My approach: keep my "raw" requirements.\.txt files in a ".requirements" directory in the project root. The packages listed here mainly are bare, without a version qualifier. I run the script at https://gist.github.com/nicois/b49deb1f92e9f504cd93715a78440... This creates matching requirements. files in the project root, with specific python package versions for everything. Both sets of files are checked into the repository. Periodically, I re-run the gist, which updates the requirements in the repo.

IMO this is the best of both worlds: in the "bare" requirements I only put what I want, and the derived requirements file is a fully-defined list of what I need.

This means each commit in my repo is not susceptible to third-party changes: when my tests pass on a given commit, it will pass every time in the future too. I can decide when I want to refresh the requirements, and it's a simple one-liner.