As a matter of policy, are -stable packages updated for security fixes?

I know that used to be the case, but as of today (40 days after 4.2 was
released), there are *no* 4.2-stable package updates shown at
http://www.openbsd.org/pkg-stable.html.  In contrast, there are 183
4.1-stable updates shown (accumulated over the roughly 7 months from
4.1-release to now), and 249 4.0-stable updates shown (presumably
accumulated over the year from 4.0-release to the end of 4.0-stable
updates when 4.2 was released), and my memory of past releases (going
back some years) is of a similar steady trickle of -stable package
updates (often described as security fixes).

So, am I just "lucky" that no bugs-important-enough-for-stable-updates
have been found in any 4.2 packages yet?  Is there somewere other than
http://www.openbsd.org/pkg-stable.html that I should be watching if I
want to keep -stable packages up to date with security fixes?

ciao,

-- 
-- Jonathan Thornburg (remove -animal to reply) <J.Thornburg@soton.ac-zebra.uk>
   School of Mathematics, U of Southampton, England
   "Washing one's hands of the conflict between the powerful and the
    powerless means to side with the powerful, not to be neutral."
                                      -- quote by Freire / poster by Oxfam