[GH-ISSUE #3111] comfyui-easyuse-anima@0.6.2 flagged by four info-level Registry scan findings (manual review requested) #1101

New issue

Closed

opened 2026-10-27 21:25:46 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-27 21:25:46 +00:00

Owner

Originally created by @n0va39 on GitHub (Jul 28, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3111

Registry version

Publisher: n0va39
Node: comfyui-easyuse-anima
Version: 0.6.2
Version ID: aa3e23e8-918d-4802-92e5-f5307124942c
Current status: NodeVersionStatusFlagged
Published: 2026-07-28
Release: https://github.com/n0va39/ComfyUI-EasyUseAnima/releases/tag/v0.6.2
Artifact: https://cdn.comfy.org/n0va39/comfyui-easyuse-anima/0.6.2/node.zip

Problem

Version 0.6.2 is an urgent runtime hotfix for a frontend regression in 0.6.1, but the Registry scanner has flagged it on four info-severity YARA findings. The public node pointer therefore remains on 0.5.6, so Registry/Manager users cannot receive the fixed release as the latest version.

Could the Registry team manually review and activate 0.6.2, or identify any source change that is actually required?

Findings and context

easyuse_anima/aio/torch_compile_diagnostics.py:45
- Finding: python_bytecode_manipulation, matched $importlib_direct on importlib.import_module("torch").
- Context: this is a lazy optional import used only when the user requests read-only Torch/KJNodes environment diagnostics. It does not manipulate bytecode, evade imports, execute supplied code, or use eval/exec.
easyuse_anima/autocomplete/index.py:115
- Finding: python_database_connections on sqlite3.connect(...).
- Context: this opens a local on-disk autocomplete index with SQLite URI mode=ro and PRAGMA query_only = ON. The same module can build that local index through a temporary file before atomic replacement. There is no external database or remote connection.
easyuse_anima/autocomplete/index.py:115
- Finding: python_network_operations, matched the generic .connect( substring in sqlite3.connect(...).
- Context: this is the same local SQLite call, not a socket or network operation.
easyuse_anima/naia/client.py:95
- Finding: python_network_operations on requests.post(...).
- Context: this is the node's documented NAIA API integration. It defaults to localhost only (127.0.0.1, localhost, or ::1); non-local hosts are rejected unless the user explicitly enables allow_remote_api. Responses are parsed as JSON and never executed.

The Registry API also shows that earlier comfyui-easyuse-anima 0.1.x versions received the same NAIA requests.post information-level finding and were later made Active by an administrator batch review.

Release evidence

The release tag points to the reviewed hotfix commit: 444abf98d7739f2e3e2949325bc9b56c6ca9592a.
Repository full validation passed before publication: 1,241 Python tests, 120 frontend tests, TypeScript checks, Pyright baseline, package validation, and archive CRC verification.
The packaged 0.6.2 artifact was tested in an isolated ComfyUI 0.27.0 / frontend 1.45.20 instance. The affected LoRA Preset profile bar rendered, its menus opened, and the server log contained no related runtime errors.
Registry publish workflow: https://github.com/n0va39/ComfyUI-EasyUseAnima/actions/runs/30331286185
Metadata synchronization workflow: https://github.com/n0va39/ComfyUI-EasyUseAnima/actions/runs/30331365287

Version 0.6.2 has not been republished or mutated; the published artifact remains immutable. Thank you for reviewing it.

