@publicvoit @phaer @sa0bse Even 23.11 got the backport right away: https://github.com/NixOS/nixpkgs/pull/323753#issuecomment-2199658842

For reference, here are the guidelines on what can make it into release branches: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases, which includes security fixes.

@publicvoit @phaer @sa0bse Also right from the beginning, 24.05 had the fix backported. The stable branch is definitely not an afterthought. Although most advanced users do indeed run unstable on their personal machines, this is not recommended for production systems.

The reason they have the same version numbers is because they're the same version ATM. 24.05 has just been cut from unstable, so the chances of any given package having diverged are low at this point.

@publicvoit @phaer @sa0bse Nix's hashes are very similar to git commit hashes.

If, in an arbitrary software project, you backported a bugfix from a stable branch into an LTS branch by cherry picking it, the new commit on the LTS branch would look very similar to the original. But their hashes would be different because the commits' parents and some metadata would be different. Same with Nix packages, and any input to a package affects the hash, even if one transitive dependency is different.