My dependency upgrade workflow for a Python web app is usually:

    run pip list --outdated
    upgrade one package
    run tests
        if success
            pip freeze to update this package (and its dependencies)
            commit
        else
            investigate or revert and make a note for later (if many breaking changes, etc.)

(Or if you only freeze top-level dependencies, even though that goes against best practices.)

I prefer to upgrade everything and fix things that break. I've always been able to easily figure out which dependency was causing the exception after upgrading all packages, so no point in upgrading them individually for me.

Also, I don't manually update my packages. My build scripts do that for me from my requirements.txt file, so it makes sense to update requirements.txt first.

The only solution I know of to this is to "unroll" all those dependencies into your own requirements.txt, and manage them the same way.

For some projects I work with this is actually the only option, since I have to use requirements files with hashes and those are all-or-nothing -- even a single dependency-of-a-dependency that doesn't specify a hash will break the install, so I have to track down all of them and get a hashed entry into my requirements file.

Seems optimizing for the happy path (nothing breaks) could save some time.

   pip list --outdated | sed 's/(.*//g' | xargs pip install -U
   pip freeze > requirements.txt

Another similar easy option is pip-review.

https://github.com/jgonggrijp/pip-review

If you want to automate updating your requirements file, take a look at requires.io [3].

[1] https://github.com/nvie/pip-tools

[2] https://github.com/jgonggrijp/pip-review

[3] http://requires.io/

Upgrading packages doesn't work for me because I need my build scripts to do the upgrade. For example, when installing some packages which have C bindings they fail unless certain flags are set correctly.

Requires.io is cool, I personally use Gemnasium [1] for the same thing. However, both tools don't update your requirements.txt file for you, they just notify you when you need to update it.

[1] https://gemnasium.com/features

IMO this is the best of both worlds: in the "bare" requirements I only put what I want, and the derived requirements file is a fully-defined list of what I need.

This means each commit in my repo is not susceptible to third-party changes: when my tests pass on a given commit, it will pass every time in the future too. I can decide when I want to refresh the requirements, and it's a simple one-liner.

https://github.com/nvie/pip-tools

https://doppins.com

    sed 's/==.*//g' requirements.txt \
    | tr '\n' ' ' \
    | (read var; pip install -U $var) \
    && pip freeze > requirements.txt

[1] http://www.kennethreitz.org/essays/a-better-pip-workflow

Tools like pur, pip-compile etc. should have been included a long time ago.