UPM's philosophy is to use a lockfile to specify dependency constraints. The first time you press run and UPM guesses which packages satisfy which import statements, those versions are put into the lockfile.
Every Replit Python project can be downloaded and you'll have the spec file and the lock file so you can install the same dependencies locally.