I'd say it's worth doing, unless you intend to spin down the app entirely in a couple of years, just for the sake of security updates. You don't want to be in a situation where there's a vulnerability announced, and you can't pick up a fix without updating 6 versions, with all of the headaches that brings. It's worth devoting a few % of time here and there to bumping everything to the latest version and fixing any issues that come up, and maybe trying to move things that had been using external gems to any new internal processes that cover the same tasks.