This is wrong and OMG all other 15 answers to this comment even more wrong. Pinning a dependency in requirements.txt does not pin its transitive dependencies.

This is wrong and OMG all other 15 answers to this comment even more wrong. Pinning a dependency in requirements.txt does not pin its transitive dependencies. This does NOT mean you should pip freeze everything into requirements.txt, because then how do you distinguish top level dependencies from transitive? The correct answer is to use lock file. No third party tools needed (1). In Python they named it constraints and requires an extra flag to use. pip freeze > constraints.txt. Then next time pip install -r requirements.txt -c constraints.txt. Oh, and always always always use a venv for each project. Globally installed packages is a recipe for disaster. (1) Poetry and Pipenv are still nice additions, with nicer project declarations in pyproject.toml and to save you from remembering pip flags or forgetting activation of venvs. But they are not strictly necessary and it’s honestly just 2 commands extra without them.