chore: Sync upstream feast-dev/feast master - #220

to_tensor decides between a torch.Tensor and a plain list by looking at
the first value that is not None, but it searches the list where the
missing values have already been replaced by default_value. That default
is float('nan') by default, which is not None, so the search always
returns the first element.

When the first entity row is missing, the type is then read off the
default rather than off the feature. A string feature whose first row is
absent, the ordinary case of an entity key that is not in the online
store, raises 'Failed to convert values for ... to tensor: new():
invalid data type' instead of returning the list the docstring promises.
Reordering the entity rows makes the error disappear.

Read the first present value from the retrieved list. The fallback stays
default_value so that a fully missing numeric feature keeps taking the
tensor path, which the added regression test pins.

Signed-off-by: Rodrigo-Palma <[email protected]>

ApplyValidationReference and ApplyMaterialization built the full domain
object inside the argument list of their permission check:

    assert_permissions(
        resource=FeatureView.from_proto(request.feature_view),
        actions=[AuthzedAction.WRITE_ONLINE],
    )

Python evaluates arguments first, so from_proto() — which dill-loads the
caller-supplied UDF — always ran before assert_permissions() could reject
the request. Unpickling executes arbitrary code, so an unauthorized caller
achieved code execution and only then received a permission error.

Load metadata first, authorize, and deserialize only after the check
passes. The permission check needs just name/project/tags, never the
callable itself.

FeatureView.from_proto() already accepted skip_udf; this adds the same
parameter to ValidationReference.from_proto(), gating both the GEProfiler
and GEProfile dill payloads. As a result profiler may now legitimately be
unset, so it becomes Optional and the profile property raises a clear
error rather than failing on None.

This covers the registry server paths only. Deserialization on the
feature server is not addressed here.

Signed-off-by: Chaitany Patel <[email protected]>

The rbac-remote README told readers to set the client auth type to
`kuberentes`, while the linked feature_store.yaml (and Feast itself)
uses `kubernetes`. Copying the documented value gives an invalid auth
type.

Also corrects spelling in the docs: directories, entity, versions,
every time, workflow, Registries, accommodate, supersede, running,
activities, and a doubled "the the".

Signed-off-by: toyeshhm <[email protected]>

Signed-off-by: Francisco Javier Arceo <[email protected]>

…dev#6858)

* fix: Allow dill 0.4 so UDF serialization works on Python 3.14

dill~=0.3.0 keeps Python 3.14 users on dill 0.3.9, which does not
support 3.14's changes to pickle. Serializing a UDF with
dill.dumps(udf, recurse=True), as Transformation.to_proto() and
StreamFeatureView.to_proto() do, fails with "TypeError:
_Pickler._batch_setitems() missing 1 required positional argument:
'obj'" whenever the UDF refers to a module-level global such as pd, so
on-demand feature views cannot be applied on 3.14.

dill added Python 3.14 support in 0.4.0 and made it formal in 0.4.1.
Allow it. The lock files still resolve dill 0.3.9 for 3.10-3.12, and
pixi.lock only records the new requirement (from `pixi lock`).

Signed-off-by: Yihang Chen <[email protected]>

* chore: Regenerate Python requirement locks for dill 0.4

Signed-off-by: Yihang Chen <[email protected]>

---------

Signed-off-by: Yihang Chen <[email protected]>

Aggregation.__init__ types time_window and slide_interval as Optional and
to_proto honours that: it only writes the Duration when the value is not
None. from_proto tests the value instead of the presence, and an absent
Duration also reports ToNanoseconds() == 0, so an aggregation defined
without a window comes back with timedelta(0).

That difference is load bearing. aggregation_specs_to_agg_ops rejects a
windowed aggregation in online serving with 'if getattr(agg,
"time_window", None) is not None', so an on demand feature view with a
plain Aggregation(column=..., function=...) works in process and then
fails with 'Time window aggregation is not supported in online serving.'
on the first get_online_features after feast apply, whatever the
registry. The same round-trip runs for StreamFeatureView.

Read the field through HasField, which is available because both are
google.protobuf.Duration message fields. Aggregation.__eq__ compares
these two attributes, so this also stops a registry diff from seeing an
unchanged feature view as modified.

Signed-off-by: Rodrigo-Palma <[email protected]>

…6-09-28