Inside the java_cup.jar file, version.class says it's v0.10k. That is
the most recent version available from
https://www.cs.princeton.edu/~appel/modern/java/CUP/, though the Munich
site where it's now being maintained is currently releasing 11b.
runtime.jar seems to be classes generated from java_cup.jar. I haven't
confirmed that, though.
bsf.jar's org.apache.bsf.Main unfortunately does not announce its
version. The NOTICE does give it a 2006 copyright, for what that's
worth, and the contained files are dated 10/06/2006. BSFMANAGER.CLASS
does seem to have symbols for version and getVersion; it might be
possible to extract a version number from those, if it was actually set.
Yes, getting Xalan onto current versions of its dependencies and
documenting their origins is an acknowledged goal. I *think* it's an
open work item; if not, we should make it one.
There's a pretty deep backlog, though. We may need to make some
decisions about priorities.