The one thing about pipenv that prevents me from using it in more projects is that it refuses to not upgrate a dependency. If I install or upgrade a dependency

The one thing about pipenv that prevents me from using it in more projects is that it refuses to not upgrate a dependency. If I install or upgrade a dependency, every dependency is upgraded. (I'm not sure what `--keep-outdated` is supposed to do, because it definitely does not keep outdated dependencies.) First of all, it's surprising and unpredictable. (Why would `pipenv upgrade requests` upgrade boto3?) It also prevents me from controlling change (and therefore controlling risk). I'm responsible for everything that gets deployed, so when I upgrade a dependency it is deliberate, isolated, and well-tested. I can't do that with pipenv. I understand that they want to encourage keeping dependencies up-to-date, but I think the proper approach to this is npm's, where it informs me about outdated packages, but lets me do what I will with that information. So, for the moment, I'm still in the dark ages of manually pinning everything into `requirements.txt`.