Pip has a decent solution for lock files:

https://pip.pypa.io/en/stable/user_guide/#constraints-files