diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 87c6fb93d8..0b650fc520 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,12 @@ on:
       - "dependabot/**"
   pull_request:
 
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#changing-github_token-permissions
+permissions:
+  pull-requests: write
+  issues: write
+  repository-projects: write
+
 jobs:
   Windows:
     name: 'Windows (${{ matrix.python }}, ${{ matrix.arch }}${{ matrix.extra_name }})'
diff --git a/test-requirements.txt b/test-requirements.txt
index 8676cb210a..a65044dd89 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -39,10 +39,6 @@ decorator==5.1.1
     # via ipython
 dill==0.3.6
     # via pylint
-exceptiongroup==1.1.0 ; python_version < "3.11"
-    # via
-    #   -r test-requirements.in
-    #   pytest
 flake8==4.0.1
     # via -r test-requirements.in
 idna==3.4
@@ -83,7 +79,7 @@ packaging==23.0
     #   pytest
 parso==0.8.3
     # via jedi
-pathspec==0.10.3
+pathspec==0.11.0
     # via black
 pexpect==4.8.0
     # via ipython
@@ -125,14 +121,6 @@ sniffio==1.3.0
     # via -r test-requirements.in
 sortedcontainers==2.4.0
     # via -r test-requirements.in
-tomli==2.0.1
-    # via
-    #   black
-    #   build
-    #   coverage
-    #   mypy
-    #   pylint
-    #   pytest
 tomlkit==0.11.6
     # via pylint
 traitlets==5.8.1
@@ -146,10 +134,7 @@ types-pyopenssl==23.0.0.2 ; implementation_name == "cpython"
 typing-extensions==4.4.0 ; implementation_name == "cpython"
     # via
     #   -r test-requirements.in
-    #   astroid
-    #   black
     #   mypy
-    #   pylint
 wcwidth==0.2.6
     # via prompt-toolkit
 wheel==0.38.4