We're on a 2.x version as well. For us, it's just incredibly hard for us to justify the effort _and_ risk. Particularly, the risk. Most of us have been burned

We're on a 2.x version as well. For us, it's just incredibly hard for us to justify the effort _and_ risk. Particularly, the risk. Most of us have been burned by a major upgrade (either here or elsewhere) where things have broken in non-obvious, hard to test ways. This is particularly problematic in the dependency chain where support is limited. Breaking issues may turn us into unexpected maintainers of key libraries.