Gokul Anantha Narayanan

fix(core,mlops): honor caller region in feature_store ingest_dataframe and stop telemetry from blocking SDK calls (#6197) * feat(mlops): allow specifying region in feature_store ingest_dataframe ingest_dataframe() had no way to say which AWS region the FeatureGroup lives in, so both the DescribeFeatureGroup call and the record writes fell back to whatever region boto3 resolved, with no caller control. Add an optional `region` argument and thread it through the whole ingestion path: - feature_utils.ingest_dataframe -> CoreFeatureGroup.get(region=...) and IngestionManagerPandas(region=...) - IngestionManagerPandas gains a `region` field, forwarded to put_record(region=...) and batch_write_record(region=...) in the single-thread, multi-thread, multi-process, and BatchWriteRecord paths `region` is appended last and defaults to None, so existing calls and their behavior are unchanged. * fix(core): stop telemetry from blocking SDK calls Telemetry could add unbounded latency to any decorated SDK call. A Feature Store ingest was reported taking ~47 minutes from a private VPC while the underlying PutRecord completed server-side in 348ms; all of the remaining time was spent in the two telemetry emissions that follow the call. Three defects, all in the emission path: 1. `_requests_helper` passed the timeout positionally. `requests.get` takes `params` as its second positional argument, so the value was appended to the query string and the request had no timeout at all. From a VPC with no route to the telemetry endpoint the GET hung until a network device dropped the flow. Now passed as `timeout=`, verified bounded at ~2s against a black-holed address. The same one-line defect existed in sagemaker-serve's telemetry_logger and is fixed there too. 2. `_get_default_sagemaker_session` hardcoded us-west-2. Module-level functions such as `ingest_dataframe` have no session of their own, so the decorator synthesizes one, which pointed both the STS `get_caller_identity` call and the telemetry GET at a region the caller may have no route to. The region is now resolved by boto3 from the caller's environment, with the default kept only as a last resort since `Session` requires a region. 3. Emission was synchronous. `_send_telemetry_request` now dispatches to a daemon thread and returns immediately, so neither the STS call nor the GET can sit in the caller's critical path. Daemon threads are killed at interpreter exit, so a pending send cannot delay shutdown either. In-flight sends are capped and excess events dropped rather than growing threads without bound, and nothing can escape the thread. The existing body moved to `_send_telemetry_request_sync`. Telemetry request failures now log at debug instead of logging a full traceback at error level; a best-effort metric should not look like an error. Note: events queued at process exit may now be lost. That is the intended trade-off for never blocking the caller. * fix(core): never drop telemetry events when sending asynchronously Removes the in-flight cap added alongside the async send. Telemetry events are data we cannot silently lose, so every event now gets its own daemon thread rather than being dropped once eight sends are outstanding. Feature Store ingestion is the special case that motivated moving the send off the caller's thread at all: it is decorated at more than one level (ingest_dataframe and IngestionManagerPandas.run), so a single user call emits several events, and sending them serially turned an ingest the service finished in under a second into a multi-minute wait.

fix: anchor tar member validation to extract_path in sagemaker-core (#6195) custom_extractall_tarfile falls back to filtering members with _get_safe_members when tarfile.data_filter is unavailable (Python < 3.12, before the 3.9.17 / 3.10.12 / 3.11.4 backports). That fallback had two containment defects that combined to let an archive member be written outside the extraction directory: - _get_safe_members anchored its check to the process working directory (_get_resolved_path("")) rather than the directory the archive is extracted into. It now takes the base as an argument, and custom_extractall_tarfile passes the resolved extract_path. - _is_bad_path compared paths with str.startswith, so a sibling directory sharing a textual prefix with the base (e.g. base "/tmp/extract" and "/tmp/extract-evil/f") was treated as contained. Containment is now checked with os.path.commonpath, via a shared _is_within_base helper that _validate_extracted_paths uses as well. Absolute member paths are now rejected outright, since joinpath would otherwise silently discard the base for them. Both defects were required for the escape: relative member resolution is base-independent under normpath, so a plain "../../x" member does not escape on its own. The working-directory anchoring is what made a prefix-matching sibling ("<cwd>" vs "<cwd>evil") pass validation while extraction still wrote outside extract_path. _validate_extracted_paths only walks extract_path, so it did not catch the escape either. This is the shared utility every v3 extraction path routes through (model unpack, local/image.py, serve TGI and DJL prepare, pipeline repack). An already-correct implementation of the same logic exists in sagemaker-mlops/src/sagemaker/mlops/workflow/_repack_model.py; this brings common_utils.py in line with it. Adds regression tests covering the end-to-end escape, the sibling-prefix bypass, absolute members, and that validation is anchored to extract_path.