WordPress core
Security fixes applied quicklyPoint releases from the WordPress security team go on within days, because they patch holes that are already public. A major version, by contrast, waits until every plugin your site relies on has been made ready for it.