So by including hypothesis we pretty much guarantee we will get at least one weekly PR from dependabot (assuming the configuration does what it claims) to update dependencies? That sounds like a significant maintenance burden. Maybe we should instead document its use during development, from the [comment elsewhere](https://github.com/numpy/numpy/pull/14440#issuecomment-532077648) in the PR and not make it a hard dependency for CI.