Refine, disable or replace pyup?

[madig]

Our dependency pinnings are used for testing. PRs like #351 fail because pyup-bot it doesn't take the minimum Python version into account. Look into configuring it better or switch to GitHub's update bot thing or remove?