Use requirements.txt volatile. We use a separate file to list the direct dependencies, 'ddeps.txt' and 'ddeps-dev.txt' for development deps. Once we update on

Use requirements.txt volatile. We use a separate file to list the direct dependencies, 'ddeps.txt' and 'ddeps-dev.txt' for development deps. Once we update one of these files a clean venv is created, the dependencies installed and the freeze output saved as requirements.txt. Then the dev dependencies are installed and the output of that freeze is saved to requirements-dev.txt. This preserves the dependencies where we made the conscious choice to require them and also allows us to explicitly vet any new dependencies and versions.