diff --git a/.ci/check_unsupported.sh b/.ci/check_unsupported.sh
index ad06b7dcf7..9d037be397 100755
--- a/.ci/check_unsupported.sh
+++ b/.ci/check_unsupported.sh
@@ -11,7 +11,7 @@ set -x
 # Many bear dependencies do not install on unsupported versions
 echo "" > bear-requirements.txt
 
-pip install 'pip==9.0.1' 'setuptools==21.2.2'
+pip install 'pip==9.0.3' 'setuptools==21.2.2'
 
 python setup.py install 2>&1 | tee setup.log
 
diff --git a/.ci/constants.ps1 b/.ci/constants.ps1
index f8979db466..e697e436ea 100644
--- a/.ci/constants.ps1
+++ b/.ci/constants.ps1
@@ -1,6 +1,6 @@
 
 New-Variable -Scope global -Name project_name -Value 'coala-bears'
-New-Variable -Scope global -Name pip_version -Value '9.0.1'
+New-Variable -Scope global -Name pip_version -Value '9.0.3'
 New-Variable -Scope global -Name setuptools_version -Value '21.2.2'
 
 $old_EAP = $ErrorActionPreference
diff --git a/.moban.dt/travis-before-install.yaml b/.moban.dt/travis-before-install.yaml
index 958ba51803..9518f97415 100644
--- a/.moban.dt/travis-before-install.yaml
+++ b/.moban.dt/travis-before-install.yaml
@@ -26,8 +26,9 @@ before_install:
       export PATH="$HOME/.pyenv/bin:$PATH";
     fi
   - hash -r && pyenv versions --bare && python --version
+  - pip install pip==9.0.3
   - if [ "${TRAVIS_PYTHON_VERSION/3.4/}" != "$TRAVIS_PYTHON_VERSION" ]; then
-      pip install pip==9.0.3 setuptools==21.2.2;
+      pip install setuptools==21.2.2;
     fi
 
   - if [ -f ".ci/deps.$TRAVIS_LANGUAGE.sh" ]; then
diff --git a/.moban.dt/travis-manual-matrix.yaml b/.moban.dt/travis-manual-matrix.yaml
index 96a308ca77..4a5859d159 100644
--- a/.moban.dt/travis-manual-matrix.yaml
+++ b/.moban.dt/travis-manual-matrix.yaml
@@ -156,11 +156,11 @@
   before_script: true
   script: .ci/check_unsupported.sh
 
-- python: 3.6
+- python: 3.6.9
   stage: sentinel
-  before_install: false
-  install: pip install moban
-  before_script: false
+  before_install: []
+  install: pip install moban~=0.5.0 gitfs2 pypifs
+  before_script: []
   script: .ci/check_moban.sh
-  after_success: false
-  after_failure: false
+  after_success: []
+  after_failure: []
diff --git a/.travis.yml b/.travis.yml
index cc8249b4fe..5897396ab5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -197,7 +197,7 @@ jobs:
       before_script: true
       script: .ci/check_unsupported.sh
 
-    - python: 3.6
+    - python: 3.6.9
       stage: sentinel
       before_install: []
       install: pip install moban~=0.5.0 gitfs2 pypifs
@@ -600,8 +600,9 @@ before_install:
       export PATH="$HOME/.pyenv/bin:$PATH";
     fi
   - hash -r && pyenv versions --bare && python --version
+  - pip install pip==9.0.3
   - if [ "${TRAVIS_PYTHON_VERSION/3.4/}" != "$TRAVIS_PYTHON_VERSION" ]; then
-      pip install pip==9.0.3 setuptools==21.2.2;
+      pip install setuptools==21.2.2;
     fi
 
   - if [ -f ".ci/deps.$TRAVIS_LANGUAGE.sh" ]; then
diff --git a/bear-requirements.yaml b/bear-requirements.yaml
index d168d4535c..36cf392642 100644
--- a/bear-requirements.yaml
+++ b/bear-requirements.yaml
@@ -13,7 +13,7 @@ pip_requirements:
   autopep8:
     version: ~=1.2
   bandit:
-    version: ~=1.2
+    version: ~=1.2,<1.6.3
   bashate:
     version: ~=0.5.1
   cmakelint:
diff --git a/setup.cfg b/setup.cfg
index 18c0be3a5c..3e41245210 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -18,7 +18,7 @@ addopts =
   --color=yes
   --doctest-glob=*.rst
   --doctest-modules
-  --doctest-ignore-import-error
+  --doctest-ignore-import-errors
   --cov
   --instafail
   --profile
diff --git a/setup.py b/setup.py
index 281fe35641..253e09a86a 100755
--- a/setup.py
+++ b/setup.py
@@ -420,9 +420,9 @@ def read_requirements(filename):
 
 if __name__ == '__main__':
     pip_version = LooseVersion(pip.__version__)
-    if pip_version < LooseVersion('9.0.1'):
-        raise RuntimeError('Version of pip is less than 9.0.1. '
-                           'Consider upgrading pip to pip~=9.0.1')
+    if pip_version < LooseVersion('9.0.3'):
+        raise RuntimeError('Version of pip is less than 9.0.3. '
+                           'Consider upgrading pip to pip~=9.0.3')
     setup(name='coala-bears',
           version=VERSION,
           description=DESCRIPTION,
diff --git a/test-requirements.txt b/test-requirements.txt
index 69914db0a9..d55372998d 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -3,21 +3,18 @@
 # ignore the dependency version difference and only fail when the
 # bear is loaded.
 colorama<0.4
-# coverage 4.4.2 broke compatibility with coverage-config-reload-plugin
-# and thus broke https://github.com/jayvdb/coverage_env_plugin .
-# See https://github.com/jayvdb/coverage_config_reload_plugin/issues/1
-coverage==4.4.1
+coverage>=5.2.1
 coverage-env-plugin~=0.1
 coverage-config-reload-plugin~=0.2
-codecov~=2.1.0
+codecov~=2.0.5
 moban~=0.5.0 ; python_version > '3.0'
 packaging~=16.8
-pytest~=4.6
-pytest-cov~=2.4
+pytest~=3.6.4
+pytest-cov>=2.4,<2.6
 pytest-env~=0.6.0
 pytest-instafail~=0.3.0
 pytest-mock~=1.1
-pytest-profiling~=1.3.0
+pytest-profiling~=1.7.0
 pytest-pythonpath~=0.7.0
 pytest-reorder~=0.1.0
 git+https://github.com/jayvdb/pytest-reqs@coala#egg=pytest-reqs
diff --git a/tox.ini b/tox.ini
index a94d8b655e..40a5ec8c1c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -70,7 +70,7 @@ passenv =
   _R_CHECK_CRAN_INCOMING_
   NOT_CRAN
   R_PROFILE
-pip_version = 9.0.1
+pip_version = 9.0.3
 alwayscopy = true
 skipsdist = true
 sitepackages={env:TOXINI_SITEPACKAGES:False}
@@ -92,7 +92,7 @@ deps =
   java{7,8}-!pip: guess-language-spirit~=0.5.2
   -rtest-requirements.txt
   # pytest-cov-threshold is incompatible with py34
-  !py34: git+https://github.com/krkd/pytest-cov-threshold
+  !py34: git+https://github.com/krkd/pytest-cov-threshold#egg=pytest-cov-threshold
   noskip: pytest-error-for-skips
 setenv =
   LINTR_COMMENT_BOT=false