I guess we should lock to a major version at least. https://pip.pypa.io/en/stable/user_guide/#requirements-files