@romin @mona @bronze
I won't be so sure: https://news.ycombinator.com/item?id=39867431
According to this comment on hnews, this person was with the project long before 5.4.5 that Debian maintainers consider safe. We still can't be sure.

And how do you guys stay on old versions for so long while using mainstream architectures? :marseyemojismilemouthtighteyes:
Even PowerPC machine this instance runs on has xz-5.6.0 — and I not only have to build it myself, mainline Void maintainers don't even longer patch software to remain buildable for PowerPC :marseylaugh:
Well, I probably have too much free time :marseyshy2: