There is a lock file now.

https://packaging.python.org/en/latest/specifications/pylock...

Issue is since there are no standardized build tool (pip, uv both are third party), there are a zillion ways of generating this lockfile unlike go.mod or cargo.toml. So it doesn't work in many scenarios and it's confusing as hell.