deps: upgrade pywin32 & relax version constraint

[milas]

Upgrade to latest pywin32, which has support for Python 3.10 and
resolves a CVE (related to ACL APIs, outside the scope of what
docker-py relies on, which is npipe support, but still gets
flagged by scanners).

The version constraint has also been relaxed in setup.py to allow
newer versions of pywin32. This is similar to how we handle the
other packages there, and should be safe from a compatibility
perspective.

Fixes #2902.
Closes #2972 and closes #2980.

[glours]

LGTM

[thaJeztah]

Looks like there's a couple more contributions for fixing this; https://github.com/docker/docker-py/pulls?q=is%3Apr+is%3Aopen+pywin32+in%3Atitle

If someone has time, could we post a short "thank you for contributing" on those PR's before closing them? (I know some of them have been waiting for a long time to get their PR looked at)

[milas]

@thaJeztah Yes! I'm on it. (For context, I was planning to accept those, but changes around our GitHub Actions config meant they needed a rebase etc and so I didn't want to make them jump through more hoops.)

[thaJeztah]

but changes around our GitHub Actions config meant they needed a rebase etc and so I didn't want to make them jump through more hoops.)

Makes perfect sense 👍

Thanks for leaving the comments ❤️

[jmahlik]

I saw this was added to the 6.0.0 milestone. Any chance of a backport to 5.x? I ask because there's a few projects with docker<6.0.0 that might take a while to update to 6.x.

https://github.com/aws/sagemaker-python-sdk/blob/284ddbebcf6240f0a4d3c734244f8e8ad066a9b3/requirements/extras/local_requirements.txt#L3

[milas]

@jmahlik Unfortunately, it's not going to be practical to do a 5.0.x release with this change.

That said, the 6.0.0 release will be API-compatible with the 5.x series. The major version bump is because there are a couple of security-related behavior changes (e.g. around SSH Docker hosts) and the packaging/dependency management is substantially different.

As a result, once released you could temporarily use a constraint file if needed:

constraints.txt

docker>=6.0.0

Install with pip -c:

pip install -c constraints.txt package-that-depends-on-docker-py-5