> If your app lives in a vacuum I don't see why you'd ever need to upgrade the framework. Unfortunately the only apps that live in a vacuum are embedded apps n

> If your app lives in a vacuum I don't see why you'd ever need to upgrade the framework. Unfortunately the only apps that live in a vacuum are embedded apps not connected to the internet. We should all be monitoring our dependencies for security upgrades. Eventually even a stable framework like Django goes out of long term support. I wrote a Django app in 2008 that is still in heavy use today and at some point had to go through and upgrade to a new major version. It wasn’t a breeze, it took me a few weeks. To leave the app live on that 10 year old version would have been irresponsible for security reasons. The only apps that live in a vacuum are embedded apps, like the one in a vacuum cleaner.