The XZ Utils project, a widely used lossless data compression utility in Linux and Unix environments, has officially released version 5.8 — its first significant update following last year’s security crisis, when a malicious backdoor was discovered in version 5.6. This new release, announced on March 25, 2025, signals a renewed commitment to security, performance optimization, and transparency.
One of the most notable improvements in XZ 5.8 is the use of SSE2 intrinsics in the LZMA/LZMA2 decoder on x86 and x86_64 architectures, replacing traditional memcpy() operations. This enhancement results in decompression time reductions of up to 5%. Impressively, when built against the musl C library, performance gains can exceed 15% for highly compressed files.
Performance improvements don’t stop there. XZ 5.8 introduces optimizations for 64-bit POWER and RISC-V architectures, improving encoder speeds on systems that support fast unaligned memory access. The CRC CLMUL implementation for x86_64 and E2K architectures has also been entirely rewritten, further enhancing reliability and processing efficiency.
The release brings substantial updates to the CMake build system as well, which is no longer considered experimental. The configuration process now aligns more closely with established Autotools-based builds across multiple platforms, including NetBSD, Darwin, and mingw-w64. Documentation improvements have been made with a fully revised INSTALL file to assist developers.
International users will also appreciate the updated translations in several languages, including German, Italian, Croatian, Portuguese, Korean, Serbian, Romanian, and Ukrainian, along with localized man pages.
On the operational side, XZ 5.8 now syncs output files and directories with fsync() before deleting input files, reducing the risk of data loss. For users who prefer to disable this safety feature, the --no-sync option has been introduced. Furthermore, the --single-stream option now implies --keep to prevent accidental data loss.
Notably, several legacy LZMA Utils script aliases such as lzcmp, lzdiff, lzless, and lzgrep are now officially deprecated and will be removed in future releases.
The update, led by Lasse Collin, comes after a turbulent period for the project. The discovery of a backdoor in version 5.6 shook the open-source community and highlighted the critical need for vigilant security oversight in widely adopted projects. This release represents a renewed effort by the maintainers to not only restore trust but to elevate the performance and security of the compression tool.
XZ 5.8 is now available for download on the official XZ project website, and system administrators and developers are strongly encouraged to upgrade to benefit from improved performance, additional features, and critical security safeguards.
Source: XZ site
