@@ -22,9 +22,13 @@ def add_cpu_hashes(requirements: str, cpu_requirements: str) -> str:
 
     def add_hashes(match: re.Match[str]) -> str:
         name, version = match[1], match[2]
+        # Universal torch-backend locks already emit dedicated +cpu lines; leave
+        # those alone and only augment the plain/PyPI pin with CPU wheel hashes.
+        if version.endswith("+cpu"):
+            return match[0]
         hashes = cpu_hashes.get((name, f"{version}+cpu"))
         if not hashes:
-            raise ValueError(f"Missing CPU hashes for {name}=={version}")
+            raise ValueError(f"Missing CPU hashes for {name}=={version}+cpu")
         hashes = hashes | set(re.findall(r"sha256:[0-9a-f]{64}", match[0]))
         header = match[0].splitlines()[0]
         return (
@@ -43,7 +47,13 @@ def main() -> None:
     parser.add_argument("--python-version", required=True)
     args = parser.parse_args()
     contents = args.requirements.read_text()
-    pins = [f"{match[1]}=={match[2]}" for match in TORCH_REQUIREMENT.finditer(contents)]
+    pins = sorted(
+        {
+            f"{match[1]}=={match[2].removesuffix('+cpu')}"
+            for match in TORCH_REQUIREMENT.finditer(contents)
+            if not match[2].endswith("+cpu")
+        }
+    )
     if not pins:
         raise ValueError("No hashed PyTorch requirements found")
     with tempfile.TemporaryDirectory() as tmp:

diff --git a/pixi.lock b/pixi.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -180,7 +180,7 @@ test = [
 ci = [
     "feast[test, aws, azure, cassandra, clickhouse, couchbase, delta, docling, duckdb, elasticsearch, faiss, gcp, ge, glide, go, grpcio, hazelcast, hbase, ibis, iceberg, image, k8s, mcp, mcp-server, milvus, mlflow, mongodb, mssql, mysql, openlineage, opentelemetry, oracle, scylladb, spark, trino, postgres, pytorch, qdrant, rag, ray, redis, singlestore, snowflake, sqlite_vec]",
     "build",
-    "virtualenv>=20.26,<21",
+    "virtualenv==21.14.1",
     "dbt-artifacts-parser",
     "ruff>=0.8.0",
     "mypy-protobuf>=3.1",

@@ -94,9 +94,9 @@ def __init__(
         # Defer kubeconfig load until materialize/cleanup — feast apply only
         # constructs the engine and calls update() (a no-op), so it must not
         # require a cluster.
-        self._k8s_client = None
-        self._core_v1 = None
-        self._custom_api = None
+        self._k8s_client: Optional[client.ApiClient] = None
+        self._core_v1: Optional[client.CoreV1Api] = None
+        self._custom_api: Optional[client.CustomObjectsApi] = None
         self._server_id = uuid.uuid4().hex[:8]
 
     def _ensure_k8s(self) -> None:

@@ -1,6 +1,6 @@
 import logging
 import time
-from typing import Optional
+from typing import Any, Optional, cast
 
 from kubernetes import client
 from kubernetes.client.exceptions import ApiException
@@ -135,12 +135,15 @@ def _get_cr_with_retry(self) -> Optional[dict]:
         last_exc = None
         for attempt in range(_MAX_RETRIES):
             try:
-                return self.custom_api.get_namespaced_custom_object(
-                    group="sparkoperator.k8s.io",
-                    version="v1beta2",
-                    namespace=self.namespace,
-                    plural="sparkapplications",
-                    name=f"feast-sa-{self._job_id}",
+                return cast(
+                    Optional[dict[Any, Any]],
+                    self.custom_api.get_namespaced_custom_object(
+                        group="sparkoperator.k8s.io",
+                        version="v1beta2",
+                        namespace=self.namespace,
+                        plural="sparkapplications",
+                        name=f"feast-sa-{self._job_id}",
+                    ),
                 )
             except ApiException as e:
                 if e.status == 404:

@@ -1,9 +1,12 @@
 import logging
 import os
 import ssl
-from typing import Optional
+from typing import TYPE_CHECKING, Optional
 from unittest.mock import Mock
 
+if TYPE_CHECKING:
+    from kubernetes.client import AuthenticationV1Api
+
 import jwt
 from fastapi import Request
 from fastapi.security import OAuth2AuthorizationCodeBearer
@@ -40,7 +43,7 @@ def __init__(self, auth_config: OidcAuthConfig):
             verify_ssl=self._auth_config.verify_ssl,
             ca_cert_path=self._auth_config.ca_cert_path,
         )
-        self._k8s_auth_api = None
+        self._k8s_auth_api: Optional["AuthenticationV1Api"] = None
         self._jwks_client: Optional[PyJWKClient] = None  # Initialize it lazily.
 
     def _get_jwks_client(self) -> PyJWKClient:
@@ -293,15 +296,13 @@ async def _validate_k8s_sa_token_and_extract_namespace(
         token_review = client.V1TokenReview(
             spec=client.V1TokenReviewSpec(token=access_token)
         )
-        auth_api: client.AuthenticationV1Api = self._k8s_auth_api
-        response = auth_api.create_token_review(token_review)
-
-        if not response.status.authenticated:
-            raise AuthenticationError(
-                f"Kubernetes token validation failed: {response.status.error}"
-            )
+        response = self._k8s_auth_api.create_token_review(token_review)
+        status = response.status
+        if status is None or not status.authenticated:
+            error = getattr(status, "error", None) if status is not None else None
+            raise AuthenticationError(f"Kubernetes token validation failed: {error}")
 
-        username = getattr(response.status.user, "username", "") or ""
+        username = getattr(status.user, "username", "") or ""
         namespaces = []
         if username.startswith("system:serviceaccount:") and username.count(":") >= 3:
             namespaces.append(username.split(":")[2])