Most upgrade shops are paid to upgrade, so they upgrade. We start somewhere else: do you actually need this right now? Sometimes the right move is a targeted security-patch path on your current major version, not a jump. Sometimes one or two risky dependencies are the real exposure, not the framework itself. We will tell you when a smaller, cheaper fix buys you the safety you came for, and when the version really is the problem. That honesty is the whole point, and it is why founders come back.
Here is the rough end-of-life picture we work from. Rails 6 and earlier receive no official security fixes. Within Rails 7, only the latest minor is still inside its security-fix window, and that window closes in 2026 - Rails 7.1 and earlier are already end of life and getting no patches, which is why apps on those versions missed the security fixes shipped in 2026. Rails 8 is the current, supported line. If you are on Rails 7.1 or below, you carry real, unpatched risk right now. If you are on a current release, you may simply need maintenance, not a project. We confirm your exact version, dependencies, and the live security-support status before recommending anything.