Requests simply vendors what it needs, afaik. Which is sub-optimal. At least this gives you visibility into those deps.