The OpenBSD project maintains its own fork:

https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/cvs/

It's not especially active, but you can see the last change sets were in the past year, so "not maintained for more than a decade" doesn't apply to what they're using.