Is there a move away from the XZ Utils component in progress?

[Ricky-Tigg]

Hello. In light of the fiasco caused by the discovery of a backdoor in the component xz in a known version range, is there at this time a consensus on compression for future releases within the RPM/DNF component developer teams, in order to consider moving away from XZ Utils, e.g. in favor of the zstd (Zstandard) component?

Components pertinent for the context that currently require it:

$ dnf -q rq --installed --alldeps --whatrequires xz-libs --qf '%{name} v. %{version}' \
| grep -E 'rpm|dnf|^libdnf|^libsolv'
deltarpm v. 3.6.3
libsolv v. 0.7.28
rpm-libs v. 4.19.1.1

P.S. xz-libs component provides /usr/lib64/liblzma.so*.

[pmatilai]

The dependency on XZ has always been optional in rpm, it's a matter of distro choice and preferences.
Older Fedora and RHEL used XZ compression on the payload, but both default to zstd nowadays. But, because XZ compressed content is quite common still, disabling it would probably be seen as an unacceptable regression. Maybe in a few years...

I'm not up to speed with what other distros do here.