It looks as though the JDK provides its own shaded version of apache xalan.
I have found a bug in producing XML with an XSLT (bug is a new line and indentation is added within some cdata sections). This is fixed in the unreleased jdk12. I would like to avoid this situation in which I have to both wait for oracle to fix the problem as well as upgrade the JRE used.
I looked into including xalan as a dependency via maven. This does work and seems to fix the issue however it appears that the last time xalan was updated was Jul 24, 2014. That is more than 4 years since the last update.
I would like to be able to depend on xalan or something else that supports XSLT without that dependency coming from the JRE.
- Does oracle maintain its own version of xalan for its JRE independent from apache?
- Why has xalan not been updated since Jul 2014 on maven?
- Will depending on xalan cause all sorts of issues? I did see in Dealing with "Xerces hell" in Java/Maven? that xml-apis was excluded to try and avoid some issues.
- Would it be better to use a different XML library that is less likely to be also used by the JVM? What would be a library worth looking into.
Trying to answer as best I can (but some of your questions require inside knowledge):
As far as I can tell, the JRE versions of Xerces and Xalan are modified versions of Apache Xerces and Xalan, but not heavily modified, and there is some effort to port bug fixes across from the Apache version.
Xalan has not been modified because no-one is working on it. Its original sponsors were IBM and Sun (it derives partly from IBM's LotusXSL, partly from Sun's XSLTC). Sun's developers left after the Oracle acquisition; IBM moved its investment into the commercial Websphere XSLT 2.0 processor and the Datapower engine. So Xalan remained as an XSLT 1.0 processor, which means the specification has not changed in 19 years, and the code became correspondingly stable so there has been little need for bug fixing. Users who need more functionality than Xalan offers typically move to Saxon, unless they have the kind of budget that makes Websphere or Datapower affordable.
No, it's quite possible to have an application use the Apache versions of Xalan and/or Xerces without running into any technical problems.
(I have an interest here) Moving to Saxon gives you all the functional and productivity benefits of XSLT 2.0 and XSLT 3.0; the product is continuously developed and maintained and well supported; in some cases you may see a substantial performance improvement; and there's been a lot of incremental improvement over the years in areas such as diagnostics, configurability, and instrumentation. But the benefits have nothing to do with whether or not the code is also used in the JVM.