I am not sure this is necessarily the best way to determine which Tomcat version should be picked. A problem already arises if a user declares a dependency on the Servlet API library or if it is pulled in as transitive dependency of another library. I am hoping there's a better way of determining it.