What's the requirement for a package to be updated?

Development Security
3

There is an interesting discussion around the time it takes to deliver security updates in Timely updates for NixOS