[oebs]

We follow this rule (about two dozen services with in total ~100k loc of Python): By default, use the version 1 release below the latest.

I.e. we currently run 3.11 and will now schedule work to upgrade to 3.12, which is expected to be more or less trivial for most services.

The rationale is that some of the (direct and transitive) dependencies will take a while to be compatible with the latest release. And waiting roughly a year is both fast enough to not get too much behind, and slow enough to expect that most dependencies have caught up with the latest release.

[jnwatson]

Yeah some deprecated C API stuff just got removed, so it might take me, a package maintainer, to catch up.