Sorry, life's been quite hectic the last few days. The procedure is: once they push a release, we import it. We have a couple of patches against the last release which I always wanted to submit against CivetWeb. Not all of them are applicable for general audience, so some will remain in our realm. There is also a rather experimental fix
https://github.com/pi-hole/FTL/commit/7b8fe079ac2cae5c3b2be4dd26e553a868da6f19
but it is not a complete fix - it only fixes Lua server pages (the only ones really relevant to Pi-hole). It fixes 404 Pages (sometimes?) respond with a 200 HTTP status. I may submit it partially and leave the rest to them, it's pretty straightforward. In an ideal world, I should have time later today but ... let's say: wel'll see.
Once we have also put the Pi-hole patches in, we can have a look how/when to update the embedded CivetWeb. IMO it'd be cleaner to wait for a release, could maybe argue that it's time for another one. If they refuse this for incomprehensible reasons, we can think about migrating to their master head.