I do wonder about these extended periods of support. Like how many eyes are they spending on comparing vulnerabilities in 18 year old versions of, to pick a random example, libdeflate. Are they backporting security fixes? If someone goes wrong, do they have expertise on how hand or are their customers just going to go bother the upstream maintainer?<p>I've certainly run into users expecting me to make my libraries run on old versions of Python that RHEL supports even if the PSF no longer does. Some of these users don't understand that they've paid RHEL for support and they've paid me nothing, so I have no reason to give a toss what Python version RHEL supports in LTS minus 2.