xz is also used in Windows and who knows what versions or how it is used there (impossible to verify because of the closed source nature of the windows ecosyste

xz is also used in Windows and who knows what versions or how it is used there (impossible to verify because of the closed source nature of the windows ecosystem) if Microsoft security detected some kind of relations between xz and exploits injected into the Windows source code/build process, they are pretty much 100% going to order github to nuke the entire repo regardless of what other people in the open source community thinks or wants. https://en.wikipedia.org/wiki/XZ_Utils https://en.wikipedia.org/wiki/XZ_Utils