[edmorley]

I was about to rule out Poetry due to pyup not supporting it, however it turns out Dependabot (which as a bonus looks to be more actively maintained than pyup) supports it:

https://dependabot.com/blog/announcing-poetry-support/