I've had a Django app running for 3+ years (stick to an LTS release) and it requires a very occasional security update (months in-between) but generally it's a 5 minute change to update the version, run the test suite and then push to prod