We currently provide xalan.jar and serializer.jar in tomcat/endorsed, both in the installer and in the Distribution zip.
This causes problems because that version also contains an outdated version of BCEL which comes before the one we ship. (see
MNT-8800 and MNT-8826).
It also means that the deployment on non-Tomcat application servers is more complex, because xalan is not in the war.
The documentation says
Some Alfresco features require Xalan and its dependencies to be in the endorsed directory because they use XSLT features that are not available in the xsltc implementation built into the JDK.
but this is probably not true any more, according to the various wise developers I could ask.
We should package Xalan in the war, not in Tomcat.