same form in the requirements.txt, tho if you had both

requests==2.11.1

and

requests[security]==2.11.1

they’d clobber each other because it keys off the requirement name