mirror of
https://github.com/Comfy-Org/ComfyUI-Manager.git
synced 2026-05-09 00:22:51 +08:00
4410ebc6a6
Defense-in-depth over GET→POST alone: reject the three CORS-safelisted simple-form Content-Types (x-www-form-urlencoded, multipart/form-data, text/plain) on 16 no-body POST handlers (glob + legacy) to block <form method=POST> CSRF that bypasses method-only gating. Move comfyui_switch_version to a JSON body so the preflight requirement applies. Split db_mode/policy/update/channel_url_list into GET(read) + POST(write). Tighten do_fix (high → high+) and gate three previously-ungated config setters at middle. Resynchronize openapi.yaml (27 paths, 30 operations, ComfyUISwitchVersionParams as a shared $ref component). Add E2E harness variants, Playwright config, CSRF/secgate suites, 39-endpoint coverage, and a CHANGELOG. Breaking: legacy per-op POST routes (install/uninstall/fix/disable/update/ reinstall/abort_current) are removed; callers already use queue/batch. Legacy /manager/notice (v1) is removed; /v2/manager/notice is retained. Reported-by: XlabAI Team of Tencent Xuanwu Lab CVSS: 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
66 lines
1.5 KiB
TOML
66 lines
1.5 KiB
TOML
[build-system]
|
|
requires = ["setuptools >= 61.0"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[project]
|
|
name = "comfyui-manager"
|
|
license = { text = "GPL-3.0-only" }
|
|
version = "4.2"
|
|
requires-python = ">= 3.9"
|
|
description = "ComfyUI-Manager provides features to install and manage custom nodes for ComfyUI, as well as various functionalities to assist with ComfyUI."
|
|
readme = "README.md"
|
|
keywords = ["comfyui", "comfyui-manager"]
|
|
|
|
maintainers = [
|
|
{ name = "Dr.Lt.Data", email = "dr.lt.data@gmail.com" },
|
|
{ name = "Yoland Yan", email = "yoland@comfy.org" },
|
|
{ name = "James Kwon", email = "hongilkwon316@gmail.com" },
|
|
{ name = "Robin Huang", email = "robin@comfy.org" },
|
|
]
|
|
|
|
classifiers = [
|
|
"Development Status :: 5 - Production/Stable",
|
|
"Intended Audience :: Developers",
|
|
"License :: OSI Approved :: GNU General Public License v3 (GPLv3)",
|
|
]
|
|
|
|
dependencies = [
|
|
"GitPython",
|
|
"PyGithub",
|
|
# "matrix-nio",
|
|
"transformers",
|
|
"huggingface-hub>0.20",
|
|
"typer",
|
|
"rich",
|
|
"typing-extensions",
|
|
"toml",
|
|
"uv",
|
|
"chardet"
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
dev = ["pre-commit", "pytest", "ruff", "pytest-cov", "pygit2"]
|
|
|
|
[project.urls]
|
|
Repository = "https://github.com/ltdrdata/ComfyUI-Manager"
|
|
|
|
[tool.setuptools.packages.find]
|
|
where = ["."]
|
|
include = ["comfyui_manager*", "cm_cli*"]
|
|
|
|
[project.scripts]
|
|
cm-cli = "cm_cli:main"
|
|
|
|
[tool.ruff]
|
|
line-length = 120
|
|
target-version = "py39"
|
|
|
|
[tool.ruff.lint]
|
|
select = [
|
|
"E4", # default
|
|
"E7", # default
|
|
"E9", # default
|
|
"F", # default
|
|
"I", # isort-like behavior (import statement sorting)
|
|
]
|