It's xss, so users could include javascript code in posts which would be executed in other users browsers. We announce new releases in a couple of places, like the instance admin chat, !lemmy@lemmy.ml community and github releases.