Do not use org.glassfish Mojarra 2.4.0!

Look, there's a Mojarra 2.4.0 in Maven Central!

What is this? Is JSF 2.4 already there?

No, JSF 2.4 is not there. Technically speaking, Mojarra 2.4.0 represents the latest state of the master branch as it was during the transfer from Oracle to Eclipse. That transfer took place when JSF 2.3 specification was already released and JSF 2.4 specification has still to be started yet. JSF 2.4 is far from being a beta, let alone a reasonable snapshot. And yet there is a Mojarra 2.4.0 in Maven instead of e.g. a Mojarra 2.4.0-M1. As per the agreement between Oracle and Eclipse, it was necessary to release the latest work on Mojarra under Oracle's umbrella into Maven Central before the transfer to Eclipse was completed, and this had to be done without making any code modifications, even pom.xml version changes are not allowed and thus the version couldn't be modified. And later Eclipse will do the same after the transfer is completed so that the integrity can be validated by the public. Using version "2.4.0" is indeed way too confusing for the public, because does actually not at all represent a real "2.4.0" version, but it is what it is.

In other words, you should not use it. Mojarra 2.4.0 is basically somewhere in between Mojarra 2.3.3 and 2.3.4. A few days later, Mojarra 2.3.4 was released. Use this instead.

<dependency>
    <groupId>org.glassfish</groupId>
    <artifactId>javax.faces</artifactId>
    <version>2.3.4</version>
</dependency>

Or, if there's already a newer 2.3.x version available, obviously use that instead.

After the transfer to Eclipse, we'll as first step change the package name from javax.faces to jakarta.faces (and thus also the Maven coordinates) and bump the version to 3.0 for Jakarta EE 9. In other words, there will never come an official release of JSF 2.4.