[GH-ISSUE #1308] Security update popup? #543

New issue

Open

opened 2026-10-27 21:18:47 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-27 21:18:47 +00:00

Owner

Originally created by @Lex-DRL on GitHub (Dec 7, 2024).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/1308

Today, I've noticed a changelog message for ComfyUI v0.3.7 warning users about ultralytics 8.3.41-8.3.42 vulnerability. I was lucky to: 1) going to Comfy, 2) deciding to update and 3) deciding to read the changelog at the very exact time this was there. But it could be easily missed, especially if you don't use ComfyUI every day and therefore can jump over entire versions between updates.

Maybe, ComfyUI and Manager need to figure out a way to communicate security-related or any other critical changelog messages and Manager should show them in a special "warning" popup, which is much harder to miss?

Probably, this in-page notifier needs to scan over ALL the messages which appeared since the last update (anything after the local commit the user's install is at).

Originally created by @Lex-DRL on GitHub (Dec 7, 2024). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/1308 Today, I've noticed a changelog message for ComfyUI v0.3.7 warning users about ultralytics 8.3.41-8.3.42 vulnerability. I was lucky to: 1) going to Comfy, 2) deciding to update and 3) deciding to read the changelog at the very exact time this was there. But it could be easily missed, especially if you don't use ComfyUI every day and therefore can jump over entire versions between updates. Maybe, ComfyUI and Manager need to figure out a way to communicate security-related or any other critical changelog messages and Manager should show them in a special "warning" popup, which is much harder to miss? Probably, this in-page notifier needs to scan over ALL the messages which appeared since the last update (anything after the local commit the user's install is at).

bsakaguchi added the

feature request

label

2026-10-27 21:18:47 +00:00

bsakaguchi commented

2026-10-27 21:18:48 +00:00

Author

Owner

@Lex-DRL commented on GitHub (Dec 7, 2024):

To avoid any ambiguity, this is what I'm talking about:

@Lex-DRL commented on GitHub (Dec 7, 2024): To avoid any ambiguity, this is what I'm talking about: ![screenshot](https://github.com/user-attachments/assets/bc6fe9a2-775e-4475-bea6-9be196237032)

bsakaguchi commented

2026-10-27 21:18:48 +00:00

Author

Owner

@ltdrdata commented on GitHub (Dec 8, 2024):

I’m already considering such a method.

@ltdrdata commented on GitHub (Dec 8, 2024): I’m already considering such a method.

bsakaguchi referenced this issue

2026-10-27 21:30:55 +00:00

[PR #543] [MERGED] Update custom-node-list.json #1396