Update dependencies & simplify dependency management

[dr0i]

This came up in a discussion with @blackwinter :

• [ ] we update dependencies to close security threats
• [ ] Along with that we could simplify the dependency management
• [ ] investigate why https://github.com/metafacture/metafacture-core/security/dependabot doesn't show a thing