Arch has a policy to keep package patching to a minimum. If the newer xz version doesn't have a backdoor, they will probably follow upstream. Also, Arch doesn'

Arch has a policy to keep package patching to a minimum. If the newer xz version doesn't have a backdoor, they will probably follow upstream. Also, Arch doesn't appear to be affected by the vulnerability: >> openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. > Arch does not directly link openssh to liblzma, and thus this attack vector is not possible.