Apache no longer maintains Xalan-C, it is dead and won't receive security updates. Prodded by Roger Leigh (upstream maintainer), thanks.
