Publisher: erpk · Repository: https://github.com/eRepublik-Labs/comfyui-nodes-erpk · Registry: https://registry.comfy.org/nodes/comfyui-nodes-erpk
Summary
Every version we have published since 2026-08-04 is NodeVersionStatusFlagged — three in a row. The registry therefore still serves 2026.7.2 (published 2026-07-10) as latest, so ComfyUI Manager users are a month behind and cannot install anything newer. One of the blocked releases is a security dependency bump (Pillow 12.3.0, cryptography 50.0.0, pyasn1 0.6.4, idna 3.18), so the flag is holding back a fix rather than just features.
Same symptom as #180 and Comfy-Org/registry-web#265.
Affected versions
| Version |
Status |
Version ID |
Published |
| 2026.8.3 |
Flagged |
8a879978-0db2-4fac-b077-edcbb7715db1 |
2026-08-10 |
| 2026.8.2 |
Flagged |
f8625dfe-f32b-4ab1-b2cf-b80ca532d7a4 |
2026-08-04 |
| 2026.8.1 |
Flagged |
afa7f548-a225-465d-97f6-24ca3b59aa26 |
2026-08-04 |
| 2026.7.2 |
Active — currently served |
— |
2026-07-10 |
API confirmation:
GET https://api.comfy.org/nodes/comfyui-nodes-erpk
latest_version.version = 2026.7.2
latest_version.status = NodeVersionStatusActive
2026.8.3 sat in Pending for over an hour after upload before resolving to Flagged, in case the scan duration is a useful signal.
Attestation against the documented standards
Verified across the whole package at 2026.8.3, against https://docs.comfy.org/registry/standards:
- No
eval / exec — zero occurrences in any Python file.
- No
subprocess, os.system, os.popen, pickle.loads, __import__ — zero occurrences. The three pip install strings in the tree are text inside ImportError messages, not executed calls.
- No runtime package installation. Dependencies are declared in
pyproject.toml and left to ComfyUI Manager.
- No obfuscation. Every file is readable source. The
web/ frontend is plain unbundled ES modules — no file in web/ contains a line longer than 500 characters.
- Outbound network calls go to documented vendor APIs only: Anthropic, Google, OpenAI and xAI via their official SDKs, and
api.wavespeed.ai directly. utils/safe_fetch.py implements an SSRF guard that resolves and rejects private, loopback, link-local and reserved ranges before any user-supplied URL is fetched.
bandit over the package reports 0 High findings. The 6 standing Medium findings are all B615 (HuggingFace from_pretrained without revision pinning) in an optional local-vision module, and predate the last Active version.
What changed between the last Active version and the first Flagged one
v2026.7.2..v2026.8.1 is 41 files, 897 insertions, 94 deletions — almost entirely model-ID and pricing data for the vendor APIs this pack wraps, plus one new node and its help page. Zero dependency lines changed in pyproject.toml. No new network primitives, no new process or filesystem access, no new imports beyond the already-declared SDKs.
The two modules most likely to draw a scanner's attention, utils/scan_engine.py and utils/safe_fetch.py, both predate 2026.7.2, which scanned Active. So neither can be what changed.
I have been unable to identify a trigger, which matches the content-independence that #180 demonstrates with a controlled experiment.
Request
- Re-review and approve
2026.8.1, 2026.8.2 and 2026.8.3.
- If a specific pattern did trigger the flag, please share it — I would much rather fix the cause than open a review request every release.
Publisher:
erpk· Repository: https://github.com/eRepublik-Labs/comfyui-nodes-erpk · Registry: https://registry.comfy.org/nodes/comfyui-nodes-erpkSummary
Every version we have published since 2026-08-04 is
NodeVersionStatusFlagged— three in a row. The registry therefore still serves2026.7.2(published 2026-07-10) as latest, so ComfyUI Manager users are a month behind and cannot install anything newer. One of the blocked releases is a security dependency bump (Pillow 12.3.0, cryptography 50.0.0, pyasn1 0.6.4, idna 3.18), so the flag is holding back a fix rather than just features.Same symptom as #180 and Comfy-Org/registry-web#265.
Affected versions
8a879978-0db2-4fac-b077-edcbb7715db1f8625dfe-f32b-4ab1-b2cf-b80ca532d7a4afa7f548-a225-465d-97f6-24ca3b59aa26API confirmation:
2026.8.3 sat in
Pendingfor over an hour after upload before resolving toFlagged, in case the scan duration is a useful signal.Attestation against the documented standards
Verified across the whole package at 2026.8.3, against https://docs.comfy.org/registry/standards:
eval/exec— zero occurrences in any Python file.subprocess,os.system,os.popen,pickle.loads,__import__— zero occurrences. The threepip installstrings in the tree are text insideImportErrormessages, not executed calls.pyproject.tomland left to ComfyUI Manager.web/frontend is plain unbundled ES modules — no file inweb/contains a line longer than 500 characters.api.wavespeed.aidirectly.utils/safe_fetch.pyimplements an SSRF guard that resolves and rejects private, loopback, link-local and reserved ranges before any user-supplied URL is fetched.banditover the package reports 0 High findings. The 6 standing Medium findings are allB615(HuggingFacefrom_pretrainedwithout revision pinning) in an optional local-vision module, and predate the last Active version.What changed between the last Active version and the first Flagged one
v2026.7.2..v2026.8.1is 41 files, 897 insertions, 94 deletions — almost entirely model-ID and pricing data for the vendor APIs this pack wraps, plus one new node and its help page. Zero dependency lines changed inpyproject.toml. No new network primitives, no new process or filesystem access, no new imports beyond the already-declared SDKs.The two modules most likely to draw a scanner's attention,
utils/scan_engine.pyandutils/safe_fetch.py, both predate2026.7.2, which scanned Active. So neither can be what changed.I have been unable to identify a trigger, which matches the content-independence that #180 demonstrates with a controlled experiment.
Request
2026.8.1,2026.8.2and2026.8.3.