Xz package contains a vulnerability
forum.manjaro.org
Sorry guys, I made a mistake pushing xz 5.6.1-2. It will actually be available in testing & stable shortly.