Developer dependencies are not routinely updated

[StevenMaude]

This repository has a slightly unusual setup in that the production dependencies are vendored. However, the developer dependencies are not regularly updated.

[StevenMaude]

This was in part due to being on an unsupported Python version; we now have some Dependabot PRs. Though they may not be doing exactly the right thing in the context of the vendoring.