In case you choose to provide your own MyFaces JSF implementation during installation, the installer will install bundled unproductized artifact commons-digester-1.8.jar

The artifact should be productized, furthermore the version of it should be parametrized in pom.xml of the installer-commons project to be able to easily upgrade.