only pin dependencies in requirement files