cp: fix(deps): clear wheel-bundled ffmpeg CVEs from the all image (part 1/2) (2192) into r1.3.0

[svcnvidia-nemo-ci]

beep boop [🤖]: Hi @thomasdhc 👋,

we've cherry picked #2192 into  for you! 🚀

Please review and approve this cherry pick by your convenience!

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[svcnvidia-nemo-ci]

/ok to test 870c6ad

[greptile-apps]

Greptile Summary

This PR changes the video and interleaved dependency set. The main changes are:

• PyAV is bumped to 17.1.0 for newer bundled FFmpeg.
• OpenCV dependencies switch to opencv-python-headless.
• PyNvVideoCodec moves from video_cuda12 into a new video_media extra.
• albumentations and its transitive packages are removed from interleaved extras.
• Motion-vector tests are updated for the new PyAV flag path.

Confidence Score: 4/5

The changed video decode dependencies need fixes before merging.

• Real motion-vector decoding can fail on the changed PyAV flag lookup.
• Existing CUDA video installs can lose PyNvVideoCodec and crash in direct NV codec paths.
• Existing all-extra installs can silently fall back from NVDEC to CPU decode.

nemo_curator/stages/video/filtering/motion_vector_backend.py, pyproject.toml

Important Files Changed

Filename	Overview
nemo_curator/stages/video/filtering/motion_vector_backend.py	Changes the PyAV motion-vector export flag access for the new PyAV version.
pyproject.toml	Updates video/interleaved extras and moves NVDEC support into a new opt-in extra.
tests/stages/video/filtering/test_motion_vector_backend.py	Removes mocks for the old PyAV flag names while keeping the AV stack mocked.
uv.lock	Mirrors the dependency graph changes from pyproject.toml.

Comments Outside Diff (1)

1. pyproject.toml, line 284-295 (link)

   All Extra Loses NVDEC

   all still expands through video_cuda12, so it now excludes PyNvVideoCodec as well. The frame extraction stage defaults to decoder_mode="pynvc"; without that package it disables the NVDEC path and falls back to CPU FFmpeg, so existing [all] GPU video installs can silently lose hardware decode throughput.

   Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

_{Reviews (1): Last reviewed commit: "fix(deps): clear wheel-bundled ffmpeg CV..." | Re-trigger Greptile}

[greptile-apps]

Motion Flag Lookup Can Fail

Real decode_for_motion() calls reach this line before any frames are decoded, but PyAV exposes export_mvs as the codec-context flag attribute while the Flags2 enum member is EXPORT_MVS. If PyAV 17.1.0 does not define a lowercase class member, this raises AttributeError at runtime and the current tests miss it because they mock the AV stack.

[greptile-apps]

CUDA Extra Drops NVDEC

Existing x86_64 Linux users who install nemo_curator[video_cuda12] no longer get PyNvVideoCodec, but direct NV codec paths such as the stitching decoder still instantiate VideoBatchDecoder and raise when that package is missing. This changes an established CUDA video install from working hardware decode to a runtime crash unless users discover and install the new video_media extra.