From bd0f88ac7c5cffe6ce186ce3c45cb8c9445ecc29 Mon Sep 17 00:00:00 2001 From: MDSALMANSHAMS Date: Sun, 19 Jul 2026 10:44:27 +0530 Subject: [PATCH 1/3] Bump ffmpeg to 8.1.2 to fix CVE-2026-8461 ffmpeg 8.1.1 is affected by CVE-2026-8461, an out-of-bounds write in the MagicYUV decoder (libavcodec/magicyuv.c, CWE-787, CVSS 8.8). It is fixed upstream in ffmpeg 8.1.2. Update FFMPEG_VERSION from 8.1.1 to 8.1.2 in all seven build Dockerfiles (manylinux2014, manylinux_2_28 and musllinux_1_2). --- docker/manylinux2014/Dockerfile_aarch64 | 2 +- docker/manylinux2014/Dockerfile_i686 | 2 +- docker/manylinux2014/Dockerfile_x86_64 | 2 +- docker/manylinux_2_28/Dockerfile_aarch64 | 2 +- docker/manylinux_2_28/Dockerfile_x86_64 | 2 +- docker/musllinux_1_2/Dockerfile_aarch64 | 2 +- docker/musllinux_1_2/Dockerfile_x86_64 | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docker/manylinux2014/Dockerfile_aarch64 b/docker/manylinux2014/Dockerfile_aarch64 index 09812ddbc..0a09dfc7b 100644 --- a/docker/manylinux2014/Dockerfile_aarch64 +++ b/docker/manylinux2014/Dockerfile_aarch64 @@ -4,7 +4,7 @@ FROM quay.io/pypa/manylinux2014_aarch64:latest ARG CCACHE_VERSION=4.13.6 -ARG FFMPEG_VERSION=8.1.1 +ARG FFMPEG_VERSION=8.1.2 ARG FREETYPE_VERSION=2.14.3 ARG LIBPNG_VERSION=1.6.58 ARG VPX_VERSION=v1.15.2 diff --git a/docker/manylinux2014/Dockerfile_i686 b/docker/manylinux2014/Dockerfile_i686 index aaa9373bc..9a56d6424 100644 --- a/docker/manylinux2014/Dockerfile_i686 +++ b/docker/manylinux2014/Dockerfile_i686 @@ -2,7 +2,7 @@ FROM quay.io/pypa/manylinux2014_i686:latest ARG CCACHE_VERSION=3.7.9 ARG CMAKE_VERSION=3.17.0 -ARG FFMPEG_VERSION=8.1.1 +ARG FFMPEG_VERSION=8.1.2 ARG NASM_VERSION=2.15.04 ARG OPENSSL_VERSION=1_1_1w ARG QT_VERSION=5.15.0 diff --git a/docker/manylinux2014/Dockerfile_x86_64 b/docker/manylinux2014/Dockerfile_x86_64 index c75f28fda..9ed273c78 100644 --- a/docker/manylinux2014/Dockerfile_x86_64 +++ b/docker/manylinux2014/Dockerfile_x86_64 @@ -4,7 +4,7 @@ FROM quay.io/pypa/manylinux2014_x86_64:latest ARG CCACHE_VERSION=4.13.6 -ARG FFMPEG_VERSION=8.1.1 +ARG FFMPEG_VERSION=8.1.2 ARG FREETYPE_VERSION=2.14.3 ARG LIBPNG_VERSION=1.6.58 ARG VPX_VERSION=v1.15.2 diff --git a/docker/manylinux_2_28/Dockerfile_aarch64 b/docker/manylinux_2_28/Dockerfile_aarch64 index b8af36412..9c3d46675 100644 --- a/docker/manylinux_2_28/Dockerfile_aarch64 +++ b/docker/manylinux_2_28/Dockerfile_aarch64 @@ -3,7 +3,7 @@ FROM quay.io/pypa/manylinux_2_28_aarch64:latest -ARG FFMPEG_VERSION=8.1.1 +ARG FFMPEG_VERSION=8.1.2 ARG FREETYPE_VERSION=2.14.3 ARG LIBPNG_VERSION=1.6.58 ARG VPX_VERSION=v1.15.2 diff --git a/docker/manylinux_2_28/Dockerfile_x86_64 b/docker/manylinux_2_28/Dockerfile_x86_64 index 4deeddf61..08cbb2464 