Hi,
while applying bedrock i found it odd to actually specify the exact wordpress version in the composer.json file.
After googling a bit I found quite a few posts from people who also find it annoying to track the latest patch version and update the file each time a security update is released. I also found the (from my experience with other dependecy management tools) expected composer option to only specify the major/minor version (i.e. “johnpbloch/wordpress”: “4.5.*”) which makes updating wordpress easier (also allows automatic CI check for a new version’s compatibility).
I would suggest adding this information to the Bedrock docs for those not yet accustomed to composer (wordpress updates are something you really will handle in any project) and maybe even as the default for the composer.json file.