Incorrect version installed with Composer

When installing this plugin via wpackagist (https://wpackagist.org/search?q=miniorange-saml-20-single-sign-on&type=any&search=), it thinks version 4.9.70 is the latest, but this appears that it was a typo tag and was reverted. The 4.9.70 tag directory still exists in the svn repo though. Right now it seems to install different versions of the plugin, sometimes 4.8.70, sometimes 4.8.95.
Thank you.