diff --git a/pootle/apps/pootle_translationproject/urls.py b/pootle/apps/pootle_translationproject/urls.py
index bd1a7a30ce..231b892d46 100644
--- a/pootle/apps/pootle_translationproject/urls.py
+++ b/pootle/apps/pootle_translationproject/urls.py
@@ -22,45 +22,46 @@
 urlpatterns = [
     # Admin views
     url(
-        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/]*)" r"/admin/permissions/",
+        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/><]*)" r"/admin/permissions/",
         admin_permissions,
         name="pootle-tp-admin-permissions",
     ),
     # Translation
     url(
-        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/]*)/"
-        r"translate/(?P<dir_path>(.*/)*)?$",
+        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/><]*)/"
+        r"translate/(?P<dir_path>([^<>]*/)*)?$",
         TPTranslateView.as_view(),
         name="pootle-tp-translate",
     ),
     url(
-        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/]*)/"
-        r"translate/(?P<dir_path>(.*/)*)(?P<filename>.*\.*)$",
+        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/><]*)/"
+        r"translate/(?P<dir_path>([^<>]*/)*)(?P<filename>.*\.*)$",
         TPTranslateStoreView.as_view(),
         name="pootle-tp-store-translate",
     ),
     # Export view
     url(
-        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/]*)/"
-        r"export-view/(?P<dir_path>(.*/)*)?$",
+        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/><]*)/"
+        r"export-view/(?P<dir_path>([^<>]*/)*)?$",
         TPExportView.as_view(),
         name="pootle-tp-export",
     ),
     url(
-        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/]*)/"
-        r"export-view/(?P<dir_path>(.*/)*)(?P<filename>.*\.*)$",
+        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/><]*)/"
+        r"export-view/(?P<dir_path>([^<>]*/)*)(?P<filename>.*\.*)$",
         TPExportStoreView.as_view(),
         name="pootle-tp-store-export",
     ),
     # Browser
     url(
-        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/]*)/" r"(?P<dir_path>(.*/)*)?$",
+        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/><]*)/"
+        r"(?P<dir_path>([^<>]*/)*)?$",
         TPBrowseView.as_view(),
         name="pootle-tp-browse",
     ),
     url(
-        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/]*)/"
-        r"(?P<dir_path>(.*/)*)(?P<filename>.*\.*)?$",
+        r"^(?P<language_code>[^/]*)/(?P<project_code>[^/><]*)/"
+        r"(?P<dir_path>([^<>]*/)*)(?P<filename>.*\.*)?$",
         TPBrowseStoreView.as_view(),
         name="pootle-tp-store-browse",
     ),
diff --git a/pootle/middleware/errorpages.py b/pootle/middleware/errorpages.py
index 68f460660a..7afdc2b7a4 100644
--- a/pootle/middleware/errorpages.py
+++ b/pootle/middleware/errorpages.py
@@ -52,7 +52,7 @@ def log_exception(request, exception, tb):
 
     try:
         request_repr = repr(request)
-    except:
+    except Exception:
         request_repr = "Request repr() unavailable"
 
     msg_args = (str(exception.args[0]), tb, request_repr)
@@ -93,7 +93,7 @@ def handle_exception(request, exception, template_name):
         return HttpResponseServerError(
             render_to_string(template_name, context=ctx, request=request)
         )
-    except:
+    except Exception:
         # Let's not confuse things by throwing an exception here
         pass
 
diff --git a/requirements/_lint.txt b/requirements/_lint.txt
index b8328cab75..ca45c0e60f 100644
--- a/requirements/_lint.txt
+++ b/requirements/_lint.txt
@@ -1,6 +1,6 @@
 # Linting tools
 
 black==19.10b0
-flake8==3.4.1
+flake8==4.0.1
 isort==4.3.21
 pylint==2.4.4
diff --git a/setup.py b/setup.py
index b7eb48c989..4b3b59f9ee 100755
--- a/setup.py
+++ b/setup.py
@@ -120,7 +120,7 @@ def build_mo(self):
                     command = ["msgfmt", "--strict", "-o", mo_filename, po_filename]
                 try:
                     subprocess.check_call(command, stderr=subprocess.STDOUT)
-                except subprocess.CalledProcessError as e:
+                except subprocess.CalledProcessError:
                     error_occured = True
                 except Exception as e:
                     log.warn("%s: skipping, running msgfmt failed: %s", lang, e)