Comment 6 for bug 491644

The internal copy of libpopt is not actually used. ./configure checks for libpopt and if it finds it (as it does on our builds) will use that instead.

But you're right that the upstream project is not active. Arguably it's very stable and requires little maintenance work from us! :) Note that Debian only has one open bug (and it's against rdiff, not the library) and Ubuntu has none. The Debian package just got a new maintainer too.