Recent cookie enhancements in http transport added 2 tomcat depencies (tomcat-util & tomcat-apr), totalling about 300KB extra.
1. WHY tomcat 5.5, and not 6.0?
2. Without jar shading, it WILL conflict with tomcat jars bundled in jboss. What version wins and what hidden regressions may come out of it?
This should be reworked to use the latest available stable tomcat AND actual classes identified and bytecode-shaded (so they'll be in org.mule.org.apache.tomcat.util for example). This will guarantee to library version conflicts. Take a look at what e.g. MMC agent build does with some classes that we pull from the ant.jar.