Unfortunately, that's the way it is for Mojarra 2.2.  I complained but it's really not worth fighting over.  Ed is technically correct that there is no requirement for what the API implementation can depend on.  In fact, the MyFaces version of the API jar has many more dependencies.

http://java.net/jira/browse/JAVASERVERFACES-2504