Make sure your distro provides security updates for git. For instance, CVE-2018-17456 (another RCE via submodules bug) was recently disclosed and patched in Debian Jessie (oldstable), even though jessie has git 2.1.x which may not be getting updates from git core developers.

Otherwise, old and new git interact really quite well. You'll miss out on new features, naturally. Because of reasons, I still make daily use of 1.8.2.2 and it's fine! (but only when interacting with trusted peers within my organization, that thing hasn't seen a security patch in a decade or so)

As for release notes, every release gets its own file here: https://github.com/git/git/tree/master/Documentation/RelNote... -- you'll get the highlights of major features by reading the x.y.0 release notes.

Git is not a hard build from source as such things go, but it leaves you to track security fixes on your own.