Pin dependencies #387

We're pinning some package versions in requirements-text.txt, but not those packages' dependencies. Consider using pip-tools to pin all packages in the environment.

This issue was motivated by #334.