I recently encountered this when running hazelcast 5.3 and having version 5.0.0 of apache poi-ooxml on the classpath. This was bringing in version 2.7.2 of xalan.
Upgrading to 5.3.0 of apache.poi-ooxml fixed the issue for me as judging from the maven dependency tree xalan is no longer being used.