CVE-2026-18948 (9.9 Critical, no fixed version on PyPI) blocks us from installing feast

Our internal vulnerability scanner flags CVE-2026-18948 (CVSS 9.9, Critical) in feast
(https://nvd.nist.gov/vuln/detail/CVE-2026-18948). Since there is no fixed version on PyPI,
we cannot install the feast SDK at all.

It is still unfixed in the latest releases: 0.66.0 is affected, and the nightly
0.67.0.dev94 carries the same vulnerable code (`udf_rehydrate.py` is byte-identical).

Could you please:
1. ship the fix in an upcoming release (0.67.0, or a 0.66.x patch) and note the fixed
version in the release notes;
2. fill in the affected/patched ranges in https://github.com/advisories/GHSA-gg2p-37pv-v7fq, so scanners can clear the alert once a fix exists;
3. if this is out of scope upstream, say so explicitly — a documented decision lets us
proceed internally.

Happy to test a patch or send a PR. Thanks.

Start by inspecting udf_rehydrate.py and comparing it with the affected 0.66.0 and nightly 0.67.0.dev94 versions to understand the vulnerable code. Review the release process and GHSA-gg2p-37pv-v7fq metadata; done means a validated fix is shipped, the fixed version is documented in release notes, and the advisory ranges are updated.

Written by the indexing model from the issue text.