Wait till you have to keep up with the changes when 3.1 then 3.2 come out six months within each other, and start to change and deprecate things that you learned in 3.0.x
You don't have to keep up if you don't want to. Your apps will not stop working if you choose not to upgrade. I have apps still running on Rails 1.x and 2.x. They don't get huge traffic and they are meeting the customer's needs. There would be no business advantage for these particular customers if I had to charge them to upgrade.
Yes you do have to keep up. Because one day you'll go install your 2.3 app on a new server, and you'll have an incompatible version of some library because Rails 2.3 didn't specify version number dependencies.
Like what happened to Rails 3.0.7 and Rake 2 weeks ago.
That's why you use Bundler. In my experience Bundler solves this problem 100%. Lock your gems and get Ruby from RVM and the chances of nasty surprises are next to nil.
I wish the Rubygems guys would put down the crack pipe though. They're the one problem in this setup and, admittedly, they're a massive problem :(
It's not just security (and other) patches for Rails, it's maintenance for the assorted plugins one inevitably ends up using.
If you've a Rails 2.x app with plugin ActsLikeWhatever, and you run into some problem with that plugin, chances are the fix will only be in the newest, non-Rails2, release.
It took me five minutes of reading the changelog to figure out what I have to stop using in 3.1. There are additional features that can be integrated into a workflow at whatever pace is desired. People are making a bigger deal of this than they should, I think.
