Codeigniter version within ExpressionEngine outdated? Is it wise to update?

Question

Is there a specific reason that even the most recent ExpressionEngine installs (as of writing, 2.8.1) are built upon a seemingly outdated version of CodeIgniter (2.0.1), when CI 2.1.4 is available?

And is it possible to manually update that Codeigniter instance to avoid security issues – or does EllisLab use a custom build of CI that should not be tampered with?

(Context: A malware scan has listed my ExpressionEngine installs as outdated (and in need for update) because of the version number of Codeigniter install within.)

Answer 1

Just to clarify, we definitely use a forked version of CI with security holes patched as we find them. We also apply any security patches to the public version of CodeIgniter. Don't update what's there as that would cause compatibility issues.

Answer 2

EllisLab has forked the official CodeIgniter version and are using their own internal one. I highly doubt you can replace this with the official one.