[stable-only] Cap bandit to 1.6.2

The 1.6.3 [1] release has dropped support for py2 [2] but the release
is faulty and pip still picks it up for py2 [3][4], so cap to 1.6.2
when using py2.

Sphinx requirements also fixed to make requirements-check job pass.

lower-constraints job fixed with
* correcting contradicting/missing constraints
* setting default install_command to not use upper-constraints.txt

[1] https://github.com/PyCQA/bandit/releases/tag/1.6.3
[2] PyCQA/bandit#615
[3] PyCQA/bandit#663
[4] PyCQA/bandit#665

Change-Id: Ib2bad4cbd1ac9a63cd8c8e48f5cd5bf8c5cde595

lower-constraints.txt

@@ -4,8 +4,8 @@ Babel==2.5.3
 bandit==1.4.0
 certifi==2018.1.18
 chardet==3.0.4
-coverage==4.5.1
-debtcollector==1.19.0
+coverage==4.0
+debtcollector==1.2.0
 docutils==0.14
 dulwich==0.19.0
 extras==1.0.0
@@ -23,45 +23,46 @@ linecache2==1.0.0
 MarkupSafe==1.0
 mccabe==0.2.1
 mock==2.0.0
-monotonic==1.4
+monotonic==0.6
 mox3==0.25.0
 msgpack==0.5.6
 netaddr==0.7.19
 netifaces==0.10.6
 openstack-requirements==1.2.0
-openstackdocstheme==1.20.0
+openstackdocstheme==1.18.1
 os-client-config==1.29.0
 oslo.config==5.2.0
-oslo.context==2.20.0
-oslo.i18n==3.20.0
-oslo.serialization==2.25.0
-oslo.utils==3.36.0
-oslotest==3.3.0
+oslo.context==2.19.2
+oslo.i18n==3.15.3
+oslo.serialization==2.18.0
+oslo.utils==3.33.0
+oslotest==3.2.0
 packaging==17.1
 Parsley==1.3
-pbr==3.1.1
+pbr==2.0.0
 pep8==1.5.7
 pyflakes==0.8.1
 Pygments==2.2.0
 pyinotify==0.9.6
 pyparsing==2.2.0
-python-dateutil==2.7.0
+python-dateutil==2.5.3
 python-mimeparse==1.6.0
 python-subunit==1.2.0
 pytz==2018.3
 PyYAML==3.12
-reno==2.7.0
+reno==2.5.0
 requests==2.18.4
 requestsexceptions==1.4.0
 rfc3986==1.1.0
-six==1.11.0
+six==1.10.0
 smmap2==2.0.3
 snowballstemmer==1.2.1
-Sphinx==1.6.5
+Sphinx==1.6.2
 sphinxcontrib-websupport==1.0.1
 stevedore==1.28.0
-testrepository==0.0.20
-testtools==2.3.0
+systemd-python==234
+testrepository==0.0.18
+testtools==2.2.0
 traceback2==1.4.0
 unittest2==1.1.0
 urllib3==1.22

test-requirements.txt

@@ -15,9 +15,11 @@ oslotest>=3.2.0 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
 
 # this is required for the docs build jobs
-sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2,<2.0.0;python_version=='2.7'  # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2;python_version>='3.4'  # BSD
 openstackdocstheme>=1.18.1 # Apache-2.0
 reno>=2.5.0 # Apache-2.0
 
 # Bandit security code scanner
-bandit>=1.1.0 # Apache-2.0
+bandit>=1.1.0,<1.6.3;python_version=='2.7' # Apache-2.0
+bandit>=1.1.0;python_version>='3.5' # Apache-2.0

tox.ini

@@ -44,6 +44,7 @@ basepython = python3
 commands = bandit -r oslo_log -x tests -n5
 
 [testenv:lower-constraints]
+install_command = python3 -m pip install {opts} {packages}
 basepython = python3
 deps =
   -c{toxinidir}/lower-constraints.txt