I guess part of my reservation with this method comes from pegging the project to exact versions of various libraries. If we do that, then we're required to update the requirements every time a new version of a dependency comes out. Hopefully most maintainers are not breaking the api or core functionality of their libraries with new releases, so we would be increasing the amount of work we had to do to maintain the library. Obviously this would not always be true, in which case we'd have to update diesel to use the newer version of the api or impose a maximum version, but doing that on breakages (as opposed to every new release) is a lot less overhead. I could be convinced otherwise though--I've never used `pip-dump` to manage dependencies, so I don't have any experience.