Other than security updates why can't you just freeze your dependencies as they are now? Or am I understanding you want to continuously work on it but don't want to have to fix forward version incompatibilities?
Web Framework versions go EOL and then you're forced to upgrade. So constant maintenance is required with Rails, even if you just want to put the app in "security patch only mode".
I feel like this is less of an issue for Django but I don't have any data to support that opinion.