Obviously everyone has different situations. But if all you need are security updates, the Rails team has historically been very good about providing patches even for unsupported releases. If they don&#x27;t, porting is often fairly trivial anyway. I often see ronin [1] implementations of exploits very soon after a CVE so you can even test against your own app.<p>Unfortunately, my point was more that you can&#x27;t just not upgrade Rails. Eventually everything else you use will require newer Rails and upgrading at that point becomes extraordinarily difficult. E.g., ActiveRecord plugins often just monkeypatch the internals, which are naturally free to change from release to release. However, most gem authors don&#x27;t want to test against multiple versions, so the latest becomes the only supported one and you have to upgrade &quot;just because.&quot;<p>[1] -- <a href="https:&#x2F;&#x2F;github.com&#x2F;ronin-ruby&#x2F;ronin&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ronin-ruby&#x2F;ronin&#x2F;</a>