For me it’s all about security updates, so it depends on the posture. If it’s not taking external traffic, non-critical, and does something simple, it’s probabl

For me it’s all about security updates, so it depends on the posture. If it’s not taking external traffic, non-critical, and does something simple, it’s probably fine to use an old version without a lot of concern. Otherwise I’d like to see at least a steady stream of dependency updates. With Dependabot and the like this is a relatively low effort commitment to merge its PRs when they come up. If there isn’t some security auditing on it and it’s serving on the open web it’s out of the question for prod IMHO.