The security issues are not very urgent, I assume?

The security issues are not very urgent, I assume?

It depends on your threat model. I could argue for both sides — not to underestimate or not to over-panic. I cannot rule out that some of these may lead to more than denial of service (e.g. code execution) and some parties have assigned 8 out of 10. At the same time, I'm not aware of exploitability without large files and exploits beyond DoS are not something I know of. There is one individual on Twitter, who commented that one of these was a past zero-day of them, but I have not heard back from them, if they got more than DoS out of them. @vcunat does that answer the question?

Well perhaps. With the usual way through the staging branch and our current resources, I expect it can take even something like a month to get into nixos-unstable channel. (Stable 21.11 tends to iterate faster.)

Think we should get this merged to staging ASAP and then consider if we do a forward-port. Staging will give us a chance to discover any show-stoppers.

(have also successfully built python39 with this against master on macos 10.15, nixos x86_64 along with pkgsMusl and pkgsCross.aarch64-multiplatform variants)

staging-next seems the only other realistic option, and the sooner the less rebuilds we'd waste. It would get into nixos-unstable a couple weeks sooner but push back other changes about one week later (or more if we decide later).

staging is the cheaper option, and the timing doesn't really matter, as long as the merge happens before the next iteration starts.

Successfully created backport PR #156149 for staging-21.11.