But you think about this in a wrong way - pyramid is a "glue" framework, unlike django. - request/response (webob) gets its own updates. - templates get their

But you think about this in a wrong way - pyramid is a "glue" framework, unlike django. - request/response (webob) gets its own updates. - templates get their own updates. - sqlalchemy gets its own updates Etc. You WILL get security fixes for most of your application even without upgrading the framework itself (the attack surface for pylons/pyramid itself is smaller than monolith). By being on a lower version you don't really miss much - the API's are very stable. And 99% of time you can update pyramid version itself without risking application breakage (the chance of it is probably a lot lower than with monolithic framework). I know about very heavy websites that are still using pylons(precursor to pyramid) in production without issues (8 years now).