The shibboleth project doesn't push their artifacts to maven central on purpose and that means that the packages that are hosted there (or on jcenter) are a little stale (3.3.0 vs 3.4.3 as of writing this ) and managed by 3rd parties. The shibboleth project offers their own maven repo but offers no guarantees wrt to performance and availability.

Now that we have an artifactory instance, we could cache the artifacts there so that we can upgrade to the latest version available.