Hey @danielbachhuber,
Thanks for following up.
So I tracked it down that our Upstream devs were actually grabbing the package precompiled and offered via the Download option at https://simplesamlphp.org/download (which matches Pantheon.io’s instructions here). They have not yet configured true Composer-based workflows.
The composer.json file lists "twig/twig": "~1.0 || ~2.0",, but the ~2.0 files are already downloaded within the package.
To remediate, I altered the composer.json file, recompiled, committed the changes, and pushed up to Pantheon.
Note
I think, though, that you might have misunderstood the root (possible) issue.
When you think about it, the issue already existed that the TWIG template files were being pulled from the simplesamlphp library (instead of the timber-library plugin), I was just unaware of it.
It feels like even if simplesamlphp loaded the Twig 2.x files, those files should only be loaded for simplesamlphp (or not loaded at all, if currently unneeded).
Instead, the wp-saml-auth plugin is overriding the TWIG library provided by the timber-library plugin.
