They are currently set on requirements_frozen.txt only, which is not used by CI nor setup scripts. We should: 1. use the versions from `requirements_frozen.txt` on the top requirements files 2. remove `requirements_frozen.txt` 3. let dependabot do its thing