fix(deps): clear wheel-bundled ffmpeg CVEs from the all image (part 1/2) (#2192)

* fix(deps): clear wheel-bundled ffmpeg CVEs from the all image (part 1/2)

Signed-off-by: Dong Hyuk Chang <9426164+thomasdhc@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(video): adapt motion-vector backend to PyAV 17 API

Signed-off-by: Dong Hyuk Chang <9426164+thomasdhc@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Signed-off-by: Dong Hyuk Chang <9426164+thomasdhc@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: thomasdhc

nemo_curator/stages/video/filtering/motion_vector_backend.py

@@ -185,7 +185,7 @@ def decode_for_motion(  # noqa: C901
         stream = input_container.streams.video[0]
         ctx = stream.codec_context
         # Set this flag to return motion vectors
-        ctx.flags2 |= av.codec.context.Flags2.EXPORT_MVS
+        ctx.flags2 |= av.codec.context.Flags2.export_mvs
         ctx.thread_type = av.codec.context.ThreadType.AUTO
         ctx.thread_count = thread_count
         mv_data = []

pyproject.toml

@@ -217,8 +217,8 @@ text_cuda12 = [
 
 # Video Curation Dependencies
 video_cpu = [
-    "av==13.1.0",
-    "opencv-python",
+    "av==17.1.0",  # ffmpeg 8.1.1 (CVE: was 7.0.2)
+    "opencv-python-headless",  # dedupe with vllm's headless
     "torchvision",
     "einops",
     "easydict",
@@ -230,11 +230,16 @@ video_cuda12 = [
     "nemo_curator[vllm]",
     "cvcuda_cu12",
     "pycuda",
-    "PyNvVideoCodec==2.0.2; (platform_machine == 'x86_64' and platform_system != 'Darwin')",
     "torch<=2.10.0",
     "torchaudio",
 ]
 
+# NVDEC HW decode; opt-in, kept off `all` (wheel vendors CVE ffmpeg). CPU-decode fallback exists.
+video_media = [
+    "nemo_curator[video_cuda12]",
+    "PyNvVideoCodec==2.0.2; (platform_machine == 'x86_64' and platform_system != 'Darwin')",
+]
+
 # Math Curation Dependencies
 math_cpu = [
     "nemo_curator[text_cpu]",  # Math examples use text processing utilities
@@ -250,10 +255,9 @@ math_cuda12 = [
 
 # Multimodal / Interleaved Dependencies
 interleaved_cpu = [
-    "albumentations",
     "matplotlib",
     "open_clip_torch",
-    "opencv-python",
+    "opencv-python-headless",  # dedupe with vllm's headless
     "Pillow",
     "pypdfium2",
     "s3fs>=2024.12.0",

tests/stages/video/filtering/test_motion_vector_backend.py

@@ -177,7 +177,7 @@ def test_video_resolution_too_small_error(self):
         """Test that VideoResolutionTooSmallError is raised for small resolution."""
         mock_video = io.BytesIO(b"mock_video_data")
 
-        with patch("av.open") as mock_open, patch("av.codec.context.Flags2.EXPORT_MVS", create=True):
+        with patch("av.open") as mock_open:
             # Mock frame with small resolution
             mock_frame = Mock()
             mock_frame.height = 100  # Less than 256
@@ -211,7 +211,7 @@ def test_successful_decode(self):
         """Test successful decode operation."""
         mock_video = io.BytesIO(b"mock_video_data")
 
-        with patch("av.open") as mock_open, patch("av.codec.context.Flags2.EXPORT_MVS", create=True):
+        with patch("av.open") as mock_open:
             # Mock motion vector side data
             mock_side_data = Mock()
             mock_side_data.type = Mock()
@@ -260,18 +260,17 @@ def test_successful_decode(self):
 
             mock_open.return_value = mock_container
 
-            with patch("av.sidedata.sidedata.Type.MOTION_VECTORS", create=True):
-                result = decode_for_motion(mock_video)
+            result = decode_for_motion(mock_video)
 
-                assert isinstance(result, DecodedData)
-                assert len(result.frames) == 1
-                assert result.frame_size == torch.Size([480, 640, 3])
+            assert isinstance(result, DecodedData)
+            assert len(result.frames) == 1
+            assert result.frame_size == torch.Size([480, 640, 3])
 
     def test_no_motion_vectors(self):
         """Test decode with no motion vectors."""
         mock_video = io.BytesIO(b"mock_video_data")
 
-        with patch("av.open") as mock_open, patch("av.codec.context.Flags2.EXPORT_MVS", create=True):
+        with patch("av.open") as mock_open:
             # Mock frame with no motion vector side data
             mock_frame = Mock()
             mock_frame.height = 480
@@ -307,7 +306,7 @@ def test_custom_parameters(self):
         """Test decode with custom parameters."""
         mock_video = io.BytesIO(b"mock_video_data")
 
-        with patch("av.open") as mock_open, patch("av.codec.context.Flags2.EXPORT_MVS", create=True):
+        with patch("av.open") as mock_open:
             # Mock motion vector side data
             mock_side_data = Mock()
             mock_side_data.type = Mock()
@@ -356,11 +355,10 @@ def test_custom_parameters(self):
 
             mock_open.return_value = mock_container
 
-            with patch("av.sidedata.sidedata.Type.MOTION_VECTORS", create=True):
-                result = decode_for_motion(mock_video, thread_count=8, target_fps=5.0, target_duration_ratio=0.3)
+            result = decode_for_motion(mock_video, thread_count=8, target_fps=5.0, target_duration_ratio=0.3)
 
-                assert isinstance(result, DecodedData)
-                assert result.frame_size == torch.Size([480, 640, 3])
+            assert isinstance(result, DecodedData)
+            assert result.frame_size == torch.Size([480, 640, 3])
 
 
 class TestCheckIfSmallMotion: