It might be useful for me to add a polar opposite perspective here too — I have one (senior engineer) friend who, for personal projects, does not pin dependency

It might be useful for me to add a polar opposite perspective here too — I have one (senior engineer) friend who, for personal projects, does not pin dependency versions at all. In other words, his requirements.txt looks something like: django requests Instead of: django==1.9.9 requests==2.11.0 I can't recommend it for production projects, but it is a curious way to force yourself to live on the edge. Still, I would encourage pinning specific versions when you go from local environment to prod.