Some of it depends on the application server you use, and whether you want to bundle your own JSF version.

For instance, AS7 comes with JSF 2.1.5, but if you wanted to use 2.1.7 then you would need to include that in your WAR.

As for a maximum version, for JSF2 I don't think there is one (at least not that I've found) and with RichFaces the current Portlet Bridge 3.x series hasn't been optimized or tested for any 4.x versions yet, that will come with 3.1.  You could be ok with any version of RichFaces 4, but there may be edge cases in which you hit a problem with the current Portlet Bridge, but if you do just raise a JIRA and it will be looked at or you can provide a pull request to resolve it yourself.

Ken