[GH-ISSUE #3243] Manual review request: aun-comfyui-nodes versions 2.23.0–2.29.1 Flagged/Banned, Manager stuck at 2.22.0 #1127

New issue

Open

opened 2026-10-27 21:26:00 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-27 21:26:00 +00:00

Owner

Originally created by @loz2754 on GitHub (Sep 5, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3243

Publisher loz2754, node aun-comfyui-nodes (https://github.com/loz2754/AUN-ComfyUI-Nodes, https://registry.comfy.org/nodes/aun-comfyui-nodes).

Every version since 2.23.0 has been auto-moderated and ComfyUI Manager is pinned at 2.22.0 (latest Active). Uploads all succeed; versions then move to:

Banned: 2.23.0 (1bbcb160-…), 2.24.0 (9b8cd69f-…), 2.25.0 (9c994617-…), 2.25.1 (f845fa3e-…), 2.26.0 (40667029-…)
Flagged: 2.27.0 (4fc9eb7f-…), 2.28.0 (d7951057-…), 2.29.0 (19d4f7b1-…)
Pending (fresh today, please include in review): 2.29.1 (2a5fd034-…)

I believe these are false positives. Potentially flagged patterns and why they're benign:

subprocess calls are ffmpeg video assembly only (AUNSaveVideo.py, AUNJoinVideos.py), list-form args, no shell — identical code shipped in Active versions ≤2.22.0.
fetch() is same-origin only (/aun/loras); no external network calls; innerHTML uses are escaped or static UI; localStorage/clipboard are UI state.
PromptServer.send_sync graph messages are local ComfyUI events, unchanged since Active versions.
The one scanner warning I could see (E702 semicolon, AUNExtractPowerLoras.py:116) is fixed in 2.29.1.

Request: manual review of 2.29.1 and clearance to Active (older Banned versions can stay as-is). Happy to change any specific pattern you point at.

Originally created by @loz2754 on GitHub (Sep 5, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3243 Publisher loz2754, node aun-comfyui-nodes (https://github.com/loz2754/AUN-ComfyUI-Nodes, https://registry.comfy.org/nodes/aun-comfyui-nodes). Every version since 2.23.0 has been auto-moderated and ComfyUI Manager is pinned at 2.22.0 (latest Active). Uploads all succeed; versions then move to: - Banned: 2.23.0 (1bbcb160-…), 2.24.0 (9b8cd69f-…), 2.25.0 (9c994617-…), 2.25.1 (f845fa3e-…), 2.26.0 (40667029-…) - Flagged: 2.27.0 (4fc9eb7f-…), 2.28.0 (d7951057-…), 2.29.0 (19d4f7b1-…) - Pending (fresh today, please include in review): 2.29.1 (2a5fd034-…) I believe these are false positives. Potentially flagged patterns and why they're benign: - subprocess calls are ffmpeg video assembly only (AUNSaveVideo.py, AUNJoinVideos.py), list-form args, no shell — identical code shipped in Active versions ≤2.22.0. - fetch() is same-origin only (/aun/loras); no external network calls; innerHTML uses are escaped or static UI; localStorage/clipboard are UI state. - PromptServer.send_sync graph messages are local ComfyUI events, unchanged since Active versions. - The one scanner warning I could see (E702 semicolon, AUNExtractPowerLoras.py:116) is fixed in 2.29.1. Request: manual review of 2.29.1 and clearance to Active (older Banned versions can stay as-is). Happy to change any specific pattern you point at.

bsakaguchi commented

2026-10-27 21:26:01 +00:00

Author

Owner

@loz2754 commented on GitHub (Oct 1, 2026):

Hi. I would be most grateful if someone could bump this along for me, as my node pack is still stuck at v2.22, and I have no idea what the specific issues are so as to be able to fix them. Thanks in advance for your kind consideration. loz2754.

@loz2754 commented on GitHub (Oct 1, 2026): Hi. I would be most grateful if someone could bump this along for me, as my node pack is still stuck at v2.22, and I have no idea what the specific issues are so as to be able to fix them. Thanks in advance for your kind consideration. loz2754.