Hold a major WordPress release back for a set number of days after your site first sees it. Security and maintenance releases are never held.