Keeping 3rd party libraries updated

[erikng]

Now that we have github actions working, we need to figure out how often to update the libraries themselves and also put that bit of information into the CHANGELOG and/or RELEASE_NOTES.

It's likely this process will not be automated, unless we can figure out how to do this with dependabot.

[erikng]

See https://help.github.com/en/github/administering-a-repository/keeping-your-dependencies-updated-automatically and https://pyup.io/ for ideas

[erikng]

As I merged a dependabot update just now, I think all we care about are security patches, unless someone or some macadmin tool needs a newer version.

This should be sufficient for this tool's needs.