requirements.txt is introduced in #9785. It should be the result of pip freeze.
However, as time goes by, these files are edit manually when we bump package. Some dependencies are out-of-date and may have version conflict (see #28017).

I think we use a robot to improve this:

1. Developers only need to modify setup.py.
2. The robot creates requirements.txt using pip freeze and commits it to the pull request.
3. (The robot may also periodically update requirements.txt.)