Originally created by @n0va39 on GitHub (Jul 28, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3111 ### Registry version - Publisher: `n0va39` - Node: `comfyui-easyuse-anima` - Version: `0.6.2` - Version ID: `aa3e23e8-918d-4802-92e5-f5307124942c` - Current status: `NodeVersionStatusFlagged` - Published: 2026-07-28 - Release: https://github.com/n0va39/ComfyUI-EasyUseAnima/releases/tag/v0.6.2 - Artifact: https://cdn.comfy.org/n0va39/comfyui-easyuse-anima/0.6.2/node.zip ### Problem Version 0.6.2 is an urgent runtime hotfix for a frontend regression in 0.6.1, but the Registry scanner has flagged it on four `info`-severity YARA findings. The public node pointer therefore remains on 0.5.6, so Registry/Manager users cannot receive the fixed release as the latest version. Could the Registry team manually review and activate 0.6.2, or identify any source change that is actually required? ### Findings and context 1. `easyuse_anima/aio/torch_compile_diagnostics.py:45` - Finding: `python_bytecode_manipulation`, matched `$importlib_direct` on `importlib.import_module("torch")`. - Context: this is a lazy optional import used only when the user requests read-only Torch/KJNodes environment diagnostics. It does not manipulate bytecode, evade imports, execute supplied code, or use `eval`/`exec`. 2. `easyuse_anima/autocomplete/index.py:115` - Finding: `python_database_connections` on `sqlite3.connect(...)`. - Context: this opens a local on-disk autocomplete index with SQLite URI `mode=ro` and `PRAGMA query_only = ON`. The same module can build that local index through a temporary file before atomic replacement. There is no external database or remote connection. 3. `easyuse_anima/autocomplete/index.py:115` - Finding: `python_network_operations`, matched the generic `.connect(` substring in `sqlite3.connect(...)`. - Context: this is the same local SQLite call, not a socket or network operation. 4. `easyuse_anima/naia/client.py:95` - Finding: `python_network_operations` on `requests.post(...)`. - Context: this is the node's documented NAIA API integration. It defaults to localhost only (`127.0.0.1`, `localhost`, or `::1`); non-local hosts are rejected unless the user explicitly enables `allow_remote_api`. Responses are parsed as JSON and never executed. The Registry API also shows that earlier `comfyui-easyuse-anima` 0.1.x versions received the same NAIA `requests.post` information-level finding and were later made Active by an administrator batch review. ### Release evidence - The release tag points to the reviewed hotfix commit: `444abf98d7739f2e3e2949325bc9b56c6ca9592a`. - Repository full validation passed before publication: 1,241 Python tests, 120 frontend tests, TypeScript checks, Pyright baseline, package validation, and archive CRC verification. - The packaged 0.6.2 artifact was tested in an isolated ComfyUI 0.27.0 / frontend 1.45.20 instance. The affected LoRA Preset profile bar rendered, its menus opened, and the server log contained no related runtime errors. - Registry publish workflow: https://github.com/n0va39/ComfyUI-EasyUseAnima/actions/runs/30331286185 - Metadata synchronization workflow: https://github.com/n0va39/ComfyUI-EasyUseAnima/actions/runs/30331365287 Version 0.6.2 has not been republished or mutated; the published artifact remains immutable. Thank you for reviewing it.

bsakaguchi closed this issue

2026-10-27 21:25:46 +00:00

bsakaguchi commented

2026-10-27 21:25:47 +00:00

Author

Owner

@coderabbitai[bot] commented on GitHub (Jul 28, 2026):

🔗 Related PRs

Comfy-Org/ComfyUI-Manager#2918 - Fix: Addressed issues for ComfyUI-ACES-EXR-Toolkit [open]
Comfy-Org/ComfyUI-Manager#2924 - Add ComfyUI-TJ_NODE to custom-node-list [merged]
Comfy-Org/ComfyUI-Manager#3087 - Update VULCA ComfyUI repository URL [merged]

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

@coderabbitai[bot] commented on GitHub (Jul 28, 2026):  <details> <summary>🔗 Related PRs</summary> Comfy-Org/ComfyUI-Manager#2918 - Fix: Addressed issues for ComfyUI-ACES-EXR-Toolkit [open] Comfy-Org/ComfyUI-Manager#2924 - Add ComfyUI-TJ_NODE to custom-node-list [merged] Comfy-Org/ComfyUI-Manager#3087 - Update VULCA ComfyUI repository URL [merged] </details> --- <details> <summary> 🧪 Issue enrichment is currently in open beta.</summary> You can configure auto-planning by selecting labels in the issue_enrichment configuration. To disable automatic issue enrichment, add the following to your `.coderabbit.yaml`: ```yaml issue_enrichment: auto_enrich: enabled: false ``` </details> 💬 Have feedback or questions? Drop into our [discord](https://discord.gg/coderabbit)!

bsakaguchi commented

2026-10-27 21:25:47 +00:00

Author

Owner

@n0va39 commented on GitHub (Jul 30, 2026):

The official Registry API now reports comfyui-easyuse-anima 0.6.2 as NodeVersionStatusActive with the expected changelog and CDN download URL. Thank you; the requested review is no longer blocking the release.

@n0va39 commented on GitHub (Jul 30, 2026): The official Registry API now reports comfyui-easyuse-anima 0.6.2 as NodeVersionStatusActive with the expected changelog and CDN download URL. Thank you; the requested review is no longer blocking the release.

bsakaguchi referenced this issue

2026-10-28 21:03:32 +00:00

[PR #1101] [MERGED] Add ez-af #1710