They backport security updates to the existing software versions on stable, which causes the packages to be secure without introducing new behavior. Feature updates only occur with a new stable release I believe.
it is rare but some feature updates do get to stable, most software that is important to up to date with security fixes have the concept of an LTS or somethinf akin to it, firefox has ESR for example, basically it is a version where the devs will continously backport security fixes to it but not the features
How does Debian do level and security updates? Are they generally a good pace but userland starts consistent?
They backport security updates to the existing software versions on stable, which causes the packages to be secure without introducing new behavior. Feature updates only occur with a new stable release I believe.
Exceptions exist, for example rsync recently got a new upstream version to fix 33 CVEs: rsync.NEWS
it is rare but some feature updates do get to stable, most software that is important to up to date with security fixes have the concept of an LTS or somethinf akin to it, firefox has ESR for example, basically it is a version where the devs will continously backport security fixes to it but not the features