diff --git a/lower-constraints.txt b/lower-constraints.txt
index 73eb72d..a70397c 100644
--- a/lower-constraints.txt
+++ b/lower-constraints.txt
@@ -14,7 +14,7 @@ iso8601==0.1.11
 Jinja2==2.10
 keystoneauth1==3.4.0
 linecache2==1.0.0
-MarkupSafe==1.0
+MarkupSafe==1.1.1
 mccabe==0.2.1
 mox3==0.20.0
 openstackdocstheme==1.18.1
diff --git a/test-requirements.txt b/test-requirements.txt
index ce59c51..4d8b722 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -2,8 +2,6 @@
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
 
-hacking>=3.1.0,<4.0.0 # Apache-2.0
-
 coverage!=4.4,>=4.0 # Apache-2.0
 python-subunit>=1.0.0 # Apache-2.0/BSD
 sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD
@@ -12,8 +10,6 @@ oslotest>=3.2.0 # Apache-2.0
 stestr>=2.0.0 # Apache-2.0
 testscenarios>=0.4 # Apache-2.0/BSD
 testtools>=2.2.0 # MIT
-flake8-import-order>=0.17.1 # LGPLv3
-pycodestyle>=2.0.0,<2.7.0 # MIT
 
 # releasenotes
 reno>=2.5.0 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index aea8d7c..a201a42 100644
--- a/tox.ini
+++ b/tox.ini
@@ -18,6 +18,10 @@ deps =
 commands = stestr run --slowest {posargs}
 
 [testenv:pep8]
+deps =
+  hacking>=3.1.0,<4.0.0 # Apache-2.0
+  flake8-import-order>=0.17.1 # LGPLv3
+  pycodestyle>=2.0.0,<2.7.0 # MIT
 commands = flake8 {posargs}
 
 [testenv:venv]