Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish_images.yml:
- Around line 41-43: Replace mutable action tags with pinned commit SHAs: for
each "uses: actions/checkout@v4" (and the other "uses: actions/..." occurrences
referenced in the review) update the value to the corresponding full commit SHA
from the actions' GitHub repo (e.g., fetch the latest commit SHA for the v4 tag
of actions/checkout) so the workflow uses "uses:
actions/checkout@<full-commit-sha>". Do this for every external action
occurrence flagged (the checkout and the other actions at the referenced
locations) to ensure all external actions are pinned to immutable SHAs.

In `@docs/getting-started/concepts/feast-types.md`:
- Line 15: The sentence about Map vs ScalarMap conflates two different inference
contexts; update the text to explicitly separate Python-level type inference
(function python_type_to_feast_value_type infers ScalarMap when the first dict
key is non-string) from backend/storage/schema behavior (backends do not infer
SCALAR_MAP from stored data and therefore ScalarMap must be explicitly declared
in the Feast schema). Refer to the types Map and ScalarMap and the
python_type_to_feast_value_type inference point, and reword the paragraph so it
first describes Map/ScalarMap shapes and Python inference, then a separate
sentence stating the requirement that ScalarMap must be declared in the schema
because backends do not perform this inference.

In `@go/infra/docker/feature-server/Dockerfile`:
- Line 1: The Dockerfile currently uses a floating base image tag in the FROM
instruction ("FROM golang:1.25"); update that line to pin the base image to a
specific patch version and its immutable digest (e.g., replace the floating tag
with a concrete patch tag plus `@sha256`:<digest>) so the build is reproducible
and provenance is preserved; locate the FROM golang:1.25 line in the Dockerfile
and replace it with the chosen patch+digest reference, then rebuild to verify
the digest matches the expected image.
- Line 2: Change the Dockerfile environment setting so release images use a
local, deterministic Go toolchain: replace the GOTOOLCHAIN value currently set
to "auto" with "local" for the release image build to prevent on-demand
downloads; update the ENV declaration for GOTOOLCHAIN in the Dockerfile (the
existing ENV GOTOOLCHAIN=auto) so release builds do not perform network
toolchain fetches and produce reproducible artifacts.

In `@infra/feast-operator/go.mod`:
- Line 89: The go.mod currently lists an indirect vulnerable dependency
"google.golang.org/grpc v1.68.1"; update go.mod to ensure grpc is at least
v1.79.3 by either adding an explicit require for "google.golang.org/grpc
v1.79.3" or using a replace/override to pin that module, or by bumping the
direct modules that pull it in (e.g., "sigs.k8s.io/controller-runtime" and
"github.com/prometheus-operator/prometheus-operator/pkg/client") to versions
that depend on grpc v1.79.3+; run "go mod tidy" after the change to update the
go.sum and vendor files.

In `@infra/website/docs/blog/mongodb-feast-integration.md`:
- Around line 67-73: Replace inline credential examples in the connection_string
fields with environment-variable based placeholders and guidance: change the
shown values for connection_string (both top-level connection_string and
offline_store.connection_string) to reference env vars (e.g., MONGODB_URI or
separate MONGODB_USER/MONGODB_PASSWORD) and add a short note that credentials
must be injected from the environment and that usernames/passwords must be
URL-encoded; update the documentation blocks near the connection_string and
offline_store entries to remove patterns like
mongodb+srv://<user>:<password>@... and instead show a safe example that
references env vars and explains URL-encoding requirements.
- Around line 44-45: The docs use two formats for distance metrics (lowercase
strings like `cosine`, `dot product`, `euclidean` in the
`vector_enabled`/`vector_index=True` explanation and uppercase enum-like values
like `COSINE` in the examples for `retrieve_online_documents_v2()`), causing
copy/paste errors; pick one canonical format (recommend lowercase string
literals: "cosine", "dot_product", "euclidean") and update all
occurrences—including the explanatory paragraph and the examples referenced
around `retrieve_online_documents_v2()` and any snippets at lines ~164 and
~187—so every snippet and description uses the same metric names consistently.

In `@infra/website/src/layouts/BaseLayout.astro`:
- Around line 38-41: The current fixed meta tags og:image:width (1201),
og:image:height (630) and og:image:type ("image/png") are incorrect for per-post
socialImage; update BaseLayout.astro to accept optional props ogImageWidth,
ogImageHeight, ogImageType (defaults matching the fallback [email protected]) and
use those props for the meta tags for og:image:width, og:image:height and
og:image:type (or, alternatively, omit those meta tags when socialImage !==
fallbackImage); ensure you reference the socialImage prop and replace the
hardcoded values in the meta tag nodes so callers can pass true dimensions and
MIME type for per-post images.

