CVE-2024-3094 (10.0) in liblzma/xz

[mmomjian]

I want to bring the team's attention to the 10.0 severity CVE-2024-3094 - background.

It seems that Immich machine-learning has a dependency on xz=5.2.6, which is not a known compromised version. However, it appears that the liblzma/xz Github repo itself was compromised to execute this attack. Some other repos and Linux distros have been getting PRs trying to bump to the "update" (compromised) version of xz. Maintainers please keep an eye out for any PRs or strange behavior surrounding this package.

To be clear, there is no reason to suspect that Immich is compromised, but we should be careful for any attempts to bump the library version in the near future.