[rbanffy]

I tend to keep one CI pipeline with all dependencies unpinned (I made pip-chill for that reason) and Django set to the latest version to get early warnings of the impending doom.

That said, it takes a while for the Django folk to end support for a release so, at least, there is not much of a hurry to update a running app.