The update output shows the name of the current commit your local installation is on. So if a commit is named <script>alert("xss");</script>, for example, that code will execute when someone updates their installation.
Not a huge deal since we'd notice if someone made a rogue pull request with any commit names like that before ever accepting it into the repo.
ehpersonal38
e799b7154a