https://gerrit.wikimedia.org/r/c/analytics/quarry/web/+/711208 dropped Pipenv from Quarry, leaving just a requirements.txt with some pinned packages, with no indication which are direct dependencies and which ones transient. I'd like to re-introduce a proper package manager there to make upgrades less painful while still keeping a lockfile of sorts for indirect dependencies.

For the options: most of Toolforge infrastructure uses Poetry. uv is a newer tool but also worth exploring I think.