[thomasdhc]

Description

• av: 13.1.0 -> 17.1.0 (vendored ffmpeg 7.0.2 -> 8.1.1). av is unpinned by faster-whisper and vllm[audio], so this lifts it on every resolution path, not just the video extra.
• opencv: opencv-python -> opencv-python-headless in video_cpu and interleaved_cpu. Dedupes with the headless copy vllm already pulls and drops the redundant non-headless wheel (vendored ffmpeg 5.1.6). No cv2 GUI use in-repo.
• albumentations: dropped from interleaved_cpu (imported nowhere; also removes its albucore -> opencv-headless transitive pull).
• PyNvVideoCodec: moved from video_cuda12 into a new opt-in video_media extra, kept off 'all' (its wheel vendors ffmpeg 4.4, which NVIDIA does not update). The video pipeline already falls back to FFmpeg CPU decode when it is absent.
• av 17 renamed the codec flag Flags2.EXPORT_MVS to Flags2.export_mvs, so motion_vector_backend would AttributeError at runtime. Update the reference and drop the now-invalid create=True enum patches in its test (MOTION_VECTORS and export_mvs are real enum members in av 17 and can't be monkeypatched).

Usage

# Add snippet demonstrating usage

Checklist

• I am familiar with the Contributing Guide.
• New or Existing tests cover these changes.
• The documentation is up to date with these changes.

[greptile-apps]

Greptile Summary

This PR remediates several bundled-FFmpeg CVEs by upgrading av to 17.1.0 (vendored ffmpeg 8.1.1), switching from opencv-python to opencv-python-headless (no GUI code in-repo), dropping unused albumentations, and quarantining PyNvVideoCodec (vendors an un-updated ffmpeg 4.4) into a new opt-in video_media extra kept off all. It also fixes a latent AttributeError in decode_for_motion: the old code referenced av.codec.context.Flags2.EXPORT_MVS, which does not exist in PyAV — the correct Pythonic name is export_mvs — and updates the tests to drop create=True patches that were masking this bug.

• Dependency changes (pyproject.toml): av pinned to 17.1.0, opencv headless dedup, albumentations removed (not imported anywhere in the codebase), and PyNvVideoCodec isolated into video_media (intentionally excluded from all).
• Bug fix (motion_vector_backend.py): Flags2.EXPORT_MVS → Flags2.export_mvs — the uppercase name never existed in PyAV; anyone exercising this code path under av 13.x would have hit an AttributeError.
• Test hygiene (test_motion_vector_backend.py): Removed four patch(..., create=True) calls for non-existent or now-real attributes; assertions in two tests are un-nested from a stale inner with context.

Confidence Score: 5/5

Safe to merge — the changes are additive CVE remediations with no altered public API or data paths, and the latent AttributeError fix restores behavior that was silently broken.

All four files make targeted, well-scoped changes: the dependency upgrades are justified by CVE remediation, the opencv-headless switch is confirmed safe (no GUI cv2 calls exist in the codebase), albumentations removal is confirmed (zero imports in nemo_curator), and the EXPORT_MVS to export_mvs rename fixes a real but previously-masked AttributeError rather than introducing new risk.

No files require special attention.

Important Files Changed

Filename	Overview
nemo_curator/stages/video/filtering/motion_vector_backend.py	Fixes a latent AttributeError bug: EXPORT_MVS to export_mvs aligns with PyAV's actual Pythonic enum member name; the old name never existed in av's Flags2 enum.
pyproject.toml	av bumped to 17.1.0 (ffmpeg 8.1.1), opencv switched to headless variant, albumentations dropped, PyNvVideoCodec quarantined into opt-in video_media extra kept off all.
tests/stages/video/filtering/test_motion_vector_backend.py	Removes patches that used create=True for attributes that never existed (EXPORT_MVS) or that now exist in av 17.x without patching; assertions correctly stay inside the av.open patch context.
uv.lock	Lock file updated to reflect the new av, opencv-python-headless, and removal of PyNvVideoCodec/albumentations from the default resolution sets.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["pip install nemo_curator[all]"] --> B["video_cuda12"]
    A --> C["interleaved_cuda12"]
    B --> D["video_cpu\nav==17.1.0\nopencv-python-headless"]
    B --> E["cuda12 / vllm"]
    C --> F["interleaved_cpu\nopencv-python-headless\n(albumentations removed)"]
    C --> E
    G["pip install nemo_curator[video_media]"] --> B
    G --> H["PyNvVideoCodec==2.0.2\n(vendors ffmpeg 4.4 CVE)\nOpt-in only"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["pip install nemo_curator[all]"] --> B["video_cuda12"]
    A --> C["interleaved_cuda12"]
    B --> D["video_cpu\nav==17.1.0\nopencv-python-headless"]
    B --> E["cuda12 / vllm"]
    C --> F["interleaved_cpu\nopencv-python-headless\n(albumentations removed)"]
    C --> E
    G["pip install nemo_curator[video_media]"] --> B
    G --> H["PyNvVideoCodec==2.0.2\n(vendors ffmpeg 4.4 CVE)\nOpt-in only"]

Loading

_{Reviews (2): Last reviewed commit: "fix(video): adapt motion-vector backend ..." | Re-trigger Greptile}