Did Framework CodeIgniter Need Up-To-Date Consistently?

[eluser]queencode[/eluser]
I want to keep a discussion about framework and CMS, for example between PHP framework CodeIgniter and CMS Wordpress. As we know together, CMS need to consistently update regarding reason of security. Maybe you can see the vulnerability of timthumb that many WP theme use that.

My question is: Did CodeIgniter framework need update consistently as same as WP, for example CI version 1 -> version 2 and later if come new version we need update again? As we know together, in framework we develop by self but in CMS just install only. If we still use CI version 1, Is the good for security?

Please help to share about the case. Thank you