It's no surprise that Xerces is involved here. Some colorful background: https://stackoverflow.com/questions/11677572/dealing-with-xerces-hell-in-java-maven
The crux is clearly that xml-apis is a transitive dependency in two places, and depending on which is elected vs evicted, it will be compile or provided scope, and therefore in the WAR or not. This case might be of interest to the reproducible builds folks, since I would have thought it was deterministic, but it seems like your pom as written currently is letting it waffle. In any case, you should be able to force the behavior to be stable by declaring a direct dependency on xml-apis. Whether it should be compile or provided scope, or if you prefer to exclude it entirely instead, will take some more work. Looking at GWT, it seems like gwt-dev is provided because it's intended for compile only, and runtime requirements are in the gwt-servlet artifact, which I presume is also declared in your pom. I suspect Xerces and xml-api, as well as htmlunit, are never needed by GWT at runtime, or are provided by other artifacts or the application server. Looking at com.megginson.sax:xml-writer, it appears to really depend on xml-api, although it is an older version. If your application still works without xml-api present, exclusion might be the best option.
