--- a/THIRD_PARTY_README	Tue Jul 30 03:02:14 2013 -0700
+++ b/THIRD_PARTY_README	Wed Jul 31 09:57:27 2013 -0700
@@ -1912,6 +1912,35 @@
 
 -------------------------------------------------------------------------------
 
+%% This notice is provided with respect to Sparkle v.1.5,
+which is included with JRE 7 on Mac OS X.
+
+--- begin of LICENSE ---
+
+Copyright (c) 2012 Sparkle.org and Andy Matuschak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+--- end of LICENSE ---
+
+-------------------------------------------------------------------------------
+
 %% Portions licensed from Taligent, Inc.
 
 -------------------------------------------------------------------------------
@@ -3169,12 +3198,12 @@
 %% This notice is provided with respect to the following which is 
 included with JRE 7, JDK 7, and OpenJDK 7, except where noted:
 
-  Apache Derby 10.8.1.2        [included with JDK 7 only]
+  Apache Derby 10.8.3.0        [included with JDK 7 only]
   Apache Jakarta BCEL 5.2 
   Apache Jakarta Regexp 1.4 
   Apache Santuario XMLSec-Java 1.4.2
   Apache Xalan-Java 2.7.1 
-  Apache Xerces2 Java 2.10.0 
+  Apache Xerces2 Java 2.11.0 
   Apache XML Resolver 1.1 
 
 

--- a/src/com/sun/org/apache/xerces/internal/jaxp/SAXParserImpl.java	Tue Jul 30 03:02:14 2013 -0700
+++ b/src/com/sun/org/apache/xerces/internal/jaxp/SAXParserImpl.java	Wed Jul 31 09:57:27 2013 -0700
@@ -112,7 +112,7 @@
     /** Initial EntityResolver */
     private final EntityResolver fInitEntityResolver;
 
-    private XMLSecurityPropertyManager fSecurityPropertyMgr;
+    private final XMLSecurityPropertyManager fSecurityPropertyMgr;
 
     /**
      * Create a SAX parser with the associated features
@@ -130,8 +130,10 @@
     SAXParserImpl(SAXParserFactoryImpl spf, Hashtable features, boolean secureProcessing)
         throws SAXException
     {
+        fSecurityPropertyMgr = new XMLSecurityPropertyManager();
+
         // Instantiate a SAXParser directly and not through SAX so that we use the right ClassLoader
-        xmlReader = new JAXPSAXParser(this);
+        xmlReader = new JAXPSAXParser(this, fSecurityPropertyMgr);
 
         // JAXP "namespaceAware" == SAX Namespaces feature
         // Note: there is a compatibility problem here with default values:
@@ -150,7 +152,6 @@
             xmlReader.setFeature0(XINCLUDE_FEATURE, true);
         }
 
-        fSecurityPropertyMgr = new XMLSecurityPropertyManager();
         xmlReader.setProperty0(XML_SECURITY_PROPERTY_MANAGER, fSecurityPropertyMgr);
 
         // If the secure processing feature is on set a security manager.
@@ -396,14 +397,32 @@
         private final HashMap fInitFeatures = new HashMap();
         private final HashMap fInitProperties = new HashMap();
         private final SAXParserImpl fSAXParser;
+        private XMLSecurityPropertyManager fSecurityPropertyMgr;
+
 
         public JAXPSAXParser() {
-            this(null);
+            this(null, null);
         }
 
-        JAXPSAXParser(SAXParserImpl saxParser) {
+        JAXPSAXParser(SAXParserImpl saxParser, XMLSecurityPropertyManager spm) {
             super();
             fSAXParser = saxParser;
+            fSecurityPropertyMgr = spm;
+
+            /**
+             * This class may be used directly. So initialize the security manager if
+             * it is null.
+             */
+            if (fSecurityPropertyMgr == null) {
+                fSecurityPropertyMgr = new XMLSecurityPropertyManager();
+                try {
+                    super.setProperty(XML_SECURITY_PROPERTY_MANAGER, fSecurityPropertyMgr);
+                } catch (SAXException e) {
+                    throw new UnsupportedOperationException(
+                        SAXMessageFormatter.formatMessage(fConfiguration.getLocale(),
+                        "property-not-recognized", new Object [] {SECURITY_MANAGER}), e);
+                }
+            }
         }
 
         /**
@@ -541,9 +560,9 @@
                 setSchemaValidatorProperty(name, value);
             }
             /** Check to see if the property is managed by the property manager **/
-            int index = fSAXParser.fSecurityPropertyMgr.getIndex(name);
+            int index = (fSecurityPropertyMgr != null) ? fSecurityPropertyMgr.getIndex(name) : -1;
             if (index > -1) {
-                fSAXParser.fSecurityPropertyMgr.setValue(index,
+                fSecurityPropertyMgr.setValue(index,
                         XMLSecurityPropertyManager.State.APIPROPERTY, (String)value);
             } else {
                 if (!fInitProperties.containsKey(name)) {
@@ -563,9 +582,9 @@
                 // JAXP 1.2 support
                 return fSAXParser.schemaLanguage;
             }
-            int index = fSAXParser.fSecurityPropertyMgr.getIndex(name);
+            int index = (fSecurityPropertyMgr != null) ? fSecurityPropertyMgr.getIndex(name) : -1;
             if (index > -1) {
-                return fSAXParser.fSecurityPropertyMgr.getValueByIndex(index);
+                return fSecurityPropertyMgr.getValueByIndex(index);
             }
 
             return super.getProperty(name);