Review pinned dependency versions in `requirements.txt`

[noahp]

It may not be necessary to strictly pin them; we could loosen to only specify minor or major version.

Or we could switch to poetry so the test requirements would stay pinned and similarly loosen the install requirements.