libraries should avoid defining a dependency with an exact match. It causes issues as soon as you want to use this library as a dependency and another dependency has a different constraint. Thus, it also forbids using bug fix releases, which seems a weird choice. Locking the dependency to an exact version is the job of the lock file