Counting from the moment the fix is made/committed to when it
*needs* to be into a release.

* security: few hours if possible, less than 2~3 days at worst
* show-stopper: few hours to less than 7 days at worst
* bugfix: 2 weeks ~ 1 month
* "fix typo": 6 months, 1 year at worst

Ultimately all changes should be released after a year to avoid
ending with a gap between the release and version-control.

And not all are released immediately to avoid tagging releases too frequently.