[drpyser22]

What would you consider a sensible solution? What about

* Pip-tools(requirements.in + requirements.txt)

* Poetry (pyproject.toml+poetry.lock)

* Pipenv(Pipfile+Pipfile.lock)

Those and others enable easy declaration of direct dependencies and compile (resolve) a lock file of the actual dependency graph with hashes. Those tools have their issues and idiosyncrasies, but the dependency declaration aspect seems sensible and functional.