Make orjson an optional dependency

[Zaczero]

Thank you for your work! Can we please make orjson dependency optional? I have concerns about the quality of this dependency (compatibility, security) and would prefer to not use it in my projects.

For example ijl/orjson#452 talks about python segfault that was introduced in one of the releases, and it took multiple iterations to get it fixed properly:

• Fix buffer overread in format_escaped_str, again ijl/orjson#457
• Fix buffer overread in format_escaped_str, again ijl/orjson#459

You will also see that this project has 1-week stale auto-close policy, which is yet another red flag for me.

See:

• AttributeError: module 'orjson' has no attribute 'dumps' ijl/orjson#460
• Can't install into python3.11 virtual environment using poetry ijl/orjson#461
• and the list goes on and on...

My suggestion would be to drop the orjson dependency in exchange for https://jcristharif.com/msgspec and made it optional, just for the people who really need it - the performance gain here is most likely very small and for many people it's probably not worth the additional dependency/risk. We are not parsing megabytes/gigabytes of data - stdlib's json should do pretty well.

[sophiamyang]

Thanks for reporting the issue. I don't think orjson is a dependency anymore according to https://github.com/mistralai/client-python/blob/main/pyproject.toml. Please let us know if you see more issues. Thanks!

[Zaczero]

Indeed it is not 👍