tree e9c560d1be4913db3c85dd83fad533b17d86ddf1
parent a523b96484c1698b2a3b5e83fc78d55564c20aec
author Matthias Sohn <matthias.sohn@sap.com> 1649665657 +0200
committer Matthias Sohn <matthias.sohn@sap.com> 1649676480 +0200

Use original servlet-api 3.1.0 artefact instead of tomcat's copy

Gerrit uses tomcat's copy org.apache.tomcat:tomcat-servlet-api:8.5.23
of javax.servlet:javax.servlet-api:3.1.0. Earlier we used Jetty's copy
of the servlet-api which was replaced by Tomcat's copy in
change Ica04d0c19306da9afcadf3919581632f7df93483

This hurts us since Whitesource scans raise Tomcat 8.5.23
vulnerabilities for this dependency since it's not smart enough to
recognize that we only use the Tomcat servlet-api artefact which has
no vulnerability.

Use the original servlet-api instead of Tomcat's copy to get rid of
this issue.

Change-Id: I800d8429f08894f29eb66a0627f50ed2e55e0d54
Release-Notes: Use original javax.servlet-api instead of tomcat's copy