fix: remove onnx from required dependencies to fix Windows installation

[agfianf]

PR Type

Bug fix, Enhancement

---

Description

• Move onnx from required to optional dev-model dependencies

• Fixes Windows installation issues caused by onnx package

• Add clarifying comment about onnx usage for model export

• Update requirements.txt with cleaned hash entries

---

Diagram Walkthrough

flowchart LR
  A["pyproject.toml<br/>dependencies"] -->|remove onnx| B["onnx removed<br/>from required"]
  A -->|add to dev-model| C["dev-model section<br/>with onnx>=1.15.0"]
  D["requirements.txt"] -->|cleanup hashes| E["Remove unused<br/>hash entries"]
  B --> F["Windows installation<br/>now works"]

Loading

File Walkthrough

Relevant files

Dependencies

pyproject.toml Move onnx to optional dev-model dependencies                          pyproject.toml Removed onnx==1.17.0 from main dependencies list Added onnx>=1.15.0 to dev-model optional dependencies Added clarifying comment that onnx is for model export/modification, not needed for inference Kept onnxruntime==1.20.1 in main dependencies +1/-1      requirements.txt Remove onnx and cleanup hash entries                                          requirements.txt Removed multiple hash entries from contourpy, coverage, fonttools, kiwisolver, matplotlib, numpy, and pyyaml packages Removed entire onnx==1.17.0 package entry with all its hashes Removed exceptiongroup conditional dependency for Python < 3.11 Removed several hash entries from onnxruntime, pandas, pillow, pydantic-core, scikit-learn, scipy, and shapely Cleaned up trailing hash entries to match updated dependency structure +5/-177

---

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Restore removed conditional dependency Restore the exceptiongroup conditional dependency in requirements.txt. Its removal will likely break installation or runtime for users on Python versions older than 3.11. requirements.txt [112-117] distlib==0.3.9 \ --hash=sha256:47f8c22fd27c27e25a65601af709b38e4f0a45ea4fc2e710f65755fa8caaaf87 \ --hash=sha256:a60f20dea646b8a33f3e7772f74dc0b2d0772d2837ee1342a00645c81edf9403 --exceptiongroup==1.2.2 ; python_full_version < '3.11' \ -- --hash=sha256:3111b9d131c238bec2f8f516e123e14ba243563fb135d3fe885990585aa7795b \ -- --hash=sha256:47c2edf7c6738fafb49fd34290706d1a1a2f4d1c6df275526b62cbb4aa5393cc +exceptiongroup==1.2.2 ; python_full_version < '3.11' \ + --hash=sha256:3111b9d131c238bec2f8f516e123e14ba243563fb135d3fe885990585aa7795b \ + --hash=sha256:47c2edf7c6738fafb49fd34290706d1a1a2f4d1c6df275526b62cbb4aa5393cc filelock==3.17.0 \ --hash=sha256:533dc2f7ba78dc2f0f531fc6c4940addf7b70a481e269a5a3b93be94ffbe8338 \ --hash=sha256:ee4e77401ef576ebb38cd7f13b9b28893194acc20a8e68e18730ba9c0e54660e Apply / Chat Suggestion importance[1-10]: 9 __ Why: This suggestion correctly identifies that removing the exceptiongroup dependency will break compatibility for Python versions older than 3.11, which is a critical issue if backward compatibility is intended.	High
General	pin ONNX upper bound Add an upper-bound constraint to the onnx dependency in pyproject.toml to prevent breaking changes from major version updates. pyproject.toml [58] -"onnx>=1.15.0", # For ONNX model export/modification (not needed for inference) +"onnx>=1.15.0,<2.0.0", # For ONNX model export/modification (not needed for inference) Apply / Chat Suggestion importance[1-10]: 5 __ Why: The suggestion correctly proposes adding an upper-bound constraint to the onnx dependency to prevent future breaking changes, which is a good practice for improving dependency stability.	Low
More