[GH-ISSUE #3282] Request manual review: bonfire@0.1.0 stuck NodeVersionStatusFlagged (clean archive) #1133

New issue

Open

opened 2026-10-27 21:26:04 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-27 21:26:04 +00:00

Owner

Originally created by @DaemonSK on GitHub (Sep 14, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3282

Description

Custom Node Testing

I have tried disabling custom nodes and the issue persists (see how to disable custom nodes if you need help)

Your question

Requesting a manual review of bonfire version 0.1.0, which has been NodeVersionStatusFlagged since publish on 2026-09-14.

This is a first publish for publisher @bonfire. The node pack itself is NodeStatusActive, but there is no Active version, so Manager / registry search cannot surface an installable latest.

API status

Node: https://api.comfy.org/nodes/bonfire (NodeStatusActive)
Version: https://api.comfy.org/nodes/bonfire/versions — 0.1.0 is NodeVersionStatusFlagged
Active/Pending versions: none (GET .../versions?statuses=NodeVersionStatusActive&statuses=NodeVersionStatusPending returns [])
Version ID: 989af62d-7436-49f2-b8d2-fbc25d5cb21a
Repository: https://github.com/DaemonSK/ComfyUI-Bonfire
Publisher: bonfire

What we already checked

The published zip (26 files, runtime only; tests/docs/CI/CLAUDE.md excluded via .comfyignore) contains no:

eval / exec
subprocess / os.system
pickle / __import__
runtime pip install
network calls from the node pack

comfy node publish reported All validation checks passed successfully before the registry marked the version flagged.

If a specific scanner pattern triggered this, I would like to know so later versions do not stay hidden from Manager.

Please re-review and, if it passes, clear the flag so latest_version is 0.1.0.

Originally created by @DaemonSK on GitHub (Sep 14, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3282 ## Description ### Custom Node Testing - [x] I have tried disabling custom nodes and the issue persists (see [how to disable custom nodes](https://github.com/ltdrdata/ComfyUI-Manager#how-to-disable-nodes) if you need help) ### Your question Requesting a manual review of **bonfire** version **0.1.0**, which has been `NodeVersionStatusFlagged` since publish on 2026-09-14. This is a first publish for publisher `@bonfire`. The node pack itself is `NodeStatusActive`, but there is **no Active version**, so Manager / registry search cannot surface an installable latest. ### API status - Node: https://api.comfy.org/nodes/bonfire (`NodeStatusActive`) - Version: https://api.comfy.org/nodes/bonfire/versions — `0.1.0` is `NodeVersionStatusFlagged` - Active/Pending versions: **none** (`GET .../versions?statuses=NodeVersionStatusActive&statuses=NodeVersionStatusPending` returns `[]`) - Version ID: `989af62d-7436-49f2-b8d2-fbc25d5cb21a` - Repository: https://github.com/DaemonSK/ComfyUI-Bonfire - Publisher: `bonfire` ### What we already checked The published zip (26 files, runtime only; tests/docs/CI/CLAUDE.md excluded via `.comfyignore`) contains no: - `eval` / `exec` - `subprocess` / `os.system` - `pickle` / `__import__` - runtime `pip install` - network calls from the node pack `comfy node publish` reported `All validation checks passed successfully` before the registry marked the version flagged. If a specific scanner pattern triggered this, I would like to know so later versions do not stay hidden from Manager. Please re-review and, if it passes, clear the flag so `latest_version` is `0.1.0`.

bsakaguchi commented

2026-10-27 21:26:05 +00:00

Author

Owner

@DaemonSK commented on GitHub (Sep 14, 2026):

Follow-up: published 0.1.1 from a cleaned tree.

Removed from the public repo and from git history: agent notes (CLAUDE.md) and the live-install research docs (docs/COMPATIBILITY.md, docs/comfyui-research.md) that recorded Windows /system_stats probes.

The 0.1.1 archive is runtime only (29 files: source, js/, assets/, README, LICENSE, pyproject). No tests, docs, CI, or agent files. Version ID 8f4b9117-dc3a-4e4d-9200-aa0db36d333a, currently NodeVersionStatusPending.

Please review 0.1.1 rather than 0.1.0.

@DaemonSK commented on GitHub (Sep 14, 2026): Follow-up: published **0.1.1** from a cleaned tree. Removed from the public repo and from git history: agent notes (`CLAUDE.md`) and the live-install research docs (`docs/COMPATIBILITY.md`, `docs/comfyui-research.md`) that recorded Windows `/system_stats` probes. The 0.1.1 archive is runtime only (29 files: source, `js/`, `assets/`, README, LICENSE, pyproject). No tests, docs, CI, or agent files. Version ID `8f4b9117-dc3a-4e4d-9200-aa0db36d333a`, currently `NodeVersionStatusPending`. Please review 0.1.1 rather than 0.1.0.

bsakaguchi commented

2026-10-27 21:26:05 +00:00

Author

Owner

@DaemonSK commented on GitHub (Sep 14, 2026):

The flag on 0.1.0/0.1.1 was a YARA false positive: rule socket4 matched .bind( in js/bonfire.js (JavaScript Function.prototype.bind to open ComfyUI's Mask Editor), not a network socket.

0.1.2 removes that call. command.execute(...) is invoked on the command object instead. Please scan 0.1.2.

@DaemonSK commented on GitHub (Sep 14, 2026): The flag on 0.1.0/0.1.1 was a YARA false positive: rule socket4 matched `.bind(` in `js/bonfire.js` (JavaScript Function.prototype.bind to open ComfyUI's Mask Editor), not a network socket. **0.1.2** removes that call. `command.execute(...)` is invoked on the command object instead. Please scan 0.1.2.