For integrating with JAAS, ModeShape depends on the javax.security.jacc artifact. However, at the moment this is a compile-time dependency, which means that clients depending on modeshape-jcr will also get (among other things) the servlet-api:

 +- org.jboss.spec.javax.security.jacc:jboss-jacc-api_1.5_spec:jar:1.0.0.Final:compile
 |  \- org.jboss.spec.javax.servlet:jboss-servlet-api_3.1_spec:jar:1.0.0.Final:compile

This is not something required for ModeShape to run, so the scope of the dependency should be changed to provided