Except when there's an actual urgent patch: See recent PHP or Ruby ecosystem updates. Then you are just a sitting duck for a week