ci: Override onnx version to ensure lowerbound

[thomasdhc]

What does this PR do ?

Issue:

1. onnx 1.19.0 has a bug in its PyPI metadata -- it uses ml_dtypes.float4_e2m1fn (added in ml-dtypes 0.5.0) but declares ml-dtypes with no version constraint.

2. for Python >= 3.13 ml-dtypes>=0.5.0 requires numpy>=2.1.0, which conflicts with the build dependency group's numpy<2.0.0.

Solution:

• Added "onnx>=1.21.0; python_version < '3.13'" to override-dependencies in pyproject.toml to prevent future downgrades

Changelog

• Add specific line by line info of high level changes in this PR.

GitHub Actions CI

See the CI sectionin the Contributing doc for how to trigger the CI. A Nvidia developer will need to approve and trigger the CI for external contributors.

Before your PR is "Ready for review"

Pre checks:

• Make sure you read and followed Contributor guidelines
• Did you write any new necessary tests?
• Did you add or update any necessary documentation?
• Does the PR affect components that are optional to install? (Ex: Numba, Pynini, Apex etc)
  • Reviewer: Does the PR have correct import guards for all optional libraries?

If you haven't finished some of the above items you can still open "Draft" PR.

Additional Information

• Related to # (issue)

Summary by CodeRabbit

• Chores
  • Updated ONNX dependency version constraints to ensure compatibility across different Python versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0964c4f3-4d30-41d7-bb77-54cb0147fde7

📥 Commits

Reviewing files that changed from the base of the PR and between d461e5d and 3f709be.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pyproject.toml

---

📝 Walkthrough

Walkthrough

Added a conditional dependency override for onnx (≥1.21.0) in pyproject.toml that applies only when Python version is less than 3.13. This introduces version-specific package installation behavior via the uv package manager's override-dependencies configuration.

Changes

Cohort / File(s)	Summary
Dependency Configuration pyproject.toml	Added conditional override dependency for onnx>=1.21.0 in tool.uv.override-dependencies, scoped to Python versions below 3.13.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding a version override for onnx in the dependency configuration to ensure a minimum version constraint.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Test Results For Major Changes	✅ Passed	This PR contains a minor change—adding a single dependency override line in pyproject.toml to constrain the onnx version for Python < 3.13. Since the change is purely a configuration-level dependency constraint with no new features, breaking changes, code refactoring, or potential impact on numerics or performance, it does not require test results or regression documentation.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch donghyukc/onnx_constraint

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}