[PR #2823] [MERGED] chore(release): 4.2.1 — register extension.manager.supports_csrf_post feature flag #2805

New issue

Closed

opened 2026-10-28 21:12:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-28 21:12:48 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/ComfyUI-Manager/pull/2823
Author: @ltdrdata
Created: 4/22/2026
Status: ✅ Merged
Merged: 4/22/2026
Merged by: @ltdrdata

Base: manager-v4 ← Head: fix/csrf-post-feature-flag

📝 Commits (1)

81935bd chore(release): 4.2.1 — register extension.manager.supports_csrf_post feature flag

📊 Changes

3 files changed (+32 additions, -6 deletions)

View changed files

📝 CHANGELOG.md (+11 -5)
📝 comfyui_manager/__init__.py (+20 -0)
📝 pyproject.toml (+1 -1)

📄 Description

Summary

Follow-up to #2818. Registers a server-push feature flag so clients can detect CSRF-POST backend capability via ComfyUI core's feature_flags mechanism instead of parsing version strings.

Flag: extension.manager.supports_csrf_post = True, registered at Manager import time in comfyui_manager/__init__.py via comfy_api.feature_flags.SERVER_FEATURE_FLAGS.
Manager versions prior to 4.2.1 do not set the flag. Clients (ComfyUI_frontend, third-party extensions) observe its absence and should treat the backend as incompatible with POST-only state-mutation endpoints, prompting the user to upgrade.
ImportError on older ComfyUI cores without comfy_api.feature_flags is swallowed silently — Manager continues to function, clients simply do not observe the flag.
No endpoint or security behavior change. Pure capability advertisement.

Version bump

pyproject.toml: 4.2.0 → 4.2.1 (SSOT; importlib.metadata.version("comfyui-manager") reads from here)
CHANGELOG.md: new ## [4.2.1] - 2026-04-22 entry

Test plan

Verify flag is registered at import time: python -c "from comfy_api import feature_flags; import comfyui_manager; print(feature_flags.SERVER_FEATURE_FLAGS['extension']['manager']['supports_csrf_post'])" -> True
Verify graceful fallback on older ComfyUI core without comfy_api.feature_flags (Manager still imports, no exception propagated).
Verify frontend can observe the flag via existing feature_flags WebSocket/HTTP channel.
Confirm no behavior change on any state-mutation POST handler.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/ComfyUI-Manager/pull/2823 **Author:** [@ltdrdata](https://github.com/ltdrdata) **Created:** 4/22/2026 **Status:** ✅ Merged **Merged:** 4/22/2026 **Merged by:** [@ltdrdata](https://github.com/ltdrdata) **Base:** `manager-v4` ← **Head:** `fix/csrf-post-feature-flag` --- ### 📝 Commits (1) - [`81935bd`](https://github.com/Comfy-Org/ComfyUI-Manager/commit/81935bd66e31df3f23244a4290808dbeea036c68) chore(release): 4.2.1 — register extension.manager.supports_csrf_post feature flag ### 📊 Changes **3 files changed** (+32 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+11 -5) 📝 `comfyui_manager/__init__.py` (+20 -0) 📝 `pyproject.toml` (+1 -1) </details> ### 📄 Description ## Summary Follow-up to #2818. Registers a server-push feature flag so clients can detect CSRF-POST backend capability via ComfyUI core's `feature_flags` mechanism instead of parsing version strings. - Flag: `extension.manager.supports_csrf_post = True`, registered at Manager import time in `comfyui_manager/__init__.py` via `comfy_api.feature_flags.SERVER_FEATURE_FLAGS`. - Manager versions prior to 4.2.1 do not set the flag. Clients (ComfyUI_frontend, third-party extensions) observe its absence and should treat the backend as incompatible with POST-only state-mutation endpoints, prompting the user to upgrade. - `ImportError` on older ComfyUI cores without `comfy_api.feature_flags` is swallowed silently — Manager continues to function, clients simply do not observe the flag. - No endpoint or security behavior change. Pure capability advertisement. ## Version bump - `pyproject.toml`: 4.2.0 → **4.2.1** (SSOT; `importlib.metadata.version("comfyui-manager")` reads from here) - `CHANGELOG.md`: new `## [4.2.1] - 2026-04-22` entry ## Test plan - [ ] Verify flag is registered at import time: `python -c "from comfy_api import feature_flags; import comfyui_manager; print(feature_flags.SERVER_FEATURE_FLAGS['extension']['manager']['supports_csrf_post'])"` -> True - [ ] Verify graceful fallback on older ComfyUI core without `comfy_api.feature_flags` (Manager still imports, no exception propagated). - [ ] Verify frontend can observe the flag via existing feature_flags WebSocket/HTTP channel. - [ ] Confirm no behavior change on any state-mutation POST handler. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-28 21:12:48 +00:00