In `@infra/website/src/pages/blog/`[slug].astro:
- Around line 15-22: The extractHeroImage function's outer regex uses a
non-greedy capture up to the first </div>, which misses an <img> that appears
after a nested sibling closing tag; change the logic to first locate the opening
<div> with class "hero-image" (match the opening tag only, e.g. via
/<div[^>]*class=["'][^"']*\bhero-image\b[^"']*["'][^>]*>/i) then take the
substring starting after that opening-tag match and search forward for the first
<img ... src="..."> (e.g. use a second regex
/<img[^>]*\bsrc=["']([^"']+)["'][^>]*>/i on that substring) and return its src
if found; update extractHeroImage to implement this two-step search so
nested/sibling tags no longer cause the img to be missed.

In `@sdk/python/feast/type_map.py`:
- Around line 258-265: When decoding ScalarMap in _handle_scalar_map_value,
detect Python-key collisions produced by _map_key_to_python_value (e.g., True ==
1) instead of silently overwriting: before assigning result[key] = value, check
if key is already present in result and if so raise a clear exception (e.g.,
ValueError) that includes both the conflicting proto entry information and the
existing key/value to prevent silent data loss; update any callers/tests
accordingly to expect this failure mode.
- Line 1426: Add explicit handling for SCALAR_MAP in both conversion helpers:
update feast_value_type_to_pandas_type to include a branch mapping
ValueType.SCALAR_MAP to an appropriate pandas dtype (e.g., pandas.ObjectDtype or
pandas dtype 'object') instead of falling back, and update
_convert_value_type_str_to_value_type to recognize the string key used in the
proto mapping ("scalar_map_val") and return ValueType.SCALAR_MAP. Modify the
code inside the functions feast_value_type_to_pandas_type and
_convert_value_type_str_to_value_type to include these new cases so SCALAR_MAP
no longer hits the TypeError/STRING fallback.

In `@sdk/python/feast/types.py`:
- Line 135: The SCALAR_MAP Feast type is not mapped to PyArrow causing
KeyError/ValueError; add ValueType.SCALAR_MAP: pyarrow.binary() to the type_map
dict used by feast_value_type_to_pa (type_map.py) and add ScalarMap:
pyarrow.binary() to FEAST_TYPES_TO_PYARROW_TYPES in types.py (ScalarMap is
defined as PrimitiveFeastType.SCALAR_MAP), then add a unit test named
test_feast_value_type_to_pa_scalar_map that calls
feast_value_type_to_pa(ValueType.SCALAR_MAP) and asserts the result equals
pyarrow.binary().

In `@sdk/python/tests/unit/test_type_map.py`:
- Around line 2026-2032: In test_empty_value_map, ensure the encoded proto
actually set the scalar_map field and the decoded result is empty: after calling
python_values_to_proto_values([{}], ValueType.SCALAR_MAP) assert that
protos[0].WhichOneof('val') == 'scalar_map_val' (or that
protos[0].scalar_map_val is not an empty/default ProtoValue) and then assert
that feast_value_type_to_python_type(protos[0]) == {} to verify the decoded dict
is empty; keep the existing isinstance check if desired but add these two
explicit assertions to validate both encoding and decoding.

---

Outside diff comments:
In `@infra/feast-operator/Dockerfile`:
- Line 2: The FROM image in the Dockerfile currently uses the floating tag
"registry.access.redhat.com/ubi9/go-toolset:1.24"; replace this with a
non-floating identifier (either a specific patch tag like "go-toolset:1.24.4" or
the image digest "@sha256:...") so builds are reproducible and the build
environment cannot change silently; update the FROM line accordingly in the
Dockerfile reference to "registry.access.redhat.com/ubi9/go-toolset:1.24" so the
new pinned tag or digest is used.

In `@infra/feast-operator/go.mod`:
- Line 72: The go.mod entry for the OpenTelemetry SDK
(go.opentelemetry.io/otel/sdk v1.33.0) is vulnerable to PATH-hijacking CVEs;
update the module version to at least v1.43.0 by replacing the existing
go.opentelemetry.io/otel/sdk v1.33.0 line with an explicit pin to v1.43.0 (or
newer) so the project uses the patched SDK and re-run go mod tidy to refresh the
dependency graph referenced by go.opentelemetry.io/otel/sdk.

---

Nitpick comments:
In `@infra/website/src/pages/blog/`[slug].astro:
- Line 6: The SITE_URL constant is hardcoded; replace its usage with Astro.site
(the canonical site from astro.config.mjs) so the page and the BaseLayout
default ogUrl derive from Astro.site instead of a literal 'https://feast.dev'.
Remove or stop exporting the const SITE_URL and update references in this file
and the BaseLayout invocation (ogUrl default) to use Astro.site (or construct
URLs with new URL(Astro.url.pathname, Astro.site) where needed) ensuring no
other hardcoded domain strings remain.