Since java 1.5 the jdk itself contains a SAXParser, OutputFormat, XMLSerializer and so on so actually we could simply use those and completely remove the isolated xerces from our bundles.

(We're currently using xerces 2.8.1 from 2006 - latest version would have been 2.11.0 from 2010 but that one internally uses xml-apis that are banned from our poms because that's know to cause many problems).