Why has coverage been locked to `==4.0.3` for two years? Why not `>=4.0.0`?

If I add localstack to my pipenv, I can't lock because of this unnecessary dependency.
from OpenSSL import crypto
    if os.path.exists(target_file):
        key_file_name = '%s.key' % target_file
        cert_file_name = '%s.crt' % target_file
        return target_file, cert_file_name, key_file_name
    if random and target_file:
        if '.' in target_file:
            target_file = target_file.replace('.', '.%s.' % short_uid(), 1)
        else:
            target_file = '%s.%s' % (target_file, short_uid())
    if target_file and not overwrite and os.path.exists(target_file):
        return
    
    k = crypto.PKey()
    k.generate_key(crypto.TYPE_RSA, 1024)
    
    cert = crypto.X509()
    subj = cert.get_subject()
    subj.C = 'AU'
    subj.ST = 'Some-State'
    subj.L = 'Some-Locality'
    subj.O = 'LocalStack Org'  
    subj.OU = 'Testing'
    subj.CN = 'LocalStack'
    cert.set_serial_number(1000)
    cert.gmtime_adj_notBefore(0)
    cert.gmtime_adj_notAfter(10 * 365 * 24 * 60 * 60)