Personally, I've seen JPEG XL source code and I'd rather not have it in my production, unless it's rewritten or at least security audited / Google fuzz-tested. It's a bit of a mess (the last time I checked was 6 months ago)