Bump FFmpeg to 8.1.2 on 5.x (CVE-2026-8461)

[MDSALMANSHAMS]

Summary

Bumps FFmpeg from 8.1.1 to 8.1.2 on the 5.x branch to fix CVE-2026-8461 (out-of-bounds write in FFmpeg's MagicYUV decoder, CWE-787, CVSS 8.8), fixed upstream in FFmpeg 8.1.2.

This mirrors #1249, which already landed the same bump on 4.x (shipped in 4.14.0.94). 5.x was still building its manylinux/musllinux wheels against 8.1.1, so it remained exposed. Follow-up requested in #1248.

Changes

File(s)	Change
docker/manylinux2014/Dockerfile_{aarch64,x86_64}	FFMPEG_VERSION 8.1.1 → 8.1.2
docker/manylinux_2_28/Dockerfile_{aarch64,x86_64}	FFMPEG_VERSION 8.1.1 → 8.1.2
docker/musllinux_1_2/Dockerfile_{aarch64,x86_64}	FFMPEG_VERSION 8.1.1 → 8.1.2
.github/workflows/build_wheels_manylinux.yml	manylinux DOCKER_IMAGE tags :20260531 → :20260725 (the same 8.1.2 images 4.x now ships)

Scope

• The manylinux jobs build inside the prebuilt DOCKER_IMAGE, so pointing the tags at :20260725 is what actually delivers 8.1.2 into the wheels; the Dockerfile ARG bumps keep the recipes in sync.
• The 5.x i686 build is on a separate, older FFmpeg 5.1.x line and is intentionally left unchanged here.

This only gets the fix into the branch — cutting/publishing the 5.x release is a maintainer action whenever you're ready. cc @asmorkalov @aremishevsky

[MDSALMANSHAMS]

@asmorkalov friendly ping on this one — it's the 5.x half of #1248 (the same CVE-2026-8461 FFmpeg 8.1.2 bump that shipped on 4.x in #1249), and CI has now settled.

Current state on 80634fcb: 199 success / 13 skipped / 1 failure. The single red job, Build (3.9, x64, 1, 1, 0) (macOS 13 arm64), built the wheel successfully — it fails at the very end on artifact upload:

##[error]Failed to CreateArtifact: Unable to make request: ETIMEDOUT

So that is a GitHub artifact-upload timeout after a clean build, not a build break. Worth noting it also confirms FFmpeg 8.1.2 compiles fine on macOS arm64.

The change is 7 files, +16/-16: FFMPEG_VERSION 8.1.1 → 8.1.2 in the six manylinux/musllinux Dockerfiles, plus the four manylinux DOCKER_IMAGE tags in build_wheels_manylinux.yml bumped :20260531 → :20260725 (the 8.1.2 images 4.x already ships) — that tag bump is what actually delivers 8.1.2 into the wheels. 5.x i686 is deliberately left on its older 5.1.4 line; jumping 32-bit to 8.x is a separate, riskier change and out of scope for a CVE hotfix.

Good to merge whenever you have a moment.