I strongly recommend https://github.com/jazzband/pip-tools https://github.com/jazzband/pip-tools to solve this. It provides a simple script to take a requiremen

I strongly recommend https://github.com/jazzband/pip-tools https://github.com/jazzband/pip-tools to solve this. It provides a simple script to take a requirements file and "compile" a full specification of all transitive dependencies. You check both files into the repo, point pip at the generated file, and manually modify the other one. It means you often don't need to pin requirements manually at all, and the versions will be explicitly updated whenever you choose to recompile your requirements.