From Fedora Project Wiki
Discussion on nss update best practices, preflight and testing before major builds.
Why are NSS rebases happening in stable branches of Fedora? Package_update_guidelines#Stable_Releases suggests to just fix bugs there...
Yes, there have been too many updates, partially due to ignorance in my part. Expect one or two per year. Some will be driven by security updates and others driven by the aggressive schedule that Mozilla Firefox is imposing on nss upstream. That can and is already being tamed downstream by the desktop applications team and and I will follow suit. Most things can be addressed via patches.