In Stable it’s 5.6.0. And in Phoronix quote: “The malicious injection present in the xz versions 5.6.0 and 5.6.1 libraries”. Or am i missing something?
xz --version
xz (XZ Utils) 5.6.0
liblzma 5.6.0
pacman -Qs xz
local/lib32-xz 5.6.0-1
Library and command line tools for XZ and LZMA compressed files (32-bit)
local/xz 5.6.0-1
Library and command line tools for XZ and LZMA compressed files