Not sure if this was answered above, but it must be because of Mer's policy of avoiding GPLv3 packages for some core components. Bash 3.2 must be GPLv2, while he newest Bash is GPLv3. This policy is used to make it attractive for the vendors who are scared of GPLv3 anti Tivoisation clauses. However the assumption that all vendors are scared isn't correct, so Jolla for example shouldn't be scared in their own release of Sailfish, PlasmaActive isn't scared either, and so on.

This should be a feature in Mer, to allow using GPLv3 set of newer packages. Feel free to file a feature request to Mer.