Xz package contains a vulnerability

For what it’s worth, ldd `which sshd` does not include liblzma on Manjaro ARM (presumably also not on Manjaro x86), so at least the packaged sshd is not affected by the backdoor.