onnx-opset-bump-checklist

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The document instructs build-time/runtime downloads of ONNX source archives (e.g. https://github.com/onnx/onnx/archive/<commit-or-refs/tags/vX.Y.0>.zip) and vcpkg mirror probes/uploads which fetch remote code/artifacts that are then built/executed, so these are runtime external dependencies used to control the build/runtime behavior.