In addition to keeping Disk Station Manager (DSM) up to date you also need to keep the added packages current. Unlike DSM, package updates don’t have updates that only fix bugs and security vulnerabilities. While there may be security only patches, you have to assume that any update could bring changes to features.
Packages can be set to update automatically but in most cases I do the updates manually so that I can make sure everything is working. There have been a few cases where package updates have caused unexpected problems.
Unfortunately there’s no easy way to back out a update if there’s a problem. It can be uninstalled but this may have unintended consequences depending on the package and what changes the update made. I’ve never encountered an issue where the problem extended beyond the package being updated. For example, I’ve never had an update to Video Station break Photo Station. In a critical business environment you will want to test any package updates before installing them. A security only update may require less testing than one that changes or adds features, so the amount of testing can vary.
Package update options are configured in Package Manager rather than Control Panel.
You can configure notifications on the General tab. Desktop notifications are enabled by default but I also like to enable Email notifications so I don’t have to login to DSM to check for updates. Email notifications have to be configured in DSM for email notifications to work here.
You can also set packages to automatically install updates. There’s a check box to enable this on the management screen of every installed package, or you can manage it centrally on the settings screen. (Not all packages will support auto update, but most from Synology do support it.)
I leave auto updates turned on in some cases. Primarily for services that are open to the Internet in order to be sure they get the latest security update. I some cases I turn on auto update in order to make management easier. But even in these cases I’d prefer to leave auto updates off and be prepared to update quickly if security requires it, otherwise do some proper testing first.
There’s no control over when the updates get installed which is also another reason to do it manually. While there may be exceptions, you have to assume a package will be stopped and restarted when it is updated which could affect active users.
The package update service is nice and in some cases auto update can be enabled to ease the management burden. The interface can update all packages with just one click, so it is also easy to do it at a conveniently scheduled time.
However you do it, keeping you packages up to date is a critical task that should be done regularly.