Well THIS was annoying to discover. I woke up one day to find my WordPress 4.1.0 was now 4.1.1. I remembered disabling auto updates in early 3.X versions, so it was even MORE annoying to discover that, as of 3.7, there’s no admin button to disable it!
Security blah blah blah safety blah blah blah… I manage my own code. Insert this into wp-config.php (I put it after the database define statements):
// TURN OFF AUTO UPDATER!
define( ‘AUTOMATIC_UPDATER_DISABLED’, true );
During an update, config.php wont be overwritten and the admin update functions remain available as usual, returning full control to admin and, of course, responsibility for updating manually.