If the XML file is very large, check out the lxml website for how to use the target and feed interfaces--it's not as hard as you might think, and they work very efficiently.

The newly approved Python Enhancement Proposal 751 gives Python a standard lock file format for specifying the dependencies of projects. Here’s the what, why, and when.