[captainmuon]

So, when did universe packages get updates without ubuntu pro? Did they only update the debs for feature updates, and withhold inbetween updates if they only had security changes? That seems insane. Or did regular ubuntu (without subscription) just never update the universe packages at all?

I had the impression that, if anything, the non-main-repo things got more frequent (minor) updates.

[mdeslaur]

In the past, Universe packages only got security updates if a member of the Ubuntu community submitted a fix for sponsoring. The community can still do this, but additionally, Ubuntu Pro exists which also updates universe packages.

[noobermin]

Usually security updates for repos on gentoo I remember (not sure about ubuntu) was up to the repo maintainer, who often recieved no support. That's the price a user pays for using a non-mainline repo. I assume it's the same.

I assume repo maintainers ship security updates if it's a shipped tarball from upstream. However, some security updates are just patches, which require manual work from the maintainer. That is the issue I think, it's not as simple as delivering what upstream already gave you.

[seba_dos1]

I'd say that when maintaining a deb package for a stable distro like Ubuntu, it's much easier to apply a patch than import a whole new upstream release.