[Pkg-samba-maint] updating packages on stable?

[Michael Tokarev]

Hi!

What's the usual procedure of updating samba packages in stable?
Do we import new upstream samba-4.13.17 and upload with the new
source as 2:4.13.17+dfsg-1~deb11u1?

(why it is ~deb11 and not +deb11 anyway?)

Or do we add individual patches and release 2:4.13.13+dfsg-1~deb11u4 ?

If that's the former, is it usually okay for the
release team?

Besides, in git I see branches for debian releases
(eg buster) and for their security counterparts
(eg buster-security) - how these are managed, what's
the difference?
I usually have single branch for each debian release
(eg buster) and keep both -security and -stable in
there, releasing either to -stable or to -security,
there's no forks for -security and -stable, at least
usually - I can't imagine how one can create a fork
here.

Thanks,

/mjt