chore(customizer): fix CVEs in RL image

[anubhutivyas]

Summary

Fix CVEs for RL image

Changes

CVEs fixed:

• removed the ffmpeg wheel, doesn't fix CVEs, more like a cleanup
  • We were installing av, opencv-python-headless, decord2 from this wheel that RL specifically removes in pyproject.toml and in PRs, 3107 and 3339, both are in our RL fork, so there's essentially no use of it.
• 154 findings come from FFmpeg vendored inside PyNvVideoCodec, /opt/uv_cache/archive-v0/y7K6jcDvx-Obnh8H/PyNvVideoCodec/ that is removed
  • PyNvVideoCodec==2.0.4 comes in from a pin from vllm and GRPO needs vllm, but removing PyNvVideoCodec from cache is safe because nothing on the DPO/GRPO path can reach it
  • it's needed for video decoding which is not part of DPO/GRPO at all.
  • the import PyNvVideoCodec is function-local, inside decode_frames_pynvvideocodec(), so it only executes if that backend is explicitly selected - https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/multimodal/video.py#L799
  • also it is never the default, vllm defaults to the opencv backend - https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/envs.py#L83
• aiohttp 3.14.2 bumped up to 3.14.3 in PR - chore: address cves soluwalana/RL#10
• cryptography 48.0.1 bumped up to to 50.0.0 in PR - chore: address cves soluwalana/RL#10

remaining can't be fixed:

• grpc v1.82.0 (needs 1.82.1) from /opt/uv_cache/archive-v0/Lt4dmx5C-VX-edr9/wandb/bin/wandb-core - already on the latest wandb (0.28.1); needs an upstream Go rebuild
• stdlib go1.26.4 - same wandb-core binary, same reason, latest wandb already
• grpc v1.79.3 (needs 1.82.1) comes from /opt/uv_cache/archive-v0/0zovx6DYaLJWcATd/mooncake/libetcd_wrapper.so - already on the latest mooncake-transfer-engine-cuda13 0.3.12.post1; no fix released yet
• stdlib go1.25.10 from same libetcd_wrapper.so - but we're on latest mooncake already
• flash-attn 2.8.1 - no fix yet
• CVE-2026-11940, CVE-2026-11972, CVE-2026-15308 from python-3.13.14, I looked up there is a new version of python with the fixes - https://docs.python.org/release/3.14.7/whatsnew/changelog.html, but we don't install Python from python.org. uv installs prebuilt interpreters from the python-build-standalone project, and that project has not published the latest version yet, it tops out at 3.13.14.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with documentation updates
• Documentation only
• Contributor tooling or automation
• CI, build, or test infrastructure

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Documentation updated for user-visible behavior
• Documentation not applicable — justification:

Verification

• Pull request title follows the repository's Conventional Commit format
• Every commit includes an appropriate Signed-off-by: trailer
• uv run pre-commit run -a passes, or any blocked checks are identified below
• Targeted tests pass, or tests are marked not applicable above
• No secrets, API keys, or credentials are included

Targeted validation:

Summary by CodeRabbit

• Chores

  • Updated the reinforcement-learning container build to use a newer pinned component revision.
  • Simplified container setup by removing bundled video-processing wheel replacement steps.
  • Removed bundled FFmpeg payload files while retaining the related package dependency; the optional video backend is no longer included.

• Documentation

  • Removed CVE-handling guidance from the reinforcement-learning container documentation, including related dependency and interpreter configuration details.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4c071ba1-6f33-471c-8ff4-512020228932

📥 Commits

Reviewing files that changed from the base of the PR and between 6bfcaed and 4ade415.

📒 Files selected for processing (3)

• docker-bake.hcl
• docker/rl/Dockerfile.nmp-rl-base
• docker/rl/README.md

💤 Files with no reviewable changes (1)

• docker/rl/README.md

🚧 Files skipped from review as they are similar to previous changes (1)

• docker/rl/Dockerfile.nmp-rl-base

---

📝 Walkthrough

Walkthrough

The RL image build updates NEMO_RL_REF, removes FFmpeg/VLM wheel integration, deletes PyNvVideoCodec’s bundled FFmpeg payload, and removes the related CVE documentation.

Changes

RL image build

Layer / File(s)	Summary
Build configuration docker-bake.hcl	Updates NEMO_RL_REF and removes the ffmpeg-vlm-wheel-image context from nmp-rl-base-builder.
Image dependency handling docker/rl/Dockerfile.nmp-rl-base, docker/rl/README.md	Removes FFmpeg/VLM wheel replacement, deletes PyNvVideoCodec’s bundled FFmpeg payload, and removes the CVE handling documentation.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#762: Introduced the FFmpeg/VLM wheel build and consumption flow removed here.
• NVIDIA-NeMo/nemo-platform#901: Modified the same RL build configuration and FFmpeg wheel handling.
• NVIDIA-NeMo/nemo-platform#1056: Also updated NEMO_RL_REF and the RL base image build.

Suggested reviewers: svvarom, ironcommit

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: fixing CVEs in the RL image.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch anubhutiv/fix-rl-cves

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker-bake.hcl`:
- Line 103: Update the NEMO_RL_REF value in Dockerfile.nmp-rl-base to the
immutable SHA 1427564b347ee0a4b672182a8a98048ed2785217, matching the pinned
default in docker-bake.hcl, and remove the mutable nmp/customizer reference.

In `@docker/rl/Dockerfile.nmp-rl-base`:
- Around line 248-262: Update the PyNvVideoCodec CVE cleanup in the Docker build
to run after all prefetch operations, remove the package from any symlinked
prefetched virtual environments before cache deletion, and delete both cached
wheel archives and unpacked payloads under the package’s
*.data/data/external/ffmpeg location. Add an assertion after cleanup that no
PyNvVideoCodec FFmpeg payload remains.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 454852f9-028e-43dd-923b-afe9bff6795a

📥 Commits

Reviewing files that changed from the base of the PR and between c71ca67 and 87252be.

📒 Files selected for processing (3)

• docker-bake.hcl
• docker/rl/Dockerfile.nmp-rl-base
• docker/rl/README.md

💤 Files with no reviewable changes (1)

• docker/rl/README.md

[mckornfield]

delete em all!

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	31436/40061	78.5%	63.0%
Integration Tests	18307/38013	48.2%	20.8%

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.