fix(customizer): CVE remediation

[soluwalana]

Summary by CodeRabbit

• New Features
  • Updated embedding training to the newer bi-encoder workflow, with revised dataset/collator wiring and a top-level temperature setting.
  • Expanded container CUDA 13.2 wheel support (including newer compatible builds).
• Bug Fixes
  • Improved checkpoint initialization to avoid DTensor/sharded embedding failures.
  • Switched VLM video reading to torchcodec, removing older video dependencies.
  • Updated embedding ONNX export to use the appropriate bi-encoder export path.
• Documentation
  • Refreshed Automodel/container docs and contract-test references for the new embedding training entry point.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ec6e1c89-bf69-44ec-856d-60d375a94d8b

📥 Commits

Reviewing files that changed from the base of the PR and between 62d9df5 and 8d9a1e6.

📒 Files selected for processing (1)

• docker/Dockerfile.nmp-automodel-base

🚧 Files skipped from review as they are similar to previous changes (1)

• docker/Dockerfile.nmp-automodel-base

---

📝 Walkthrough

Walkthrough

The PR repoints Automodel Docker builds to PyTorch 26.05, rebuilds CUDA wheel stages, removes decord and imageio-ffmpeg from one Automodel cherry-pick, and switches embedding training, docs, and contract fixtures to the bi-encoder recipe path.

Changes

Automodel build and embedding updates

Layer / File(s)	Summary
Base image and wheel rebuild docker/Dockerfile.nmp-automodel-base, docker/base/Dockerfile.mamba-wheel, docker-bake.hcl	The Automodel base Dockerfile, mamba wheel Dockerfile, and bake pins switch to a parameterized PyTorch 26.05 base, add CUDA 13.2 wheel stages, repin bitsandbytes, and update the bake defaults.
Cherry-pick patch and README docker/automodel/cherry-picks/3d98f6e3.diff, docker/automodel/README.md	The 3d98f6e3.diff cherry-pick removes decord and imageio-ffmpeg from Automodel extras and uv.lock, and the README adds the patch entry and new base-image text.
Bi-encoder runtime wiring services/automodel/src/nmp/automodel/tasks/training/backends/checkpoints.py, services/automodel/src/nmp/automodel/tasks/training/backends/config.py, services/automodel/src/nmp/automodel/tasks/training/backends/finetune.py	The embedding backend switches to TrainBiEncoderRecipe, changes the model target to NeMoAutoModelBiEncoder, updates ONNX export, sets temperature, enables activation checkpointing, and rewires train and validation retrieval datasets to BiEncoderCollator with n_passages.
Contract docs and fixtures services/automodel/tests/contract/README.md, services/automodel/tests/contract/output_configs/embed_1b_*.yaml	The contract README updates embedding commands and recipe names, and the embedding YAML fixtures switch to the bi-encoder target, temperature, model_type: bi_encoder, BiEncoderCollator, and n_passages.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#445: repins the same BASE_TAG_AUTOMODEL and WHEELS_TAG defaults in docker-bake.hcl.
• NVIDIA-NeMo/nemo-platform#288: also changes Docker bake configuration used for Automodel image builds.

Suggested reviewers

• svvarom
• gabwow

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main intent: a security-driven dependency and base-image update for CVE remediation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch solu/customizer-cves

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

services/automodel/src/nmp/automodel/tasks/training/backends/checkpoints.py (1)

358-372: 🩺 Stability & Availability | 🟠 Major

Fix the exporter import path in services/automodel/src/nmp/automodel/tasks/training/backends/checkpoints.py:358
nemo_automodel.components.models.llama_bidirectional.export_onnx is not present in the shipped nemo_automodel package; this import will fail when embedding export runs. Point it at the actual biencoder exporter module.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/automodel/src/nmp/automodel/tasks/training/backends/checkpoints.py`
around lines 358 - 372, The embedding export import in the checkpoint export
flow points to a non-shipped llama_bidirectional module, so the import will fail
at runtime. Update the import used in the embedding export path inside the
checkpoint logic to reference the actual biencoder exporter module, and make
sure the call to export_to_onnx still uses the same arguments in the surrounding
try block.

services/automodel/src/nmp/automodel/tasks/training/backends/config.py (1)

80-114: 🩺 Stability & Availability | 🔴 Critical

Point this config at the biencoder class and move temperature into model.

