Clojure itself does not use or depend on lzma. Can you share links to the conflicting stuff re jvm?

It was on social media so I'll probably never find it again... Some people claimed that some jdk builds used xz/lzma then others argued that it only concerned certain libs that pulled that specific library in through ffi, but i couldn't track the convo any further

There's evidence that the bad actor committed to the xz-java package. So consider that tainted for the time being. I haven't seen anything specifically about xz in any Java builds, but if I do I'll let you know.

I would be surprised if Java builds used that

Oh, definitely not in the Java build. But it's a route for exploits to be in other projects.

I guess this should be a pretty scary lesson to enterprises about supply chain security huh