Pin dependencies

[bombsimon]

There's been a couple of times where not pinning dependencies has made either CI or local development pull the latest version and things have been broken. It's also affected result of pylint making linting failing even with no changes to the code.

Relates to #331, #336, #334

I suggest pinning dependencies and introduce a process to controlled upgrade dependencies instead. By doing this we can ensure that the latest main and CI is working until manually upgrading dependencies.