Timely updates for NixOS

[vcunat]

I might’ve misunderstood the suggestion, but I still fail to see advantages in comparison to the pure way of replacing dependencies that deals with all dependencies, assuming details like the same name+version length:

Timely updates for NixOS

I’m not aware. One full rebuild iteration takes normally roughly a week, and each of them fixes CVEs. We’re now supporting three separate branches for about a month or two, so a lag of three weeks is normal to happen, I’m afraid. Right now 22.11 has the lowest priority of the three AFAIK. BTW, there’s replaceRuntimeDependencies as well, e.g. see OpenSSL 3.0.7 update (2022-11-01) FAQ

I mean, organizing more use of that seems better to me than trying to come with something similar again.

EDIT: and of course, then there’s this one already, too:

Timely updates for NixOS

Sounds like it is about time to revive Shipping Security Updates by nbp · Pull Request #10851 · NixOS/nixpkgs · GitHub … When I created this branch, people told me that this was not worth the complexity because security updates were shipping the next day.