[n8henrie]

Depending on the project I've often done both, with something like `pip list --not-required | awk something-to-strip-versions > requirements.txt; pip freeze > requirements.lock`, I generally keep both in VCS so I can easily install all up to date versions for dev, once it works fine and tests pass overwrite the "lockfile" (problems with transitive dependencies acknowledges, probably not the right word), end users can fall back to just installing from the lockfile if not doing dev work.

EDIT: re: cross-platform concerns, I'll also note that since moving to an M1 Mac I've never been so annoyed with the Python packaging situation, and even my own libraries are routinely broken without obvious paths forward. Learning docker as a result, and looking to rust for new projects.