Keep a WordPress site on 4.9.x with security updates

hide-wp5-updates.php

<?php
/**
 * Plugin Name: Ignore WP5 Updates
 * Plugin URI: https://gist.github.com/nylen/44adecb537d65bd4c64be8007cd1523b
 * Description: Keep a site on WP 4.9.x with security updates
 * Version: 1.1.0
 * Author: James Nylen
 * License: GPLv2 - https://www.gnu.org/licenses/gpl-2.0.html
 */

function nylen_ignore_wp5( $response, $request, $url ) {
	// If this isn't a request to the updates API, ignore it.
	if ( ! preg_match(
		'#^https://api\.wordpress\.org/core/version-check/#', $url
	) ) {
		return $response;
	}

	// Unpack and inspect the data from the updates API.
	$body = json_decode( $response['body'], true );
	foreach ( $body['offers'] as $i => &$offer ) {
		if ( strtok( $offer['version'], '.' ) === '4' ) {
			if ( $offer['response'] === 'autoupdate' ) {
				// If automatic updates are enabled, let them be applied.  If
				// not, the update won't show up in the dashboard unless we
				// change the response type from 'autoupdate' to 'upgrade'.
				// (Automatic update detection from wp-admin/core-update.php)
				require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
				$upgrader = new WP_Automatic_Updater;
				$future_minor_update = (object) array(
					'current'       => $GLOBALS['wp_version'] . '.1.next.minor',
					'version'       => $GLOBALS['wp_version'] . '.1.next.minor',
					'php_version'   => $GLOBALS['required_php_version'],
					'mysql_version' => $GLOBALS['required_mysql_version'],
				);
				$should_auto_update = $upgrader->should_update(
					'core',
					$future_minor_update,
					ABSPATH
				);
				if ( ! $should_auto_update ) {
					$offer['response'] = 'upgrade';
				}
			}
		} else {
			unset( $body['offers'][ $i ] );
		}
	}
	// Re-index array keys after potentially removing some upgrade offers.
	$body['offers'] = array_values( $body['offers'] );
	// Package up the response again, and return it.
	$response['body'] = json_encode( $body );
	return $response;
}
add_filter( 'http_response', 'nylen_ignore_wp5', 10, 3 );

// Change the message on the updates page to be more accurate.
function nylen_filter_wp_latest_text( $translation, $text, $domain ) {
	if (
		$text === 'You have the latest version of WordPress.' &&
		$domain === 'default'
	) {
		return __( 'A plugin is keeping WordPress on the 4.9.x branch.' );
	}
	return $translation;
}
add_filter( 'gettext', 'nylen_filter_wp_latest_text', 10, 3 );

// Optional: Enable automatic updates even for sites managed by git.
// add_filter( 'automatic_updates_is_vcs_checkout', '__return_false' );

This is a small, zero-configuration plugin to keep a WordPress site on version 4.9.x.

You can install it by dropping the PHP file into wp-content/plugins or wp-content/mu-plugins (preferred).

I wrote this because existing solutions that I have seen block all updates, including security updates to the 4.9 release series. It's a good idea to let these through and block only updates to WP 5.0 or newer.