[PR #2954] [CLOSED] Add ComfyUI-GU_Nodepack #2903

New issue

Closed

opened 2026-10-28 21:13:34 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-28 21:13:34 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/ComfyUI-Manager/pull/2954
Author: @alexguryev
Created: 6/5/2026
Status: ❌ Closed

Base: main ← Head: add-comfyui-gu-nodepack

📝 Commits (1)

4def63f Add ComfyUI-GU_Nodepack

📊 Changes

1 file changed (+11 additions, -0 deletions)

View changed files

📝 custom-node-list.json (+11 -0)

📄 Description

Re-submission of #2815, closed for security review. Security rationale is documented
in the README (added in
d91cc62)
and summarized below.

About the pack

27+ utility nodes for ComfyUI covering:

LoRA management (stack, randomizer, motion LoRA, trigger-words filter)
Image annotation (label overlay with configurable font/position)
Project organization (project paths, naming conventions, file helpers)
Sampling utilities (indexed sampler/scheduler pickers, resolution presets, sides pack/unpack)
System integration (timer, save-image-info, get-node-active, switch-any-by-index)

Security rationale

The previous PR was closed because automated scanning flagged aiohttp.web import in
prestartup_script.py. Here is the full rationale (also in README → Security Notes):

prestartup_script.py imports aiohttp.web — used solely to monkey-patch
WebSocketResponse.prepare to hook the moment a browser tab connects to ComfyUI.
The hook refreshes the LoRA file list and resets the seed-file flag.
No custom HTTP routes or endpoints are registered.

The patch is applied defensively: checks the method signature before installing,
wraps the original in try/except, falls back gracefully if the aiohttp API changes.

Other patterns confirmed absent:

No subprocess or exec() calls
No pickle usage
JS fetch() calls only load the nodepack's own static .txt config files — standard ComfyUI extension pattern

Metadata

Repository: https://github.com/alexguryev/ComfyUI-GU_Nodepack
License: MIT
Python: >=3.10
Version: v2.6.0 (tagged)
pyproject.toml with [tool.comfy], registered on registry.comfy.org (publisher alexguryev)

Verification

JSON validated with python -m json.tool after edit.
No existing entries reordered.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/ComfyUI-Manager/pull/2954 **Author:** [@alexguryev](https://github.com/alexguryev) **Created:** 6/5/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `add-comfyui-gu-nodepack` --- ### 📝 Commits (1) - [`4def63f`](https://github.com/Comfy-Org/ComfyUI-Manager/commit/4def63f4a6f7324e1d519f86cea8247c4a94d8d4) Add ComfyUI-GU_Nodepack ### 📊 Changes **1 file changed** (+11 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `custom-node-list.json` (+11 -0) </details> ### 📄 Description Register [ComfyUI-GU_Nodepack](https://github.com/alexguryev/ComfyUI-GU_Nodepack) in `custom-node-list.json`. > Re-submission of #2815, closed for security review. Security rationale is documented > in the README (added in > [d91cc62](https://github.com/alexguryev/ComfyUI-GU_Nodepack/commit/d91cc62)) > and summarized below. ## About the pack 27+ utility nodes for ComfyUI covering: - LoRA management (stack, randomizer, motion LoRA, trigger-words filter) - Image annotation (label overlay with configurable font/position) - Project organization (project paths, naming conventions, file helpers) - Sampling utilities (indexed sampler/scheduler pickers, resolution presets, sides pack/unpack) - System integration (timer, save-image-info, get-node-active, switch-any-by-index) ## Security rationale The previous PR was closed because automated scanning flagged `aiohttp.web` import in `prestartup_script.py`. Here is the full rationale (also in README → Security Notes): **`prestartup_script.py` imports `aiohttp.web`** — used solely to monkey-patch `WebSocketResponse.prepare` to hook the moment a browser tab connects to ComfyUI. The hook refreshes the LoRA file list and resets the seed-file flag. **No custom HTTP routes or endpoints are registered.** The patch is applied defensively: checks the method signature before installing, wraps the original in try/except, falls back gracefully if the aiohttp API changes. Other patterns confirmed absent: - No `subprocess` or `exec()` calls - No `pickle` usage - JS `fetch()` calls only load the nodepack's own static `.txt` config files — standard ComfyUI extension pattern ## Metadata - Repository: https://github.com/alexguryev/ComfyUI-GU_Nodepack - License: MIT - Python: >=3.10 - Version: v2.6.0 (tagged) - `pyproject.toml` with `[tool.comfy]`, registered on registry.comfy.org (publisher `alexguryev`) ## Verification - JSON validated with `python -m json.tool` after edit. - No existing entries reordered. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-28 21:13:34 +00:00