CVE-2026-18948 (9.9 Critical, no fixed version on PyPI) blocks us from installing feast

[yuan1j]

Our internal vulnerability scanner flags CVE-2026-18948 (CVSS 9.9, Critical) in feast
(https://nvd.nist.gov/vuln/detail/CVE-2026-18948). Since there is no fixed version on PyPI,
we cannot install the feast SDK at all.

It is still unfixed in the latest releases: 0.66.0 is affected, and the nightly
0.67.0.dev94 carries the same vulnerable code (udf_rehydrate.py is byte-identical).

Could you please:

1. ship the fix in an upcoming release (0.67.0, or a 0.66.x patch) and note the fixed
   version in the release notes;
2. fill in the affected/patched ranges in GHSA-gg2p-37pv-v7fq, so scanners can clear the alert once a fix exists;
3. if this is out of scope upstream, say so explicitly — a documented decision lets us
   proceed internally.

Happy to test a patch or send a PR. Thanks.