How do I perform a critical update if my Craft site relies on older plugins? I recently came across a website in this situation and am curious to here how others approach this problem.  Here's the scenario:

A client had a website built on Craft 2.4 with a lot of integration work. The site has 10 custom plugins, integrating with several different systems and services. The relationship with the original development firm did not work out and a new development firm is picking up where the old one left off.  This means, the new team initially has limited knowledge of the 10 custom plugins on the site.

The new development firm inherits this project just as Craft discovers and releases a critical update with a fix for a security vulnerability (Craft 2.6.2791). It's in the website owners interest to upgrade to the latest version of Craft.

However, as mentioned, the site has 10 custom plugins that have not yet been updated to Craft 2.5. And, for fun, let's just say Craft 3.0 is also on the horizon.

If you are the development firm that inherits this project:


What options do you present to the new client for them to move forward?
How do you explain the costs (and the value) of why 10 plugins will need to be updated to Craft 2.5 and to Craft 3?
How do you respond if the client expresses concern that this work doesn't relate to value toward their business objectives?
I'd want the client knowingly and enthusiastically on board with a sensible plan that'd support business goals and the nature of evolving software.


Either a) do with fewer plugins/integrations, b) invest in privately upgrading the plugins, c) open source the work if possible and ask for improvements with fingers crossed, or d) rethink the site so it's less directly dependent on these plugins and thus safer from a repeat of this scenario should a-c seem unattractive. (Freezing the Craft version and avoiding software updates should be unacceptable as it's risky and invites compounding future problems—might as well pick e) move to a static site.) Re-affirm the importance of the CMS and each plugin, or remove the cruft from the equation. 
The solid and ongoing work behind Craft, and the support that comes with it, is a steal and having a well-tailored CMS likely empowers employees in various ways—decreasing dependency on (and cost of) web nerds or additional training to update content. If nothing else, staying up to date takes advantage of lots and lots of work that's included in the price of a license while keeping the site as fast and secure as possible. 
I'd encourage the line of thought and compare other ways of meeting those objectives. For example, I might contrast the (nonexistent) maintenance costs of running a SquareSpace site compared to the freedom and flexibility of hosting a Craft install. The site, as it is, is most likely supporting current business objectives and keeping it up to date will make it possible to quickly and elegantly support future business objectives with great agility. It may not be worth it, but I'd try and help them understand how much versatility they have for the (un-sexy) cost of maintenance and burden of technical diligence. Odds are they chose Craft and their custom plugins for a reason and those reasons are still vitally relevant, as is the ability to stay nimble in the future.


You might also try to get Ben Parizek on the horn and submit the whole site for a Straight Up Craft code review. In my experience, that can be one way to get rid of unnecessary plugins.