100644 --- a/docker/manylinux_2_28/Dockerfile_x86_64 +++ b/docker/manylinux_2_28/Dockerfile_x86_64 @@ -3,7 +3,7 @@ FROM quay.io/pypa/manylinux_2_28_x86_64:latest -ARG FFMPEG_VERSION=8.1.1 +ARG FFMPEG_VERSION=8.1.2 ARG FREETYPE_VERSION=2.14.3 ARG LIBPNG_VERSION=1.6.58 ARG VPX_VERSION=v1.15.2 diff --git a/docker/musllinux_1_2/Dockerfile_aarch64 b/docker/musllinux_1_2/Dockerfile_aarch64 index 6f425f042..f9a7aa801 100644 --- a/docker/musllinux_1_2/Dockerfile_aarch64 +++ b/docker/musllinux_1_2/Dockerfile_aarch64 @@ -3,7 +3,7 @@ FROM quay.io/pypa/musllinux_1_2_aarch64:latest ARG CCACHE_VERSION=4.13.6 -ARG FFMPEG_VERSION=8.1.1 +ARG FFMPEG_VERSION=8.1.2 ARG FREETYPE_VERSION=2.14.3 ARG LIBPNG_VERSION=1.6.58 ARG VPX_VERSION=v1.15.1 diff --git a/docker/musllinux_1_2/Dockerfile_x86_64 b/docker/musllinux_1_2/Dockerfile_x86_64 index 48c76cfcb..61f30efa3 100644 --- a/docker/musllinux_1_2/Dockerfile_x86_64 +++ b/docker/musllinux_1_2/Dockerfile_x86_64 @@ -3,7 +3,7 @@ FROM quay.io/pypa/musllinux_1_2_x86_64:latest ARG CCACHE_VERSION=4.13.6 -ARG FFMPEG_VERSION=8.1.1 +ARG FFMPEG_VERSION=8.1.2 ARG FREETYPE_VERSION=2.14.3 ARG LIBPNG_VERSION=1.6.58 ARG VPX_VERSION=v1.15.1 From 40fecd99c8299d74d4923a4e70da7b17c70d74e2 Mon Sep 17 00:00:00 2001 From: Md Salman Shams <68110323+MDSALMANSHAMS@users.noreply.github.com> Date: Thu, 23 Jul 2026 11:18:09 +0530 Subject: [PATCH 2/3] Re-trigger CI (transient PyPI network flake, unrelated to ffmpeg bump) From 72c283bc432a886dfd404f2fbce0135ed65826b0 Mon Sep 17 00:00:00 2001 From: Alexander Smorkalov Date: Thu, 23 Jul 2026 12:48:37 +0300 Subject: [PATCH 3/3] Docker images rebuild --- .github/workflows/build_wheels_manylinux.yml | 8 ++++---- docker/manylinux2014/Dockerfile_aarch64 | 2 +- docker/manylinux2014/Dockerfile_x86_64 | 2 +- docker/manylinux_2_28/Dockerfile_aarch64 | 2 +- docker/manylinux_2_28/Dockerfile_x86_64 | 2 +- docker/musllinux_1_2/Dockerfile_aarch64 | 2 +- docker/musllinux_1_2/Dockerfile_x86_64 | 2 +- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build_wheels_manylinux.yml b/.github/workflows/build_wheels_manylinux.yml index 5790ba950..13efa2146 100644 --- a/.github/workflows/build_wheels_manylinux.yml +++ b/.github/workflows/build_wheels_manylinux.yml @@ -33,16 +33,16 @@ jobs: include: - platform: aarch64 manylinux: 2014 - DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-aarch64:20260531 + DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-aarch64:20260723 - platform: x86_64 manylinux: 2014 - DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64:20260531 + DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64:20260723 - platform: x86_64 manylinux: 2_28 - DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux_2_28-x86-64:20260531 + DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux_2_28-x86-64:20260723 - platform: aarch64 manylinux: 2_28 - DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux_2_28-aarch64:20260531 + DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux_2_28-aarch64:20260723 env: ACTIONS_ALLOW_UNSECURE_COMMANDS: true diff --git a/docker/manylinux2014/Dockerfile_aarch64 b/docker/manylinux2014/Dockerfile_aarch64 index 0a09dfc7b..b7c70f3f7 100644 --- a/docker/manylinux2014/Dockerfile_aarch64 +++ b/docker/manylinux2014/Dockerfile_aarch64 @@ -1,4 +1,4 @@ -# Version: 20260531 +# Version: 20260723 # Image name: quay.io/opencv-ci/opencv-python-manylinux2014-aarch64 FROM quay.io/pypa/manylinux2014_aarch64:latest diff --git a/docker/manylinux2014/Dockerfile_x86_64 b/docker/manylinux2014/Dockerfile_x86_64 index 9ed273c78..b92ef9c78 100644 --- a/docker/manylinux2014/Dockerfile_x86_64 +++ b/docker/manylinux2014/Dockerfile_x86_64 @@ -1,4 +1,4 @@ -# Version: 20260531 +# Version: 20260723 # Image name: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64 FROM quay.io/pypa/manylinux2014_x86_64:latest diff --git a/docker/manylinux_2_28/Dockerfile_aarch64 b/docker/manylinux_2_28/Dockerfile_aarch64 index 9c3d46675..0cd732118 100644 --- a/docker/manylinux_2_28/Dockerfile_aarch64 +++ b/docker/manylinux_2_28/Dockerfile_aarch64 @@ -1,4 +1,4 @@ -# Version: 20260531 +# Version: 20260723 # Image name: quay.io/opencv-ci/opencv-python-manylinux_2_28-aarch64 FROM quay.io/pypa/manylinux_2_28_aarch64:latest diff --git a/docker/manylinux_2_28/Dockerfile_x86_64 b/docker/manylinux_2_28/Dockerfile_x86_64 index 08cbb2464..2be1667db 100644 --- a/docker/manylinux_2_28/Dockerfile_x86_64 +++ b/docker/manylinux_2_28/Dockerfile_x86_64 @@ -1,4 +1,4 @@ -# Version: 20260531 +# Version: 20260723 # Image name: quay.io/opencv-ci/opencv-python-manylinux_2_28-x86-64 FROM quay.io/pypa/manylinux_2_28_x86_64:latest diff --git a/docker/musllinux_1_2/Dockerfile_aarch64 b/docker/musllinux_1_2/Dockerfile_aarch64 index f9a7aa801..78902840d 100644 --- a/docker/musllinux_1_2/Dockerfile_aarch64 +++ b/docker/musllinux_1_2/Dockerfile_aarch64 @@ -1,4 +1,4 @@ -# version: 20260531 +# version: 20260723 # Image name: quay.io/opencv-ci/opencv-python-musllinux_1_2-aarch64 FROM quay.io/pypa/musllinux_1_2_aarch64:latest diff --git a/docker/musllinux_1_2/Dockerfile_x86_64 b/docker/musllinux_1_2/Dockerfile_x86_64 index 61f30efa3..503b14a40 100644 --- a/docker/musllinux_1_2/Dockerfile_x86_64 +++ b/docker/musllinux_1_2/Dockerfile_x86_64 @@ -1,4 +1,4 @@ -# version: 20260531 +# version: 20260723 # Image name: quay.io/opencv-ci/opencv-python-musllinux_1_2-x86-64 FROM quay.io/pypa/musllinux_1_2_x86_64:latest