diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -37,30 +37,30 @@ is_windows = __platform__ in ['Windows']
 requirements = [
     "alembic >= 0.8.0, < 1.1",
     "gearbox < 1",
-    "waitress >= 0.8.8, < 1.2",
+    "waitress >= 0.8.8, < 1.4",
     "WebOb >= 1.7, < 1.8", # turbogears2 2.3.12 requires WebOb<1.8.0
     "backlash >= 0.1.2, < 1",
-    "TurboGears2 >= 2.3.10, < 2.4",
+    "TurboGears2 >= 2.3.10, < 2.4", # TODO: 2.4 drops Pylons compatibility
     "tgext.routes >= 0.2.0, < 1",
     "Beaker >= 1.7.0, < 2",
     "WebHelpers >= 1.3, < 1.4",
     "FormEncode >= 1.2.4, < 1.4",
-    "SQLAlchemy >= 1.1, < 1.3",
+    "SQLAlchemy >= 1.1, < 1.4",
     "Mako >= 0.9.0, < 1.1",
-    "Pygments >= 2.0, < 2.3",
+    "Pygments >= 2.0, < 2.5",
     "Whoosh >= 2.5.0, < 2.8",
-    "celery >= 3.1, < 4.0", # celery 4 doesn't work
-    "Babel >= 1.3, < 2.7",
-    "python-dateutil >= 1.5.0, < 2.8",
-    "Markdown >= 2.2.1, < 2.7",
+    "celery >= 3.1, < 4.0", # TODO: celery 4 doesn't work
+    "Babel >= 1.3, < 2.8",
+    "python-dateutil >= 1.5.0, < 2.9",
+    "Markdown >= 2.2.1, < 3.2",
     "docutils >= 0.11, < 0.15",
     "URLObject >= 2.3.4, < 2.5",
-    "Routes >= 1.13, < 2",
+    "Routes >= 1.13, < 2", # TODO: bumping to 2.0 will make test_file_annotation fail
     "dulwich >= 0.14.1, < 0.20",
     "mercurial >= 4.5, < 5.1",
-    "decorator >= 3.3.2, < 4.4",
+    "decorator >= 3.3.2, < 4.5",
     "Paste >= 2.0.3, < 3.1",
-    "bleach >= 3.0, < 3.1",
+    "bleach >= 3.0, < 3.2",
     "Click >= 7.0, < 8",
 ]