[Feature]: Make opencv-python-headless an optional dependency for FIPS compliance

[rdwj]

🚀 The feature, motivation and pitch

On FIPS-enabled clusters (e.g., Red Hat OpenShift), opencv-python-headless 4.13.0.90 crashes vLLM at startup with FATAL FIPS SELFTEST FAILURE (crypto/fips/fips.c:154) because the wheel statically bundles OpenSSL 1.1.1k, which fails the kernel FIPS self-test. This is tracked in #33147.

The version cannot be pinned back to 4.12.0.88 because 4.13 contains the fix for CVE-2026-22778 (CVSS 9.8 RCE), as noted when #33756 was rejected. The upstream opencv-python fix (opencv/opencv-python#1190) remains unmerged.

However, since #39986 merged PyAV as the default video backend, opencv-python-headless is no longer required for the default code path. It is only needed when a user explicitly selects the opencv video backend via --media-io-kwargs '{"video": {"backend": "opencv"}}'.

Proposal: Move opencv-python-headless from requirements/common.txt to a new opencv optional extra in setup.py, following the existing pattern used by audio, tensorizer, otel, and others. When a user selects the opencv video backend without the package installed, vLLM should raise a clear error at import time directing them to pip install vllm[opencv].

This unblocks FIPS-enabled deployments without reverting the CVE fix, and aligns with the direction the project is already heading with the PyAV migration.

Related: #33147, #33756, #39986

Alternatives

• Wait for opencv-python upstream to stop bundling OpenSSL (manylinux: avoid bundling OpenSSL to fix FIPS import crash, Related issue: #28456 opencv/opencv-python#1190). This has been open since late 2025 with no merge timeline.
• Pin to <= 4.12.0.88, which was already rejected ([BugFix] Set opencv-python-headless <= 4.12.0.88 for FIPS Compliance #33756) due to CVE-2026-22778.
• Build custom vLLM images with opencv removed. This is what we currently do in our OpenShift AI deployments, but it shouldn't be necessary for every FIPS user.

Additional context

We operate FIPS-enabled OpenShift AI clusters and currently work around this by building an overlay image that removes opencv-python-headless entirely (vLLM uses Pillow for image processing, and PyAV for video). This has been running in production without issues. Happy to submit a PR implementing this change.

Before submitting a new issue...

• Make sure you already searched for relevant issues, and asked the chatbot living at the bottom right corner of the documentation page, which can answer lots of frequently asked questions.

[rdwj]

@russellb

[vrdn-23]

Just wanted to add a +1 to this.
I am also curious if there is any official documentation detailing FIPS compliance for vLLM @russellb.
If not, I'd love to work on contributing it if this is something that is missing. Even if vLLM is deciding that it doesn't care for FIPS compliance, I think having documentation that explains the reasoning and rationale behind it and what makes it hard would be worthwhile for posterity.