Ideally, code revision system should be used, with release branch only having changes that match public release.
That way hotfix would be based on released version, reducing chances for injecting new issues, that could happen if hotfix is based on current dev code.