Hm, I knew less about packaging than I thought. I kind of assumed it was mostly automatic updates after the initial package, and only fixing things on major changes.
Anyway, looking at the different tables, it doesn't seem to me that Guix is especially behind well known distros, and there's a low percentage of problematic issues: https://repology.org/repositories/statistics/pvulnerable
Perhaps it would be more telling to see how long packages are outdated on average? dunno..
In the case of Guix, it's just updating the version and the SHA-256 hash. But the bigger issue here is how hard GNU software is for contributions. I can't do patches, because I do not want to jeopardize my email across the internet.
you could create another email account with a pseudonym
Hm, going slightly ot here. I wonder how long it will take before an 'package maintainer' AI is developed. Imho it won't take long before we see the first semi-automated packager/pkg manager. I think we have all the open source parts, but not the agent network that does the actual work, yet.
With a dedicated package agent, guix and any other smaller distro would be right behind the big ones.
You mean packages? And the link is just the graph, no other information or anything 🥲
Oh yes, about that, you can view them here: GNU Guix repository information. For some reason, the maintainer graph is at zero, which is hilarious.
