Should we put all required and their dependent packages on requirement.txt or only required packages

I digged myself a lot, and what @Charles Duffy commented above seems most proper way.

You should have two separate dependency lists: One with the dependencies a human has decided you need (which shouldn't contain transitive dependencies); one with the frozen list that reflects what you tested against (which should contain transitive dependencies)

However, Recently with the release of pipenv, I think this is the better way to keep track of dependencies.

It's like npm, much easier to maintain requirements and creating venv.

It automatically creates and manages a virtualenv for your projects, as well as adds/removes packages from your Pipfile as you install/uninstall packages. It also generates the ever–important Pipfile.lock, which is used to produce deterministic builds.