[mattbillenstein]

I use pip-compile in my flows - it's the best of both worlds, you get your declared direct dependencies via requirements.in, and the full blown locked dependencies then in requirements.txt. It's my preferred way to manage this now.

[frou_dh]

And a key thing is that both files can be committed to source control, not just one or the other.

[mattbillenstein]

Yeah, and the other bits about pip-compile -P to upgrade a single package and whatnot are very handy.