diff --git a/container_config_scripts/tests/test_nova_statedir_ownership.py b/container_config_scripts/tests/test_nova_statedir_ownership.py
index 63e91199c6..f8d6b6cc56 100644
--- a/container_config_scripts/tests/test_nova_statedir_ownership.py
+++ b/container_config_scripts/tests/test_nova_statedir_ownership.py
@@ -32,6 +32,8 @@ class FakeSelinux(object):
     @staticmethod
     def lsetfilecon(path, context):
         pass
+
+
 sys.modules["selinux"] = FakeSelinux
 
 from container_config_scripts.nova_statedir_ownership import \
diff --git a/lower-constraints.txt b/lower-constraints.txt
index d91f79fae6..e62b5c4e3c 100644
--- a/lower-constraints.txt
+++ b/lower-constraints.txt
@@ -8,7 +8,7 @@ asn1crypto==0.23.0
 Babel==2.3.4
 beautifulsoup4==4.6.0
 cachetools==2.0.0
-cffi==1.7.0
+cffi==1.14.0
 cliff==2.8.0
 cmd2==0.8.0
 contextlib2==0.4.0
@@ -31,7 +31,7 @@ futurist==1.2.0
 gitdb==0.6.4
 GitPython==1.0.1
 gnocchiclient==3.3.1
-greenlet==0.4.10
+greenlet==0.4.15
 httplib2==0.9.1
 idna==2.6
 imagesize==0.7.1
@@ -48,7 +48,7 @@ kombu==4.0.0
 linecache2==1.0.0
 logutils==0.3.5
 Mako==0.4.0
-MarkupSafe==1.0
+MarkupSafe==1.1.0
 mistral-lib==0.3.0
 mistral==6.0.0
 monotonic==0.6
@@ -78,7 +78,7 @@ oslo.utils==3.33.0
 oslosphinx==4.7.0
 oslotest==3.2.0
 osprofiler==1.4.0
-paramiko==2.0.0
+paramiko==2.7.1
 passlib==1.7.0
 Paste==2.0.2
 PasteDeploy==1.5.0
diff --git a/test-requirements.txt b/test-requirements.txt
index 31a7e4d0b3..e11f7e2c1c 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,7 +1,7 @@
 # The order of packages is significant, because pip processes them in the order
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
-hacking>=1.1.0,<1.2.0 # Apache-2.0
+hacking>=3.0.1,<3.1.0 # Apache-2.0
 openstackdocstheme>=1.18.1 # Apache-2.0
 PyYAML>=3.12 # MIT
 Jinja2>=2.10 # BSD License (3 clause)
diff --git a/tools/render-ansible-tasks.py b/tools/render-ansible-tasks.py
index 474a7e7873..b30104e3d7 100755
--- a/tools/render-ansible-tasks.py
+++ b/tools/render-ansible-tasks.py
@@ -110,7 +110,7 @@ def main():
                             ansible_tasks = expression.evaluate(data=data_source)
                             print(ansible_tasks)
                             role_ansible_tasks = role_ansible_tasks + ansible_tasks
-                        except Exception as e:
+                        except Exception:
                             print("There are no tasks in the configuration file")
             if (role_ansible_tasks != []):
                 tasks_output_file = os.path.join(output, role + "_" + section_task + ".yml")
@@ -123,5 +123,6 @@ def main():
                 save = open(tasks_output_file, 'w+')
                 yaml.dump(yaml.load(json.dumps(role_ansible_tasks)), save, default_flow_style=False)
 
+
 if __name__ == '__main__':
     main()
diff --git a/tools/yaml-validate.py b/tools/yaml-validate.py
index 35e1356cd4..de83d9bf98 100755
--- a/tools/yaml-validate.py
+++ b/tools/yaml-validate.py
@@ -25,6 +25,7 @@ from copy import copy
 def is_string(value):
     return isinstance(value, six.string_types)
 
+
 # Only permit the template alias versions.
 # The current template version should be the last element.
 # As tripleo-heat-templates is a branched repository, this
@@ -539,7 +540,7 @@ def validate_with_compute_role_services(role_filename, role_tpl, exclude_service
     if 'OS::TripleO::Services::CephOSD' in role_services:
         if tpl_us not in (None, 1):
             print('ERROR: update_serial in {0} ({1}) '
-                  'is should be 1 as it includes CephOSD'.format(
+                  'is should be 1 as it includes CephOSD {2}'.format(
                       role_filename,
                       tpl_us,
                       cmpt_us))
diff --git a/tox.ini b/tox.ini
index bd307670db..a2f8dad955 100644
--- a/tox.ini
+++ b/tox.ini
@@ -24,7 +24,7 @@ commands =
     python ./tools/yaml-validate.py .
     bash -c ./tools/roles-data-validation.sh
     bash -c ./tools/check-up-to-date.sh
-    flake8 --exclude releasenotes --ignore {[testenv:flake8]ignore}
+    flake8 --exclude releasenotes,.tox,__pycache__ --ignore {[testenv:flake8]ignore}
 
 [testenv:flake8]
 # E125 is deliberately excluded. See