What do you mean? `pip freeze > requirements.txt.lock` will freeze all your current deps, including transitive.
This is only practical if you only have one set of requirements.
If you have multiple sets of requirements (for dev vs testing vs production, eg), this becomes impractical real quick. You'll essentially have to tear down and rebuild your dependencies multiple times to update your reqs.
We are using `pip-tools` to manage that: https://github.com/jazzband/pip-tools