Skip to content

fix: Do not pass undeclared feature view columns to ODFV UDFs - #6527

Merged
ntkathole merged 2 commits into
feast-dev:masterfrom
Vedant-Agarwal:fix/odfv-source-isolation
Jul 30, 2026
Merged

fix: Do not pass undeclared feature view columns to ODFV UDFs#6527
ntkathole merged 2 commits into
feast-dev:masterfrom
Vedant-Agarwal:fix/odfv-source-isolation

Conversation

@Vedant-Agarwal

Copy link
Copy Markdown
Contributor

What

An OnDemandFeatureView's UDF (pandas and python modes) was receiving every feature column in the online response, including features from feature views that the ODFV did not list in its sources. This allowed a UDF to silently depend on an undeclared source.

This filters the UDF input down to the ODFV's declared sources before the transform runs. Join keys, request-source fields and the declared features are kept; only columns from undeclared feature views are removed. substrait already restricts its inputs through its query plan, so it is left as is.

Fixes #6158.

Tests

Three tests were added in test_on_demand_pandas_transformation.py:

  • pandas mode: the UDF sees its declared feature and the entity join key, but not another requested feature view's column.
  • python mode: the same check with the dict input.
  • two ODFVs: one ODFV's UDF does not see the other ODFV's source column, even when that feature view is present only as the other ODFV's input.

Each of these fails on the current code and passes with this change.

Functional test results:

$ pytest tests/unit/test_on_demand_pandas_transformation.py \
    -k "undeclared or other_requested_odfv"
3 passed in 0.52s

ruff and mypy are clean.

Scope

This covers the online path (get_online_features), which is what the issue reports. The offline path (get_historical_features) has the same shape and can be addressed as a follow-up.

@Vedant-Agarwal
Vedant-Agarwal requested a review from a team as a code owner June 15, 2026 20:56
Comment thread sdk/python/feast/utils.py
# stay. substrait filters on its own, so leave it alone.
declared_source_names = {
projection.name
for projection in odfv.source_feature_view_projections.values()

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FeatureViewProjection can carry a name_alias or version tag, but these comparisons and column names use .name. For an ODFV sourced from an aliased projection, won’t the alias-qualified input be classified as undeclared while alias__feature also escapes the second filter? Should these use projection.name_to_use() instead?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @Sanjays2402 — fair question, so I verified it against this branch (checked out this PR's head) rather than guess.

With an ODFV sourced from an aliased projection:

aliased = driver_stats.with_name("aliased_stats")
# projection.name = 'driver_stats', name_to_use() = 'aliased_stats'

the columns feeding the transform come through as ['driver_stats__conv_rate', 'conv_rate'].name-qualified, not alias-qualified. That's consistent with how source refs are built throughout on_demand_feature_view.py (f"{source_fv_projection.name}__{feature.name}", e.g. the loops around lines 987/1055/1151/1261). So .name matches the real column names here; switching to name_to_use() would build aliased_stats__conv_rate, which isn't present, and would drop the declared feature.

On version_tag: it's only set via from_proto (there's no user-facing setter), and the retrieval path keys source columns by .name regardless — so even a versioned projection's column is still driver_stats__conv_rate.

I'll add a test with an aliased source to lock this behavior in. If you know a path (offline retrieval?) where the input comes through alias-qualified, point me at it and I'll handle that too — I exercised online retrieval here.

@Vedant-Agarwal
Vedant-Agarwal force-pushed the fix/odfv-source-isolation branch from 73a4b10 to 883dc2d Compare July 21, 2026 21:04
@ntkathole
ntkathole force-pushed the fix/odfv-source-isolation branch from 883dc2d to 797ed12 Compare July 30, 2026 08:52
@ntkathole ntkathole changed the title fix: do not pass undeclared feature view columns to ODFV UDFs fix: Do not pass undeclared feature view columns to ODFV UDFs Jul 30, 2026
@codecov-commenter

codecov-commenter commented Jul 30, 2026

Copy link
Copy Markdown

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 95.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 46.40%. Comparing base (3c2ae3c) to head (8bb6764).
⚠️ Report is 3 commits behind head on master.

Files with missing lines Patch % Lines
sdk/python/feast/utils.py 95.00% 0 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #6527      +/-   ##
==========================================
+ Coverage   46.37%   46.40%   +0.02%     
==========================================
  Files         414      414              
  Lines       50089    50109      +20     
  Branches     7159     7167       +8     
==========================================
+ Hits        23231    23254      +23     
+ Misses      25231    25228       -3     
  Partials     1627     1627              
Flag Coverage Δ
go-feature-server 30.58% <ø> (ø)
python-unit 47.70% <95.00%> (+0.02%) ⬆️
Files with missing lines Coverage Δ
sdk/python/feast/utils.py 77.57% <95.00%> (+0.63%) ⬆️

... and 1 file with indirect coverage changes


Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3c2ae3c...8bb6764. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

An OnDemandFeatureView's UDF was receiving every feature column in the online response, including features from feature views that the ODFV did not list in its sources. That allowed a UDF to silently depend on an undeclared source.

This filters the UDF input down to the ODFV's declared sources before the transform runs, so columns from undeclared feature views are hidden. Join keys, request data and the declared features are kept. substrait already restricts its inputs through its query plan, so it is left as is.

Fixes feast-dev#6158.

Signed-off-by: Vedant Agarwal <vedantagwl10@gmail.com>
Add a regression test that sources a pandas ODFV from an aliased feature
view (with_name) and asserts the declared feature still reaches the UDF
while an unrelated feature view stays hidden. The isolation filter keys
columns by projection.name, which is what the retrieval path emits
regardless of the alias; the test fails if that is switched to name_to_use().

Signed-off-by: Vedant Agarwal <vedantagwl10@gmail.com>
@ntkathole
ntkathole force-pushed the fix/odfv-source-isolation branch from 797ed12 to 8bb6764 Compare July 30, 2026 11:10
@ntkathole
ntkathole merged commit 75b9463 into feast-dev:master Jul 30, 2026
17 of 22 checks passed
jyejare pushed a commit to opendatahub-io/feast that referenced this pull request Aug 5, 2026
…dev#6527)

* fix: do not pass undeclared feature view columns to ODFV UDFs

An OnDemandFeatureView's UDF was receiving every feature column in the online response, including features from feature views that the ODFV did not list in its sources. That allowed a UDF to silently depend on an undeclared source.

This filters the UDF input down to the ODFV's declared sources before the transform runs, so columns from undeclared feature views are hidden. Join keys, request data and the declared features are kept. substrait already restricts its inputs through its query plan, so it is left as is.

Fixes feast-dev#6158.

Signed-off-by: Vedant Agarwal <vedantagwl10@gmail.com>

* test: cover ODFV source isolation for an aliased source

Add a regression test that sources a pandas ODFV from an aliased feature
view (with_name) and asserts the declared feature still reaches the UDF
while an unrelated feature view stays hidden. The isolation filter keys
columns by projection.name, which is what the retrieval path emits
regardless of the alias; the test fails if that is switched to name_to_use().

Signed-off-by: Vedant Agarwal <vedantagwl10@gmail.com>

---------

Signed-off-by: Vedant Agarwal <vedantagwl10@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OnDemandFeatureView (pandas/python mode) UDF receives all response columns, not just declared sources

4 participants