The current stable branch of NixOS receives the least bad maintenance (i.e. timely security updates).