Report is that shortly before the hole was reported, a PR had been posted requesting to remove the dependency on xz.