Right now, if you provide the version as WP_VERSION=5.1, it will pull in WP version 5.1, even if 5.1.1 is available. This causes issues in tests that rely on the latest WP version, like the checks in the wp-cli/doctor-command.

It would make more sense for the WP_VERSION to behave more closely like semantic versioning.

So, if 5.1.2 would be the latest available version:

• WP_VERSION=5.1 => "use latest patch verison for the 5.1 minor version" => installs 5.1.2
• WP_VERSION=5.1.1 => "use exact patch version 5.1.1" => installs 5.1.1
• WP_VERSION=5.1.0 => "use exact patch version 5.1.0" => installs 5.1 (as that is the equivalent to 5.1.0.

This effectively means that all the WP_VERSION=x.x requests will always include all security patches and hotfixes.