We just use this fork to publish a build of the xalan jar with the latest bug fixes.
Xalan is very seldomly released. We just publish a build (only of xalan itself) with different coordinates (and version post fixed with a -<number>). So that we can use it in other projects (well, in this case just MMBase).
<dependency>
<groupId>org.mmbase.xalan</groupId>
<artifactId>xalan</artifactId>
<version>2.7.3-1</version>
</dependency>
<dependency>
<groupId>org.mmbase.xalan</groupId>
<artifactId>serializer</artifactId>
<version>2.7.3-3</version>
</dependency>