I think it is fine to update requests via the requirements.txt file.