title: Should I pin my Python dependencies versions?
body: <p>I am about to release a Python library I've been working on the past few weeks. I've read a lot about Python dependencies but something is not quite clear yet:</p>
  <p>Some people pretend you should <strong>never</strong> pin your dependencies versions as it would prevent the users of your library from upgrading those dependencies.</p>
  <p>Some other claim that you should <strong>always</strong> pin your dependencies versions as it is the only way of guaranteeing that your release works the way it did when you developed it and to prevent that a breaking change in a dependency wreaks havoc in your library.</p>
  <p>I somehow went for an hybrid solution, where I assumed my dependencies used <a href="http://semver.org/" rel="noreferrer">semantic versioning </a> and pinned only the major version number (say <code>somelib &gt;= 2.3.0, &lt; 3</code>) except when the major version number is <code>0</code> (semantic versioning dictates that such versions are to be considered volatile and may break the API even if only the patch number is bumped).</p>
  <p>As of now, I'm not sure which way is the best. Is there an official guideline (even a PEP perhaps ?) that dictates the best practice regarding Python dependencies and how to specify them ?</p>