Web Framework versions go EOL and then you're forced to upgrade. So constant maintenance is required with Rails, even if you just want to put the app in "security patch only mode".