pin filebrowser_safe, (issue filebrowser_safe#28)
pin bleech, otherwise depends on newer html5lib