You could issue
opkg update && opkg list-upgradable
now and then. If this reports packages that have received updates, do
opkg upgrade $(opkg list-upgradable | sed -e 's/ - .*//')
to install these updates.
Updates can also be done from LuCI, but only for one package at a time. Look under Software.
Blindly upgrading packages (manually or via script) can lead you into all sorts of trouble.
Just because there is an updated version of a given package does not mean it should be installed or that it will function properly. Inform yourself before doing any upgrades to determine if it is safe to upgrade. Avoid upgrading core packages,,
I agree with @sandude. I learned the hard way not to just blindly upgrade any upgraded packages. It ended up making things not work anymore. Personally, if the firmware is working just as it is, leave it be and get the updated packages when a new release has been made. (That way, there are no kernel conflicts, incompatibility issues, etc.)
I hear you; but, IMHO, the OpenWRT developers and community are very prompt to patch any vulnerabilities and send out a release update. I will those more technical than me to discuss the possibilities of "getting owned because of an unpatched security vulnerability" but as long as your setup is good (i.e. allow outgoing traffic, block incoming connections except for those you define, etc.), it shouldn't be an issue.
Also, as far as I can tell, these git changes may related to different kernel versions or files that are WIP. I used to build my own builds off of Master and would sometimes run into issues where something might not work properly and cause the router to have problems. Or, I'd run into kernel compatibility issues. (Mind you, I'm using an Archer C7 V2 which is a problem in itself... but that's a longer story. ). Stable builds are rock solid; and, when we pull different software into our firmware (either through LuCI or CLI), then the correct version of that software is pulled in.
Again, I will let those who are more technical than me talk to the possibility of "getting owned" due to security vulnerabilities, but I think you'll be fine as is.
Hopefully there aren't any changes that affects bootup which may happen in master branch and/or going between major versions but such changes aren't usually all that well documented. Due to the design of OpenWrt in most cases you cannot reclaim used space, you can delete (hide) files but you're not able to re-use the space which makes it very easy to run out of space on devices with limited flash. If you're using master you more or less need to carefully follow commit log and have a look at the code otherwise a "stable" branch should be fine however the package tree usually lags quite a bit behind master.