Why has coverage been locked to `==4.0.3` for two years? Why not `>=4.0.0`?

If I add localstack to my pipenv, I can't lock because of this unnecessary dependency.
from __future__ import print_function
import threading
import traceback
import os
import sys
import hashlib
import uuid
import time
import glob
import base64
import subprocess
import six
import shutil
import socket
import json