This. Using setup.py for specifying min versions (and occasionally max versions) is definitely the way to go. However, manually maintaining a requirements file

This. Using setup.py for specifying min versions (and occasionally max versions) is definitely the way to go. However, manually maintaining a requirements file in addition to setup.py is quite tedious in the long run. It is much better to freeze requirements during the build process and use the generated requirements file for deployments. But, decent test coverage is key here.