@rune pip's just severely lacking, i think poetry is sort of fixing this (by taking inspiration from better systems like npm and cargo). To bump out versions you can just have an upgrade command that checks everything and regenerates the lockfile