Rails 7.2 stopped receiving security patches on 9 August 2026. Rails 8.0 follows on 7 November 2026, and after that Rails 8.1 is the only series still receiving them. Ruby 3.2 went end of life on 1 April 2026.
If you are assessed against PCI DSS, SOC 2, HIPAA or ISO 27001, that is not a preference about upgrades. It is a control with a number attached, and an assessor who will ask you about it.
The trap most teams find halfway through
Old Rails versions impose a maximum Ruby version, not just a minimum. Rails 6.0 caps at Ruby below 3.0. Rails 5.2 caps at below 2.7. Every supported Rails release requires Ruby 3.2 or later.
So a company on Rails 6.0 or earlier cannot upgrade Ruby without first upgrading Rails, and cannot upgrade Rails without first upgrading Ruby. No single upgrade resolves it, and the gap widens on both axes at once. Teams routinely scope one axis, start work, and discover the other.
See the exact path your versions force, including the days each has gone unpatched and the controls it implicates.
Three ways to answer the finding
Start with the assessment
PCI DSS 12.3.4 requires a remediation plan approved by senior management for any component no longer receiving vendor security fixes. Most teams do not have that document. It is the first thing we produce.
The Remediation Assessment. Component inventory, the 12.3.4 remediation plan itself, the upgrade path across both Ruby and Rails, and fixed prices for each phase that follows.
If the assessment concludes you should not do this work, or should not do it with us, you pay nothing.
Remediation is quoted from the assessment findings. Every codebase is
different, and anyone quoting an upgrade without reading your Gemfile.lock is
guessing.
How an engagement works, and what the assessment contains
Why one engineer, and why this one
Twenty years building systems where being wrong was expensive: a real-time credit bureau at 99.99% availability, healthcare, payments, and an event-driven platform on Elixir and Kafka. Reid Morrison does that work himself. You are not being sold a principal engineer and handed a junior.
He maintains 11 open-source Ruby libraries with over 79 million combined downloads, and shipped new versions of four of them in July 2026 using agentic workflows. Those diffs are public. You can audit how he works, at what increment size and in what order, before you hire anyone. See the libraries.
The failure mode with AI tooling on a production upgrade is not that it is too slow. It is that it is too fast. The value is knowing which step happens first and how little to change in any one iteration, and that comes from having done this before on systems where a bad deploy had consequences.
Where the work happens is your choice, and there are three postures: our own managed machine, your Anthropic tenancy, or a virtual desktop you supply, on which your source code is never downloaded at all. Whichever applies goes into the agreement rather than being promised in a meeting. How we work with your code.
Who this is for
Mid-market companies in a regulated scope, weighted toward SaaS, healthcare, insurance and payments, running business-critical Rails applications on unsupported versions, with something forcing the timeline: an audit date, an enterprise deal blocked on a security review, a penetration test finding, or a specific unpatched CVE.