Why does Vaadin 7.2 have two versions of commons logging jars?

Looking at the distribution, I see commons-logging-1.1.1.jar and commons-logging-1.1.3.jar. Is this some sort of mistake?