thirdpartylibs.xml says simplesamlphp 2.4.7, but composer.lock file says 2.3.7. Which is correct? Or is this version X + plus some changes?