diff --git a/requirements-app.txt b/requirements-app.txt
index b05df342d..43d311360 100644
--- a/requirements-app.txt
+++ b/requirements-app.txt
@@ -14,11 +14,11 @@ eventlet==0.24.1
 gunicorn==19.7.1  # pyup: ignore, >19.8 breaks eventlet patching
 iso8601==0.1.12
 jsonschema==3.0.1
-marshmallow-sqlalchemy==0.16.1
+marshmallow-sqlalchemy==0.16.2
 marshmallow==2.19.2
-psycopg2-binary==2.8.1
+psycopg2-binary==2.8.2
 PyJWT==1.7.1
-SQLAlchemy==1.3.2
+SQLAlchemy==1.3.3
 
 notifications-python-client==5.3.0
 
diff --git a/requirements.txt b/requirements.txt
index aa66c1826..1300e6180 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -16,11 +16,11 @@ eventlet==0.24.1
 gunicorn==19.7.1  # pyup: ignore, >19.8 breaks eventlet patching
 iso8601==0.1.12
 jsonschema==3.0.1
-marshmallow-sqlalchemy==0.16.1
+marshmallow-sqlalchemy==0.16.2
 marshmallow==2.19.2
-psycopg2-binary==2.8.1
+psycopg2-binary==2.8.2
 PyJWT==1.7.1
-SQLAlchemy==1.3.2
+SQLAlchemy==1.3.3
 
 notifications-python-client==5.3.0
 
@@ -36,16 +36,16 @@ git+https://github.com/alphagov/notifications-utils.git@31.2.5#egg=notifications
 git+https://github.com/alphagov/boto.git@2.43.0-patch3#egg=boto==2.43.0-patch3
 
 ## The following requirements were added by pip freeze:
-alembic==1.0.9
+alembic==1.0.10
 amqp==1.4.9
 anyjson==0.3.3
 attrs==19.1.0
-awscli==1.16.145
+awscli==1.16.147
 bcrypt==3.1.6
 billiard==3.3.0.23
 bleach==3.1.0
 boto3==1.6.16
-botocore==1.12.135
+botocore==1.12.137
 certifi==2019.3.9
 chardet==3.0.4
 Click==7.0
@@ -68,7 +68,7 @@ phonenumbers==8.10.5
 pyasn1==0.4.5
 pycparser==2.19
 PyPDF2==1.26.0
-pyrsistent==0.14.11
+pyrsistent==0.15.1
 python-dateutil==2.8.0
 python-editor==1.0.4
 python-json-logger==0.1.10
diff --git a/tests/app/template_folder/test_template_folder_rest.py b/tests/app/template_folder/test_template_folder_rest.py
index ab838842e..118de04e8 100644
--- a/tests/app/template_folder/test_template_folder_rest.py
+++ b/tests/app/template_folder/test_template_folder_rest.py
@@ -102,7 +102,7 @@ def test_create_template_folder_sets_user_permissions(admin_request, sample_serv
     if has_parent:
         assert resp['data']['users_with_permission'] == [str(user_1.id)]
     else:
-        assert resp['data']['users_with_permission'] == [str(user_1.id), str(user_2.id)]
+        assert sorted(resp['data']['users_with_permission']) == sorted([str(user_1.id), str(user_2.id)])
 
 
 @pytest.mark.parametrize('missing_field', ['name', 'parent_id'])