The message basically means that the version of servlet-api would have transitively been 2.3 (so basically in commons-logging’s pom they define servlet-api with version 2.3), but that version 2.5 was specifically asked for in your project, so that is what was used.
Same goes for the scope. In commons-logging’s pom it is defined with scope compile, but you have it defined with scope provided, so again that is the scope that was used.