5544 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Wei Hai	84e9d86e0c	Merge 465d1a95da into 985fb9d6ad	2026-07-05 13:06:14 +02:00
Alexander Piskun	985fb9d6ad	[Partner Nodes] fix(logs-auth): mask authorization headers in logs (#14774) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-07-05 13:55:29 +03:00
Alexis Rolland	7f287b705e	fix: Bug when setting transparency in color picker (#14764)	2026-07-04 19:13:38 -04:00
comfyanonymous	b7ba504e06	Try to make coderabbit enforce AGENTS.md (#14759)	2026-07-04 14:25:24 -04:00
Silver	6c62ca0b6b	fix: error when embedding is loaded with models using llama_template (#14744)	2026-07-04 17:06:09 +08:00
Robin Huang	3fe9f5fecb	Add CLAUDE.md as symlink to AGENTS.md (#14757)	2026-07-04 13:12:47 +08:00
Alexander Piskun	1073a74976	[Partner Nodes] chore(ByteDance): adjust category name (#14752) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-07-04 00:01:05 +03:00
comfyanonymous	de1b8f3e8d	Update AGENTS.md (#14738)	2026-07-03 13:08:24 -07:00
Alexander Piskun	77917ed3a6	[Partner Nodes] chore(StabilityAI): remove StabilityAI nodes (#14737) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-07-03 14:24:21 +03:00
Daxiong (Lin)	a04ebe05c2	chore: update workflow templates to v0.11.2 (#14741)	2026-07-03 19:08:11 +08:00
Alexander Piskun	9764381998	[Partner Nodes] feat(ByteDance): add support for Seed Audio 1.0 (#14731) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-07-03 14:00:10 +03:00
comfyanonymous	1e04ced089	Update AGENTS.md (#14733)	2026-07-03 02:08:47 -04:00
Matt Miller	96e0e3585b	security: fix four vulnerabilities (GHSA-779p-m5rp-r4h4) (#14734) ... * security: fix five vulnerabilities (GHSA-779p-m5rp-r4h4) - CVE-2026-56670: force download of SVG/XML responses on /view to prevent stored XSS - CVE-2026-56671: contain /experiment/models/preview reads within the model folder - CVE-2026-56672: stop inline rendering of uploaded /userdata/{file} content - CVE-2026-56673: prevent path traversal in get_annotated_filepath (LoadImage /prompt input) - CVE-2026-56674: reject opaque/null Origin to close the CSRF middleware bypass Adds regression tests under tests-unit/security_test/ covering all five. * security: address review feedback on GHSA-779p fixes - Fix Windows CI failure in test_get_annotated_filepath: compare against os.path.abspath(...) to match the intentional abspath normalization added by the traversal hardening (abspath prepends the drive letter on Windows). - origin_check: narrow the bare `except:` in is_loopback() to ValueError so genuine interrupts aren't swallowed (review nit). - origin_check: guard .port access in is_cross_origin_forbidden() so a malformed/out-of-range port (e.g. Origin: http://127.0.0.1:99999) fails closed with a 403 instead of surfacing an uncaught 500 in the middleware. - server /view: escape backslash/quote in the Content-Disposition filename (RFC 6266 quoted-string) so a filename containing a double quote can't malform the response header. * security: address CodeRabbit review feedback on GHSA-779p tests - test #3: guard the symlink-escape test with a try/except skip so it no longer errors on Windows CI where os.symlink needs elevated privileges / Developer Mode (mirrors the guard in the sibling test #2). - test #5: refresh the stale module docstring to describe the actual /view gating (view_image closure calling folder_paths.is_dangerous_content_type, the normalising check) instead of the bypassable raw set-membership test. * revert(security): drop CVE-2026-56674 Origin: null CSRF change Per maintainer review, the reported CSRF is already mitigated by the pre-existing Sec-Fetch-Site: cross-site check for current browsers, and the null-origin rejection risked breaking legitimate sandboxed-iframe embeds. Restores origin_only_middleware and is_loopback in server.py to their prior state (the Sec-Fetch-Site check is retained) and removes utils/origin_check.py and its regression test. The other four GHSA-779p fixes are unaffected.	2026-07-02 20:44:54 -07:00
