The Phoenix framework is notorious for its long term stability and dependability. Unlike most comparable projects, the Phoenix team actively supports four release series for security vulnerabilities (currently 1.5.x-1.8.x).

Backwards compatibility and the long support window reduces the incentives for migrating to a newer series. So, seven months after being released, what fraction of the ecosystem has 1.8.x reached? Where is 1.7.x at?

I explored the public download data from Hex.pm to get the answers, and also discovered how fast patch versions get picked up. Looking at recent security advisories, leaving production apps unpatched has tangible consequences.