There is a week since Drupal 6.30 is released to fix some XSS vulnerability, but Pressflow is still on 6.29.
I am wondering if it is discontinued. If so, are there any new forks that up to date?
There are a few questions here:
Well, it depends on where you want to go to get news and what your expectation is. Drupal 6 and Pressflow 6 are pretty slow in terms of news. They are stable except for these security updates. I think it's reasonable that the promotion/updates about it are minimal beyond what is necessary for development. If you want to know what's going on (including the sate of the last release) check the issues and pull requests. And if you went there on January 15th you'd see a pull request that you could try out to get the security update and help in the process of releasing the next version by providing a review.
Peter Wolanin (and Gabor Hojtsy, I'm told) are now able to commit changes to the Pressflow repository on github. It seems likely that they are interested in Pressflow because many of the users of Pressflow are clients of Acquias. Peter and Gabor are both Security Team members (and Gabor a D6 maintainer) who stay aware of the core security releases. So, I think it's safe to say that updates will flow more quickly in the future.
No, it is still being kept up to date, but it will always take a few days after an official Drupal core release before Pressflow is updated as they are making sure that new changes don't interfere with the Pressflow code in core. From the FAQ:
When there is a new version of Drupal, does Pressflow also get updated?
"Yes! All patches and security updates provided for both Drupal 6 and 7 are also be applied to Pressflow 6 and 7. We will release updates to Pressflow in a few days after they are available on Drupal.org."