IIRC, ORO is not used by sitemap. Rather, CForms has direct dependecies on ORO.
Might be worthwile checking if 1.4 regexps are good enough for the task.
PS I heard that 1.4.0 regexp was not good: http://marc.theaimsgroup.com/?l=jakarta-regexp-user&m=106588023307749&w=2
Oh, well, since "1.4.1 fixes most bugs", we can mandate 1.4.1 or even 1.4.2 ;-).
Ugo