requirements.txt is a lock file, generated by pip freeze, which defines the exact version of all packages in the current environment.

> Now that I’ve wrote that out, I’m wondering if packages can even pin their deps required versions. I’ve only published one python package years ago, and I can’t remember if that’s possible.

It is.