Yeah, I guess I should have done a pip freeze to specify the versions in the requirements file. I wasn't thinking ahead.
Turns out one dependency had 3 major releases in the span of a year! (Which basically confirms what I was saying, though I don't know how typical that is.)