[GH-ISSUE #3072] comfyui-image-oasis@1.4.0 flagged by registry security scan (2 info-level false positives) - listing info missing #1096

New issue

Open

opened 2026-10-27 21:25:45 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-27 21:25:45 +00:00

Owner

Originally created by @NikoDemon80 on GitHub (Jul 9, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3072

Hey, dev of comfyui-image-oasis here, following up on the flags for 1.4.0. Both are info level and I believe both are benign:

requirements.txt line 28 (contains_custom_url_dependency): the URL is inside a comment block that's explicitly labeled "Non-pip dependency (NOT installable here)". It's just documentation pointing users at city96's ComfyUI-GGUF custom node, which is optional and only needed for the GGUF source type. Nothing in the file actually installs from a URL, pip never touches that line. Happy to reword the comment to drop the raw URL in the next release if that keeps the scanner quiet.

web/image_oasis.js line 2362 (python_network_operations): this one looks like a false positive. The flagged code is the node's onAdded lifecycle override, it just calls the original handler and registers the widget. There's no network operation at that line, and it's JavaScript being matched by a Python rule. The only network calls in that file are fetches to ComfyUI's own local /api routes, which is standard for any DOM widget node.

Let me know what I need to do to get Image Oasis 1.4.0 to populate the Custom Node Manager correctly. Thanks!

Originally created by @NikoDemon80 on GitHub (Jul 9, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3072 Hey, dev of comfyui-image-oasis here, following up on the flags for 1.4.0. Both are info level and I believe both are benign: requirements.txt line 28 (contains_custom_url_dependency): the URL is inside a comment block that's explicitly labeled "Non-pip dependency (NOT installable here)". It's just documentation pointing users at city96's ComfyUI-GGUF custom node, which is optional and only needed for the GGUF source type. Nothing in the file actually installs from a URL, pip never touches that line. Happy to reword the comment to drop the raw URL in the next release if that keeps the scanner quiet. web/image_oasis.js line 2362 (python_network_operations): this one looks like a false positive. The flagged code is the node's onAdded lifecycle override, it just calls the original handler and registers the widget. There's no network operation at that line, and it's JavaScript being matched by a Python rule. The only network calls in that file are fetches to ComfyUI's own local /api routes, which is standard for any DOM widget node. Let me know what I need to do to get Image Oasis 1.4.0 to populate the Custom Node Manager correctly. Thanks!

bsakaguchi commented

2026-10-27 21:25:46 +00:00

Author

Owner

@coderabbitai[bot] commented on GitHub (Jul 9, 2026):

🔗 Related PRs

Comfy-Org/ComfyUI-Manager#3006 - Fix NKD Preview Tools entry: repo renamed + dedupe [merged]
Comfy-Org/ComfyUI-Manager#3022 - Add ComfyUI-TJ_NODE_STUDIO_ONE to custom-node-list [merged]

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

@coderabbitai[bot] commented on GitHub (Jul 9, 2026):  <details> <summary>🔗 Related PRs</summary> Comfy-Org/ComfyUI-Manager#3006 - Fix NKD Preview Tools entry: repo renamed + dedupe [merged] Comfy-Org/ComfyUI-Manager#3022 - Add ComfyUI-TJ_NODE_STUDIO_ONE to custom-node-list [merged] </details> --- <details> <summary> 🧪 Issue enrichment is currently in open beta.</summary> You can configure auto-planning by selecting labels in the issue_enrichment configuration. To disable automatic issue enrichment, add the following to your `.coderabbit.yaml`: ```yaml issue_enrichment: auto_enrich: enabled: false ``` </details> 💬 Have feedback or questions? Drop into our [discord](https://discord.gg/coderabbit)!

bsakaguchi referenced this issue

2026-10-28 21:03:29 +00:00

[PR #1096] [MERGED] Add ComfyUI-Arrow-Key-Canvas-Navigation to custom-node-list.json #1706