Someone brought up an issue with the StAX licensem, and after digging through legal-discuss archives it seems the easiest way forward is to perhaps replace it with the geronimo stax API and the woodstox implementation.
I brought it up on legal-discuss again, but I'm not hopeful of an unequivocal answer. http://markmail.org/search/?q=StAX+(JSR+173)+License Thoughts/Objections? -Yonik