setup: bump some setup.py dependency versions

Upgrade notes for these libraries have not been investigated thoroughly, but
testing seems to show that it works. We are also early in the development
phase, so big problems will be caught by general testing before going wide.

Note: TurboGears2 is not upgraded to 2.4 yet. That upgrade would require us to
first move away from using the Pylons compatibility layer.

setup.py

@@ -37,30 +37,30 b" is_windows = __platform__ in ['Windows']"
 requirements = [
     "alembic >= 0.8.0, < 1.1",
     "gearbox < 1",
-    "waitress >= 0.8.8, < 1.2",
+    "waitress >= 0.8.8, < 1.4",
     "WebOb >= 1.7, < 1.8", # turbogears2 2.3.12 requires WebOb<1.8.0
     "backlash >= 0.1.2, < 1",
-    "TurboGears2 >= 2.3.10, < 2.4",
+    "TurboGears2 >= 2.3.10, < 2.4", # TODO: 2.4 drops Pylons compatibility
     "tgext.routes >= 0.2.0, < 1",
     "Beaker >= 1.7.0, < 2",
     "WebHelpers >= 1.3, < 1.4",
     "FormEncode >= 1.2.4, < 1.4",
-    "SQLAlchemy >= 1.1, < 1.3",
+    "SQLAlchemy >= 1.1, < 1.4",
     "Mako >= 0.9.0, < 1.1",
-    "Pygments >= 2.0, < 2.3",
+    "Pygments >= 2.0, < 2.5",
     "Whoosh >= 2.5.0, < 2.8",
-    "celery >= 3.1, < 4.0", # celery 4 doesn't work
-    "Babel >= 1.3, < 2.7",
-    "python-dateutil >= 1.5.0, < 2.8",
-    "Markdown >= 2.2.1, < 2.7",
+    "celery >= 3.1, < 4.0", # TODO: celery 4 doesn't work
+    "Babel >= 1.3, < 2.8",
+    "python-dateutil >= 1.5.0, < 2.9",
+    "Markdown >= 2.2.1, < 3.2",
     "docutils >= 0.11, < 0.15",
     "URLObject >= 2.3.4, < 2.5",
-    "Routes >= 1.13, < 2",
+    "Routes >= 1.13, < 2", # TODO: bumping to 2.0 will make test_file_annotation fail
     "dulwich >= 0.14.1, < 0.20",
     "mercurial >= 4.5, < 5.1",
-    "decorator >= 3.3.2, < 4.4",
+    "decorator >= 3.3.2, < 4.5",
     "Paste >= 2.0.3, < 3.1",
-    "bleach >= 3.0, < 3.1",
+    "bleach >= 3.0, < 3.2",
     "Click >= 7.0, < 8",
 ]