A new release every 6 months, and the old release almost immediately stops getting any more updates.
Also, from a vulnerability management perspective, NixOS is terrible. If you have some compliance monkey at your company that demands CVEs get resolved regardless of impact, NixOS is the wrong choice. Yeah, they'll patch CVEs that are truly impacting, but for non-impacting CVEs, they're not nearly as interested at backporting fixes as Debian or Ubuntu. From an actual security standpoint, it's fine, but if compliance requires you to resolve CVEs within a certain period of time, NixOS will fail for you.
Basically, yeah.
A new release every 6 months, and the old release almost immediately stops getting any more updates.
Also, from a vulnerability management perspective, NixOS is terrible. If you have some compliance monkey at your company that demands CVEs get resolved regardless of impact, NixOS is the wrong choice. Yeah, they'll patch CVEs that are truly impacting, but for non-impacting CVEs, they're not nearly as interested at backporting fixes as Debian or Ubuntu. From an actual security standpoint, it's fine, but if compliance requires you to resolve CVEs within a certain period of time, NixOS will fail for you.