I am a fan of Rails and am doing some work on it, but it's pretty clear that while Rails is bumping version numbers cleanly, they aren't putting all that much work into supporting older versions. Github has been doing their own work backporting security patches to Rails 2.3 for years.