New feature in Mastodon 4.2 that I am very happy about: non-dismissable and very red notices for server admins when there is a new security update available.
We also sent emails to admin. This is all done locally by your instance, it (anonymously) fetches the available updates from the central api.joinmastodon.org every 30 minutes.
