this does assume that everything in `requirements.txt` is pinned to an exact version and not `<` or `>`