Alexis Rolland	465d1a95da	Merge branch 'master' into fix/validate-node-executable	2026-07-03 09:28:39 +08:00
comfyanonymous	35c1470935	Update AGENTS.md (#14726)	2026-07-02 15:05:55 -04:00
Alexander Piskun	694815f498	[Partner Nodes] chore(Ideogram): remove IdeogramV1 and IdeogramV2 nodes (#14712) ... Signed-off-by: bigcat88 <bigcat88@icloud.com> Co-authored-by: Alexis Rolland <alexisrolland@hotmail.com>	2026-07-02 08:35:11 +03:00
comfyanonymous	92594ca84c	Update AGENTS.md with more stuff. (#14725)	2026-07-01 21:55:13 -04:00
Silver	2c935de1b1	Fix Qwen3-VL tokenizer crash with custom embeddings (#14713)	2026-07-01 21:15:07 +03:00
comfyanonymous	dd17debce5	Add some more stuff to AGENTS.md (#14704)	2026-07-01 01:51:51 -04:00
comfyanonymous	50e5270b86	Add AGENTS.md (#14696)	2026-06-30 17:40:33 -04:00
comfyanonymous	bb131be9e8	ComfyUI v0.27.0	2026-06-30 17:36:02 -04:00
Daxiong (Lin)	6fca64780c	chore: update workflow templates to v0.11.1 (#14698)	2026-06-30 14:28:09 -07:00
Alexis Rolland	6e11828d10	chore: Update nodes categories (#14674)	2026-07-01 05:20:20 +08:00
Alexander Piskun	b70944e710	[Partner Nodes] feat(Google): add Gemini Video Omni node (#14695)	2026-06-30 17:17:53 -04:00
Matt Miller	1c59659a2f	feat: make asset hashing opt-in via --enable-asset-hashing, off by default (#14663) ... Add a --enable-asset-hashing CLI flag (action=store_true, default False) and plumb it into the two asset-seeder call sites in main.py that previously hardcoded compute_hashes=True (the startup scan and the post-job output enqueue). Local runs now skip blake3 hashing unless the user opts in, avoiding the startup/per-output cost on large models directories while keeping hashing available for asset-portability features. Co-authored-by: Alexis Rolland <alexisrolland@hotmail.com>	2026-06-30 14:13:20 -07:00
comfyanonymous	d395813bcd	Fix memory leak related to int8. (#14697)	2026-06-30 14:08:59 -07:00
Alexander Piskun	8fe0243d97	[Partner Nodes] feat(Google): add Nano Banana 2 Lite model (#14693) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-06-30 11:17:23 -07:00
Silver	ba3f697dbb	Add ConditioningMultiply node to nodes.py as an addition to other adj… (#14686)	2026-06-30 16:27:09 +08:00
Comfy Org PR Bot	510ed5c384	Bump comfyui-frontend-package to 1.45.20 (#14684)	2026-06-30 16:25:03 +08:00
comfyanonymous	7851410511	Better and faster int8 lora applying. (#14685)	2026-06-29 21:52:08 -04:00
Daxiong (Lin)	a58473fd9b	chore: update embedded docs to v0.5.6 (#14668) ... Co-authored-by: Alexis Rolland <alexisrolland@hotmail.com>	2026-06-29 17:08:06 +08:00
comfyanonymous	79c555ce6b	Fix int8 mm being skipped on offloaded lora weights. (#14669)	2026-06-28 23:52:36 -04:00
Matt Miller	f19735759e	ci: add team-gated Cursor review (thin caller for github-workflows) (#14527)	2026-06-27 23:34:30 -07:00
comfyanonymous	a95e461916	int8 support on turing GPUs. (#14662)	2026-06-27 15:53:11 -07:00
pythongosssss	603d891eaf	Update GLSL node to use ANGLE library (CORE-162) (#13195)	2026-06-27 08:40:31 +08:00
