diff --git a/cl_sii/libs/mm_utils.py b/cl_sii/libs/mm_utils.py
index 4c25ebeb..52d33411 100644
--- a/cl_sii/libs/mm_utils.py
+++ b/cl_sii/libs/mm_utils.py
@@ -48,8 +48,9 @@ def __init__(self, format: str = None, **kwargs: Any) -> None:
         """
         super().__init__(**kwargs)
         # Allow this to be None. It may be set later in the ``_serialize``
-        # or ``_desrialize`` methods This allows a Schema to dynamically set the
+        # or ``_deserialize`` methods This allows a Schema to dynamically set the
         # dateformat, e.g. from a Meta option
+        # TODO: for 'marshmallow 3', rename 'dateformat' to 'datetimeformat'.
         self.dateformat = format
 
     def _add_to_schema(self, field_name: str, schema: marshmallow.Schema) -> None:
diff --git a/requirements/base.txt b/requirements/base.txt
index ac889be3..0ce3b40b 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -3,9 +3,9 @@
 
 # Required packages:
 cryptography==2.6.1
-defusedxml==0.5.0
-lxml==4.2.6
-marshmallow==2.16.3
+defusedxml==0.6.0
+lxml==4.3.3
+marshmallow==2.19.2
 pyOpenSSL==18.0.0
 pytz==2019.1
 signxml==2.6.0
diff --git a/requirements/test.txt b/requirements/test.txt
index daefd728..46cecc12 100644
--- a/requirements/test.txt
+++ b/requirements/test.txt
@@ -3,10 +3,10 @@
 
 # Required packages:
 codecov==2.0.15
-coverage==4.5.2
-flake8==3.7.6
-mypy==0.670
-tox==3.7.0
+coverage==4.5.3
+flake8==3.7.7
+mypy==0.701
+tox==3.9.0
 
 # Packages dependencies:
 #   - codecov:
@@ -34,6 +34,7 @@ pluggy==0.9.0
 py==1.8.0
 pycodestyle==2.5.0
 pyflakes==2.1.1
+requests
 toml==0.10.0
-typed-ast==1.3.4
+typed-ast==1.3.5
 virtualenv==16.5.0
diff --git a/setup.py b/setup.py
index 3603986d..c66e470f 100755
--- a/setup.py
+++ b/setup.py
@@ -21,12 +21,11 @@ def get_version(*file_paths: Sequence[str]) -> str:
 readme = open('README.rst').read()
 history = open('HISTORY.rst').read().replace('.. :changelog:', '')
 
-# TODO: add reasonable upper-bound for some of these packages?
 requirements = [
-    'cryptography>=2.6.1',
-    'defusedxml>=0.5.0',
-    'lxml>=4.2.6',
-    'marshmallow>=2.16.3',
+    'cryptography>=2.6.1,<3',
+    'defusedxml>=0.5.0,<1',
+    'lxml>=4.2.6,<5',
+    'marshmallow>=2.16.3,<3',
     # TODO: remove upper-bound after a new release of 'signxml' drops the requirement 'pyOpenSSL<19'
     'pyOpenSSL>=18.0.0,<19',
     'pytz>=2018.7',