If you create a fresh pipenv lock file nonstop, that is the same as just installing unpinned. If you create the pipfile on your workstation, now it is manual & you'll forget & I worry that locking on one OS means it will work on another OS (http://setup.py is pure chaos)
If I create a pipenv file on a build server or in a container, it is a controlled environment & but build servers run all the time. If I make it a manual step on a build server, it runs periodically, & also now I got a lock file I have to somehow push to git from inside gitlab
♡ 0 ↻ 0And not using a lock file isn't a good option either- a pypi package could be highjacked any day by a malicious user or upgraded with incompatibilities by a non-malicious user.
♡ 0 ↻ 0You can lock the dependencies list but you can't lock the vulnerability lists, so again, keeping your dependencies locked but stale isn't a great choice.
♡ 1 ↻ 0