latest_version API returns stale Active version instead of newest version (ignores Pending/Flagged)

[Josia-doit]

Summary

The registry API's latest_version field for a node returns a stale Active version instead of the newest published version, whenever the newest version has a non-Active status (e.g. Pending or Flagged).

Observed behavior

For node comfyui-josianodes (publisher josia, display name JosiaNodes):

GET https://api.comfy.org/nodes/comfyui-josianodes returns:

"latest_version": {
  "version": "1.5.3",
  "status": "NodeVersionStatusActive",
  "downloadUrl": "",
  "id": "226ef883-3fd4-4ad6-96d5-0303713c3b2e",
  "node_id": "comfyui-josianodes"
}

GET https://api.comfy.org/nodes/comfyui-josianodes/versions returns (newest first):

version	status
1.6.4	NodeVersionStatusPending
1.6.2	NodeVersionStatusFlagged
1.6.0	NodeVersionStatusFlagged
1.5.9	NodeVersionStatusFlagged
1.5.8	NodeVersionStatusBanned
1.5.5	NodeVersionStatusFlagged
1.5.3	NodeVersionStatusActive
1.5.0	NodeVersionStatusActive
1.4.5	NodeVersionStatusActive
1.4.0	NodeVersionStatusActive

So the actual newest version is 1.6.4 (Pending), but latest_version reports 1.5.3 (Active) — a version that is 3 minor releases behind and whose downloadUrl is even empty.

Expected behavior

latest_version (and the "latest version" shown at the top of the node's registry page) should be the highest semantic version across all statuses, i.e. 1.6.4. A version's status (Pending / Flagged / Active) should not cause a much older version to be surfaced as "latest".

Impact

• The registry web page and any client reading latest_version display 1.5.3 as the current version, even though 1.6.4 is already published.
• Note: the ComfyUI Manager /install endpoint correctly resolves and installs 1.6.4. So there is an inconsistency between the "latest version" metadata and what actually gets installed.

Reproduction

curl https://api.comfy.org/nodes/comfyui-josianodes | jq '.latest_version.version'
# -> "1.5.3"   (expected "1.6.4")

Suspected cause

GetLatestNodeVersion (or the query that populates latest_version) appears to filter by status = Active (or otherwise prioritize the Active status over pure version ordering), rather than ordering by version descending first and then applying status-visibility rules.

Evidence timestamp

Captured 2026-08-11 (UTC+8).