Back in December I posted about stopping WordPress from updating to WordPress 5 (which includes the terrible Gutenberg.
However, I realised soon afterwards that was the wrong thing to do; instead I should have allowed WordPress to perform minor updates within the WordPress 4 branch, which can be done using the below line:
define( 'WP_AUTO_UPDATE_CORE', 'minor' );
Once this line has been added to your wp.config file, WordPress 4 will be able to update to later WordPress 4 versions, but not to WordPress m5.