In general, packages for a given release are not updated until the next release (Open BSD lacks the developer resources for providing updates to packages on versions other than 'current').
If you want to upgrade your packages more regularly, you either need to use ports, or upgrade to a new snapshot, and then run pkg_add -ui again.
Update If Unmodified /etc/ /var/ /root/ /.cshrc /.profile# When upgrading to a new Free BSD release, files which match Merge Changes # will have any local changes merged into the version from the new release.
Merge Changes /etc/ /var/named/etc/ /boot/device.hints# When upgrading between releases, should the list of Components be # read strictly (Strict Components yes) or merely as a list of components # which *might* be installed of which Free BSD Update should figure out # which actually are installed and upgrade those (Strict Components no)? More information about Free BSD security advisories can be found in Section13.11, “Free BSD Security Advisories”.
For further reading, check: practice, this means that as soon as a security fix/update is committed to the OPENBSD_5_3 tree a package will be built from the CVS tree.
This package is then being tested and pushed to our fan-out server over at Stable. I needed to get updates because I installed bash and didn't want to suffer from the Shellshock vulnerability, so I went with Holu's suggestion https://unix.stackexchange.com/a/103661/93476 and it got me patched up.
The only issue I see is about the postinstall and MAKEDEV scripts which COULD be failing, but are not, so far so good.
Section30.4, “Fetching by CVS” informs about the ways to retrieve or update the sources for a release, stable or current branch (using CVS).
On Net BSD, you usually upgrade pkgsrc to the latest version (which is nothing more than tar -xvzf gz) and updates the installed software individually.
More information on the Net BSD/pkgsrc website: Hope this helps!
A common mechanism for upgrading a Net BSD system to a newer version is by rebuilding the system from sources and installing the results.
This works both for stable releases such as Net BSD 5.0 and for Net BSD-current.