Palo Upgrade strategy

Brand new fancy 545 cluster.
Built Globalprotect remote access on it with a loopback. Migrating it tomorrow.

Upgrade software to be sure i have the latest bugs and features and am safe from Claude-Mythic CVE-s:

sysroot0          REVERTABLE        12.1.3-h1

sysroot1          RUNNING-ACTIVE    12.1.7-h1

Globalprotect = dead

Revert to 3-h1

Globalprotect = working

Same config.

Should I wait for ONLY the Preferred releases and not even look at any other releases, bugfixes, CVE-s or not?