The current 3rd-party module requirements for cinder are still from the
nova git import. Usually, having an upper bound for requirements makes
only sense where API-incompatible changes are expected (like WebOb). For
the others it is better the only require a minimum version because
usually distributions differ on the shipped versions of these Python
modules. For instance, openSUSE has newer versions for almost all of
those and running the testsuite there works flawlessly.