• cfg["temperature"] is ignored here; TrainBiencoderRecipe only instantiates self.cfg.model, and LlamaBidirectionalModel reads temperature from the model config.
• nemo_automodel._transformers.auto_model.NeMoAutoModelBiEncoder is not present; use nemo_automodel.components.models.biencoder.biencoder_model.NeMoAutoModelBiencoder.
• make_retrieval_dataset takes train_n_passages, and the collator is RetrievalBiencoderCollator.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/automodel/src/nmp/automodel/tasks/training/backends/config.py`
around lines 80 - 114, The embedding-model config is pointing at the wrong
backend and placing `temperature` in the wrong scope: `TrainBiencoderRecipe`
only uses `cfg["model"]`, so move `temperature` under the `model` config instead
of the top level. In the `_is_embedding_model` branch of the config builder,
replace the current `NeMoAutoModelBiEncoder.from_pretrained` target with
`nemo_automodel.components.models.biencoder.biencoder_model.NeMoAutoModelBiencoder`,
and keep the rest of the biencoder-specific settings aligned with
`LlamaBidirectionalModel` expectations.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@services/automodel/src/nmp/automodel/tasks/training/backends/finetune.py`:
- Line 20: The import in the finetune training backend points to the wrong
recipe module and class name. Update the reference used by the training backend
to the biencoder API exposed by nemo_automodel 0.2.0, replacing
TrainBiEncoderRecipe from nemo_automodel.recipes.retrieval.train_bi_encoder with
TrainBiencoderRecipe from nemo_automodel.recipes.biencoder.train_biencoder, and
make sure any corresponding references in the same backend match the new symbol
names.

---

Outside diff comments:
In `@services/automodel/src/nmp/automodel/tasks/training/backends/checkpoints.py`:
- Around line 358-372: The embedding export import in the checkpoint export flow
points to a non-shipped llama_bidirectional module, so the import will fail at
runtime. Update the import used in the embedding export path inside the
checkpoint logic to reference the actual biencoder exporter module, and make
sure the call to export_to_onnx still uses the same arguments in the surrounding
try block.

In `@services/automodel/src/nmp/automodel/tasks/training/backends/config.py`:
- Around line 80-114: The embedding-model config is pointing at the wrong
backend and placing `temperature` in the wrong scope: `TrainBiencoderRecipe`
only uses `cfg["model"]`, so move `temperature` under the `model` config instead
of the top level. In the `_is_embedding_model` branch of the config builder,
replace the current `NeMoAutoModelBiEncoder.from_pretrained` target with
`nemo_automodel.components.models.biencoder.biencoder_model.NeMoAutoModelBiencoder`,
and keep the rest of the biencoder-specific settings aligned with
`LlamaBidirectionalModel` expectations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6cf66553-20ac-4dd1-b0e7-1c31c72e255c

📥 Commits

Reviewing files that changed from the base of the PR and between b4473e8 and 6563252.

📒 Files selected for processing (11)

• docker/Dockerfile.nmp-automodel-base
• docker/automodel/README.md
• docker/automodel/cherry-picks/3d98f6e3.diff
• docker/automodel/cherry-picks/e6d2930a.diff
• docker/base/Dockerfile.mamba-wheel
• services/automodel/src/nmp/automodel/tasks/training/backends/checkpoints.py
• services/automodel/src/nmp/automodel/tasks/training/backends/config.py
• services/automodel/src/nmp/automodel/tasks/training/backends/finetune.py
• services/automodel/tests/contract/README.md
• services/automodel/tests/contract/output_configs/embed_1b_full_sft.yaml
• services/automodel/tests/contract/output_configs/embed_1b_lora.yaml

💤 Files with no reviewable changes (1)

• docker/automodel/cherry-picks/e6d2930a.diff

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	20910/27478	76.1%	61.2%
Integration Tests	12108/26247	46.1%	19.5%