[GH-ISSUE #3237] Latest version stuck at v1.5.3 because newer versions (v2.0.0) have "Flagged" status in Registry API #1126

New issue

Closed

opened 2026-10-27 21:26:00 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-27 21:26:00 +00:00

Owner

Originally created by @DemonAlone on GitHub (Sep 3, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3237

Describe the bug
ComfyUI Manager shows v1.5.3 as the latest version for DemonAlone-JS_Addon-ComfyUI, although v2.0.0 and v1.9.8 are published and available via CDN. The issue is that the Registry API's latest_version points to v1.5.3 because newer versions have status: "NodeVersionStatusFlagged" instead of "Active".

API evidence
I queried the versions endpoint and got:

v2.0.0: status: "NodeVersionStatusFlagged", deprecated: false
v1.9.8: status: "NodeVersionStatusFlagged", deprecated: false
v1.5.3 (current latest): status: "NodeVersionStatusActive", deprecated: true

The latest_version field in the main node endpoint returns v1.5.3, because it's the most recent version with Active status.

Expected behavior
v2.0.0 should be the latest version, as it's the newest non-deprecated release.

Actual behavior
The Manager shows v1.5.3, and users cannot see that v2.0.0 is available unless they manually check the version history.

Possible cause
This resembles issue #3059, where a security-scan falsely flagged newer versions, preventing them from becoming Active. I suspect the same happened here — my newer versions were automatically flagged and need manual review to be set to Active.

Request
Could a moderator please review the Flagged status for versions v2.0.0 and v1.9.8 of DemonAlone-JS_Addon-ComfyUI and set them to Active if they are safe? Alternatively, please let me know if there is anything I need to fix in my package to pass the security scan.

Environment

ComfyUI Manager version: [v3.41]
ComfyUI version: [0.34.0]

Originally created by @DemonAlone on GitHub (Sep 3, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3237 **Describe the bug** ComfyUI Manager shows `v1.5.3` as the latest version for `DemonAlone-JS_Addon-ComfyUI`, although `v2.0.0` and `v1.9.8` are published and available via CDN. The issue is that the Registry API's `latest_version` points to `v1.5.3` because newer versions have `status: "NodeVersionStatusFlagged"` instead of `"Active"`. **API evidence** I queried the versions endpoint and got: - `v2.0.0`: `status: "NodeVersionStatusFlagged"`, `deprecated: false` - `v1.9.8`: `status: "NodeVersionStatusFlagged"`, `deprecated: false` - `v1.5.3` (current latest): `status: "NodeVersionStatusActive"`, `deprecated: true` The `latest_version` field in the main node endpoint returns `v1.5.3`, because it's the most recent version with `Active` status. **Expected behavior** `v2.0.0` should be the latest version, as it's the newest non-deprecated release. **Actual behavior** The Manager shows `v1.5.3`, and users cannot see that `v2.0.0` is available unless they manually check the version history. **Possible cause** This resembles issue #3059, where a security-scan falsely flagged newer versions, preventing them from becoming `Active`. I suspect the same happened here — my newer versions were automatically flagged and need manual review to be set to `Active`. **Request** Could a moderator please review the `Flagged` status for versions `v2.0.0` and `v1.9.8` of `DemonAlone-JS_Addon-ComfyUI` and set them to `Active` if they are safe? Alternatively, please let me know if there is anything I need to fix in my package to pass the security scan. **Environment** - ComfyUI Manager version: [v3.41] - ComfyUI version: [0.34.0]

bsakaguchi closed this issue

2026-10-27 21:26:01 +00:00

bsakaguchi commented

2026-10-27 21:26:01 +00:00

Author

Owner

@seeker-ktf commented on GitHub (Sep 3, 2026):

I'm pretty sure this is a function of the "bug" I reported in # 3220. There seems to be a lot of people reporting about the same problem.

Edit to say you could try my fix and see if the update button shows up for you as well. It might add more credibility to all of us in the same boat.

@seeker-ktf commented on GitHub (Sep 3, 2026): I'm pretty sure this is a function of the "bug" I reported in # [3220](https://github.com/Comfy-Org/ComfyUI-Manager/issues/3220). There seems to be a lot of people reporting about the same problem. Edit to say you could try my fix and see if the update button shows up for you as well. It might add more credibility to all of us in the same boat.

bsakaguchi commented

2026-10-27 21:26:01 +00:00

Author

Owner

@DemonAlone commented on GitHub (Sep 3, 2026):

@seeker-ktf , My issue doesn’t resemble yours at all. The fact that the update button (along with last-update date and star count) isn’t displayed unless you’re registered in custom-node-list.json is normal behavior. Registration via workflow is incomplete. My problem isn’t about the presence of the update button, but rather that versions starting from 1.5.3 never appear in the ComfyUI Manager altogether.

@DemonAlone commented on GitHub (Sep 3, 2026): @seeker-ktf , My issue doesn’t resemble yours at all. The fact that the update button (along with last-update date and star count) isn’t displayed unless you’re registered in custom-node-list.json is normal behavior. Registration via workflow is incomplete. My problem isn’t about the presence of the update button, but rather that versions starting from 1.5.3 never appear in the ComfyUI Manager altogether.

bsakaguchi commented

2026-10-27 21:26:02 +00:00

Author

Owner

@DemonAlone commented on GitHub (Sep 4, 2026):

Subject: Fixed in v2.0.1

I've released v2.0.1 with a fix for the only real security issue (path traversal in JavaScript). The Python part already used a combobox list and did not allow arbitrary input.
All other findings from the scanner (network calls to localhost, high-entropy strings) are false positives:
The network request goes only to 127.0.0.1 to check the local job queue.
The flagged strings are plain descriptions and tooltips.
I've also added sanitization in play_sound.js to block .., absolute paths, and Windows drive letters.
The new version is now available in the registry. Closing this issue.

@DemonAlone commented on GitHub (Sep 4, 2026): Subject: Fixed in v2.0.1 I've released v2.0.1 with a fix for the only real security issue (path traversal in JavaScript). The Python part already used a combobox list and did not allow arbitrary input. All other findings from the scanner (network calls to localhost, high-entropy strings) are false positives: The network request goes only to 127.0.0.1 to check the local job queue. The flagged strings are plain descriptions and tooltips. I've also added sanitization in play_sound.js to block .., absolute paths, and Windows drive letters. The new version is now available in the registry. Closing this issue.