Compose: Update requests dependency

[jgeerds]

A few days ago requests 2.13 has been released. Unfortunately, docker-compose still enforces requests < 2.12:

'requests >= 2.6.1, != 2.11.0, < 2.12',

Is there a reason for this? Changes are mostly bugfixes.

It seems like some distributions already ship docker-compose with newer versions of requests without any issues.

[shin-]

There are indeed reasons for this:

• https://github.com/docker/docker-py/issues/1321
• https://github.com/docker/docker-py/issues/1155
• https://github.com/docker/docker-py/issues/811
• https://github.com/docker/docker-py/issues/148

We make a fairly unconventional use of requests (HTTP over UNIX sockets) which makes us particularly sensitive to updates of the requests package - even when they're just bugfixes.

[neilsh]

Suggestion: I wonder if a sustainable solution going forward would be to submit unit tests to the requests project covering the unconventional functionality that docker-compose relies on, to help ensure their interface doesn't change with new versions.

[hrabalvojta]

Isn't this reason why you have RC versions?

[voidlily]

I tried changing the requirement line for requests in docker-compose's setup.py to match docker-py's as an initial pass and tested some very basic functionality for local dev. I'm not sure what would need to be done next to take this to completion (though I suspect unit tests submitted upstream as from a previous suggestion would be helpful to clarify the unconventional behavior docker-compose relies on).

My motivation for making this change on my end is that in a project I'm working on there's another package I'm using with a transitive dependency on a recent version of requests, causing a conflict with the most recent official release of docker-compose.

requests>2.18.0

'requests >= 2.6.1, != 2.11.0, < 2.12',