My bad! That part should have been clearer.

I mean you don't need pinned dependencies. Just declare the dependencies as you would normally in install_requires (from setup.cfg) and that's it. No need for pinning exact dependency versions with pip-tools, therefore no requirements.txt.

I think the standard practice is to just test the library against the latest version of its dependencies. In the case a new release of a dependency causes breakage, then you update your install_requires to restrict the version.