When #330 was merged it did not update the build configuration for the project to no longer build Python 2 compatible wheels. You can see on https://pypi.org/project/Flask-Cors/4.0.0/#files that the wheel is marked with Python 2 support. This results in the 4.0.0 release being pulled down in a Python 2 environment even though support has been removed.