@ottaross
TL,DR: doesn't really matter.
Update the one with an active security advisory first. Otherwise it might (but doesn't have to) be more reasonable to update the OS first, as if there is any dependency between those two, it's core depending on os, not the other way. However, there is possible a scenario, when os stops providing something the old core depends on, henceforth creating an implicit reverse dependcy. Personally I would consider that as a maintaining malpractice. And if os support is removed, then its usage from core is removed first, then some time is granted for all to update the core, then it's being removed from os.
But overall, if there are no security consideration it shouldn't really matter. Just don't lag behind the recent versions too much.