I've just looked at versions-maven-plugin, where a custom XMLEventReader (ModifiedPomXMLEventReader) is used to rebuild the pom file.
A custom class is used because "StAX API (JSR-173) are not good round-trip rewriting <b>while</b> keeping all unchanged bytes in the file as is. For example, the StAX API specifies that <code>CR</code> characters will be stripped. Current implementations do not keep " and ' characters consistent."
