[GH-ISSUE #3236] comfyui-vrm-pose-editor: 0.13.0+ flagged, latest_version stuck at 0.12.0 (manual review request) #1125

New issue

Open

opened 2026-10-27 21:25:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-27 21:25:59 +00:00

Owner

Originally created by @ketle-man on GitHub (Sep 3, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3236

Publisher: statsu
Node: comfyui-vrm-pose-editor
Repo: https://github.com/ketle-man/comfyui-vrm-pose-editor

Problem

Every version since 0.13.0 has been flagged by the Registry security scan, so latest_version is frozen at 0.12.0 (published 2026-08-08). ComfyUI-Manager therefore offers no update — explicit /install of a specific version still works, but the normal update path (and the "latest" shown in Manager/Registry) delivers nothing newer than 0.12.0.

That gap now covers three releases (0.13.0, 0.13.1, and today's 0.14.0) and roughly a month of bug fixes and new features (Light & Pose Editor unified modal, keyframe timeline with pose/camera/shape-key animation, WebM/GIF export, etc.).

Status from the public API

GET https://api.comfy.org/nodes/comfyui-vrm-pose-editor/versions

Version	Status	Published
0.14.0	🕓 Pending	2026-09-03
0.13.1	🚩 Flagged	2026-09-02
0.13.0	🚩 Flagged	2026-08-26
0.12.0	✅ Active (= current `latest_version`)	2026-08-08
0.11.0 and earlier	✅ Active	—

latest_version.version = 0.12.0, latest_version.status = NodeVersionStatusActive.

What changed at 0.13.0

0.13.0 added camera FOV/Near clip sliders — pure logic changes in js/pose_editor_3d.js / js/pose_editor_core.js, no new third-party dependency, no new network call, no new vendored library. I can't find anything in that diff that looks network-related.

I checked our own source (excluding the vendored Three.js/OrbitControls/GLTFLoader/three-vrm libraries under js/vendor/, which have been bundled unchanged since 0.1.x) for the pattern mentioned in #3059's later comments as a known false-positive source for python_network_operations:

$ grep -rn ".bind(|.connect(" --include=*.js js/ | grep -v js/vendor/
(no matches)

No .bind(/.connect( outside the vendored files. If the scanner also scans the vendor bundles (present unchanged since early Active releases), I don't understand why 0.12.0 and earlier passed but 0.13.0 onward did not.

There is also no eval/exec/os.system/pickle/__import__/compile() anywhere in the Python backend, and no subprocess usage at all.

Ask

Manual review and activation of the 0.13.0–0.14.0 line (or at minimum 0.14.0, once its scan finishes), so latest_version advances and users receive the backlog.
If there's a specific pattern/file the scanner is catching, I'd like to know so I can address it directly — the version-status endpoint doesn't expose a status_reason, so I have nothing to work from on my side.

This looks like the same class of issue as #3059, #3085, #3111, and #3215 — all resolved (or explained) via manual review.

Originally created by @ketle-man on GitHub (Sep 3, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3236 **Publisher:** `statsu` **Node:** `comfyui-vrm-pose-editor` **Repo:** https://github.com/ketle-man/comfyui-vrm-pose-editor ### Problem Every version since **0.13.0** has been flagged by the Registry security scan, so `latest_version` is frozen at **0.12.0** (published 2026-08-08). ComfyUI-Manager therefore offers no update — explicit `/install` of a specific version still works, but the normal update path (and the "latest" shown in Manager/Registry) delivers nothing newer than 0.12.0. That gap now covers three releases (0.13.0, 0.13.1, and today's 0.14.0) and roughly a month of bug fixes and new features (Light & Pose Editor unified modal, keyframe timeline with pose/camera/shape-key animation, WebM/GIF export, etc.). ### Status from the public API `GET https://api.comfy.org/nodes/comfyui-vrm-pose-editor/versions` | Version | Status | Published | |---|---|---| | 0.14.0 | 🕓 Pending | 2026-09-03 | | 0.13.1 | 🚩 Flagged | 2026-09-02 | | 0.13.0 | 🚩 Flagged | 2026-08-26 | | 0.12.0 | ✅ Active (= current `latest_version`) | 2026-08-08 | | 0.11.0 and earlier | ✅ Active | — | `latest_version.version` = **0.12.0**, `latest_version.status` = `NodeVersionStatusActive`. ### What changed at 0.13.0 0.13.0 added camera FOV/Near clip sliders — pure logic changes in `js/pose_editor_3d.js` / `js/pose_editor_core.js`, no new third-party dependency, no new network call, no new vendored library. I can't find anything in that diff that looks network-related. I checked our own source (excluding the vendored Three.js/OrbitControls/GLTFLoader/three-vrm libraries under `js/vendor/`, which have been bundled unchanged since 0.1.x) for the pattern mentioned in #3059's later comments as a known false-positive source for `python_network_operations`: $ grep -rn ".bind(|.connect(" --include=*.js js/ | grep -v js/vendor/ (no matches) No `.bind(`/`.connect(` outside the vendored files. If the scanner also scans the vendor bundles (present unchanged since early Active releases), I don't understand why 0.12.0 and earlier passed but 0.13.0 onward did not. There is also no `eval`/`exec`/`os.system`/`pickle`/`__import__`/`compile()` anywhere in the Python backend, and no `subprocess` usage at all. ### Ask 1. Manual review and activation of the 0.13.0–0.14.0 line (or at minimum 0.14.0, once its scan finishes), so `latest_version` advances and users receive the backlog. 2. If there's a specific pattern/file the scanner is catching, I'd like to know so I can address it directly — the version-status endpoint doesn't expose a `status_reason`, so I have nothing to work from on my side. This looks like the same class of issue as #3059, #3085, #3111, and #3215 — all resolved (or explained) via manual review.