If it's already end of life you can fork it and upgrade the dependency. You'll miss nothing. This is only difficult if you need to maintain changes upstream, but that's not the case here.

Security support lifetimes make sense for a widely used language or runtime, but not really a frontend web framework on the most backwards compatible language you can have.