To Upgrade or Not To Upgrade?
 

I download security patches as soon as I find them. However, for something such as upgrading 3.8.4 to 3.8.5, how useful is it? No doubt there are some enhancements/bug fixes in the newer version. But how do upgrades like that affect security? If it turns out there's a big XSS flaw in the coding, would vBulletin release a patch for 3.8.4 rather than forcing you to upgrade to 3.8.5? I ask because when I signed up for vBulletin (about a year ago), the latest version was 3.8.3. Since then, I've upgraded all the way to 3.8.5. Some of the mods I've gotten from vbulletin.org were written in the early days of 3.8.x, and I'm pretty sure one of the ones I'm using is no longer being supported. I don't want to compromise security, but if updating from .5 to .6 (when the day comes) makes no difference with security, and I can keep on using a great forum with functioning modifications, then do I necessarily need to upgrade my forum?