comfyanonymous	470ac36a0a	Fix int8 loras causing lower quality requant with wrong settings. (#14650) ... * Update comfy-kitchen * Support requantizing with same settings as orig quant.	2026-06-26 16:41:29 -07:00
Wei Hai	bf00c39705	Don't instantiate nodes during validation ... Addresses review feedback: the V1 executability check fell back to constructing the node (class_def()) when the FUNCTION method wasn't found on the class. That runs __init__ during validation, so a constructor's side effects or failure could be misreported as invalid_node_definition for an otherwise valid node. Inspect only the class. No core/extra node defines its FUNCTION method on the instance, so this loses no real coverage while removing the side-effect risk. Replace the instance-fallback test with one asserting a node with a raising __init__ but a valid class-level method still passes validation (i.e. it is never instantiated).	2026-06-26 16:04:29 -07:00
Wei Hai	82c954bd2a	Validate that a node is executable before running the prompt ... A node whose FUNCTION points at a method that does not exist (e.g. a typo in a custom node), or a V3 node missing its execute override, was only detected once that node ran -- after every upstream node had already executed. In a multi-node workflow the user waited for the whole graph to run up to the broken node before seeing the error. validate_prompt already walks every node before execution; add an executability check there so the error is reported up front and attributed to the offending node (returned in node_errors), and nothing runs. The check resolves the V1 FUNCTION method on the class (the common case) and falls back to an instance, since the runtime invokes it on an instance and a node may define FUNCTION or its method in __init__. V3 nodes are checked via their existing VALIDATE_CLASS. Add tests for V1 typo, V3 typo, good nodes, and a node whose method is defined in __init__ (must not be falsely rejected).	2026-06-26 15:53:34 -07:00
comfyanonymous	7cb784e0f4	Faster int8. (#14641)	2026-06-25 15:25:47 -07:00
comfyanonymous	1a510f0423	Support int8 models. (#14636)	2026-06-25 11:23:58 -07:00
Daxiong (Lin)	639c8fa788	chore: update workflow templates to v0.10.7 (#14632)	2026-06-25 23:05:34 +08:00
Alexander Piskun	e22f1500f9	[Partner Nodes] feat(ByteDance): add support for SeeDance-2.0-Mini video model (#14626) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-06-25 17:57:04 +03:00
Terry Jia	dac4ea3a80	feat: Bounding boxes canvas and Ideogram JSON prompt (#14537)	2026-06-25 22:34:09 +08:00
Comfy Org PR Bot	b0ec19804f	chore(openapi): sync shared API contract from cloud@4118910 (#14619)	2026-06-25 13:54:53 +08:00
comfyanonymous	64e1d740b8	Add advanced krea 2 model merging node. (#14621)	2026-06-24 20:37:30 -07:00
Yousef R. Gamaleldin	b22d0fb9c0	feat: Add Support For Simple Seed (CORE-295) (#14616)	2026-06-25 09:39:10 +08:00
Alexander Piskun	5236cd02e6	[Partner Nodes] feat(ByteDance): add 4K resolution support for SeeDance 2.0 (#14614) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-06-24 17:57:46 +03:00
Alexander Piskun	cabb7342d1	[Partner Nodes] feat(Grok): add 1080p resolution to Grok Image node (#14612) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-06-24 16:28:56 +03:00
Daxiong (Lin)	12218db68a	Update the template to bring the HH1.1 templates back (#14613)	2026-06-24 21:01:25 +08:00
Alexander Piskun	44955d783b	[Partner Nodes] feat(Alibaba): add support for HappyHorse 1.1 model (#14611) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-06-24 13:37:28 +03:00