nixpkgs is the most up to date, in general. You could take a look at the few most recent bumps and see how far they were made since upstream releases. Perhaps that would either alleviate your concern or confirm it.
Also, there might be a bot auto-submitting PRs for bumping. That should be easy to find out.
That is fine – we have a special template for that. Do not forget to mention the maintainers so that they get notified.
For GNOME packages, us maintainers follow the release schedule and updates reflect that. For unscheduled updates, we typically wait for several project releases to accumulate, unless there is a reason to do it earlier.
For serious issues, we can also cherry-pick an upstream patch and apply it without waiting on a release. That requires careful review, though.
GNOME packages have automatic updates disabled since we find it more efficient to update packages in lockstep during scheduled releases.
That patch will just silence a warning, it should not have any effect on functionality.
I must have another bug then. When I update to the most recent version, the moment I login my entire system locks. And I have to revert to previous version.