I use https://github.com/peterdemin/pip-compile-multi.

Which uses pip-tools under the hood. It even has a pre-commit-hook to make sure your packages lock files are up to date