I think the official repo now uses pipenv, which means that the requirements.txt is not the dependency source, but a generated file (perhaps its in the repo for legacy reasons).
To update the dependencies, one would need to run pipenv update to refresh the Pipfile.lock.
To regenerate requirements.txt thereafter, one would run pipenv lock -r.