How do you decide what to pin and how do you keep dependencies current?

Pin exactly in the lock file, and keep the declared ranges in pyproject relatively permissive. That gives reproducible installs without freezing you out of upgrades. Automate updates with a bot that opens small pull requests, let CI decide whether they are safe, and treat security advisories as their own track that jumps the queue rather than waiting for the next batch.

Two different jobs, so two different answers. The lock file pins exact versions and hashes, and that is what CI and production install, so builds are reproducible and yesterday green pipeline means something. The declared constraints in pyproject stay loose, usually just a lower bound plus an upper bound on the next major, so upgrades are possible without editing every line. Keeping current is the harder half. We run an automated bot that opens one pull request per dependency on a weekly schedule, and because they are small and the suite is decent, most merge on green without a human thinking hard. Major version bumps get read properly. Security advisories bypass the cadence entirely, and pip-audit runs in CI so a known vulnerable transitive dependency fails the build rather than sitting unnoticed. The failure mode I have lived through is the opposite, a service frozen for two years, then a critical Django advisory forcing four major versions in one weekend.