5574 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Alexis Rolland	ccf32f315f	Merge branch 'master' into cloud-openapi-projection	2026-07-11 05:39:16 +08:00
Terry Jia	328144ce24	CORE-329 feat: add Save 3D (Advanced) node family (#14701)	2026-07-11 04:03:34 +08:00
Terry Jia	8310b0e0db	feat: add bboxes input to Create Bounding Boxes node (#14724)	2026-07-11 03:58:03 +08:00
Yousef R. Gamaleldin	94fa08223e	Save Text Node (CORE-176) (#14102)	2026-07-11 03:54:56 +08:00
mattmillerai	7c5d93499f	chore(openapi): sync shared API contract from cloud@bcb8f5f	2026-07-10 13:30:17 +00:00
liminfei-amd	1377a2f729	Only auto-enable the ROCm comfy-kitchen Triton backend on matrix-core GPUs (#14869) ... #14862 auto-enables the comfy-kitchen Triton backend whenever torch.version.hip is set and Triton >= 3.7. The INT8 matmul kernels compile tl.dot to matrix-core instructions (WMMA on RDNA3+/gfx11xx-gfx12xx, MFMA on CDNA/gfx9xx); RDNA1/RDNA2 (gfx10xx) have neither, so the auto-enabled INT8 path hangs the GPU there (reported on RDNA2 + triton-windows 3.7.1: native and custom-node INT8 freeze until reset). Gate the automatic ROCm default on GPU architecture as well as Triton version so RDNA1/RDNA2 stay on the working eager fallback. Add --disable-triton-backend as an explicit override; --enable-triton-backend still force-enables on any arch.	2026-07-10 03:31:20 -07:00
Alexander Piskun	206b9245dc	[Partner Nodes] fix(Tencent): restore Tencent3DPartNode FBX output via staged generation (#14867) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-07-10 12:33:32 +03:00
Alexander Piskun	89ecc5cf8c	[Partner Nodes] feat(Seedream): add widget to disable thinking (#14853) ... Signed-off-by: bigcat88 <bigcat88@icloud.com> Co-authored-by: Daxiong (Lin) <contact@comfyui-wiki.com>	2026-07-10 11:58:22 +03:00
John Pollock	8e2e54e2b8	Add SeedVR2 support (CORE-6) (#14424)	2026-07-10 15:07:42 +08:00
comfyanonymous	e2a6e30d89	Fix black image on turing when using int4 models. (#14864)	2026-07-09 23:17:06 -04:00
liminfei-amd	099522f85b	Enable comfy-kitchen Triton backend by default on ROCm/AMD (#14862) ... On AMD/ROCm the CUDA backend is unavailable, so Triton is the only accelerated comfy-kitchen backend. It was disabled by default (opt-in --enable-triton-backend), leaving AMD on the slow eager path. Enable it by default when torch.version.hip is set AND Triton is >= 3.7 -- older Triton lacks libdevice.rint on the HIP backend and hard-crashes the INT8 path, so on Triton < 3.7 it stays disabled with a log line. NVIDIA behavior is unchanged; the explicit --enable-triton-backend flag still works as an override. Fixes #14861	2026-07-09 23:11:52 -04:00
liminfei-amd	62e025a4f3	Fix FP8 activation quantization for >2D activations in mixed_precision_ops (#14643) ... mixed_precision_ops.Linear.forward only quantized activations that were 2D, or 3D (reshaped to 2D). Inputs with rank >= 4 (e.g. Anima's MLP activations, which are not reshaped to 3D the way the attention path is) fell through the `input_reshaped.ndim == 2` guard and reached scaled_mm as bf16, silently dispatching a bf16 kernel instead of FP8. Since MLP is roughly half the compute, the FP8 speedup was far below expectation. Generalize the existing 3D->2D reshape to any rank >= 3 (flatten the leading dims, keep the contraction dim) and reshape the output back to the original leading dims. 2D and 3D inputs are handled exactly as before; only rank >= 4 inputs change (now quantized instead of skipped). This matches the rank-agnostic handling already used by the training path (flatten(0, -2) / unflatten). Fixes #14595.	2026-07-09 22:30:26 -04:00
comfyanonymous	b7a648ca20	Try to fix the model reloading issue some people have. (#14822)	2026-07-09 16:39:01 -07:00
comfyanonymous	73e84d5ec8	Support convrot int4 models. (#14859) ... linear_dtype in comfy_quant metadata can be used to set if the int4 op does the matrix multiplication in int8 or int4, the default is int4 on GPUs that support it with fallback to int8 for GPUs that don't.	2026-07-09 18:57:09 -04:00
Alexis Rolland	1ea724339c	Update cla.yml (#14851)	2026-07-09 17:57:44 -04:00
Simon Pinfold	412aaab0e2	feat(api): expose registered extension filters on /experiment/models (#14797) ... Each folder in the listing now carries its registered extension allowlist verbatim; an empty array means the folder accepts any extension (match-all), mirroring filter_files_extensions semantics. Gives consumers the filtering rule itself rather than just its output: /models/{folder} lists files by the per-folder rule but the rule is not exposed anywhere, and /experiment/models/{folder} filters everything by the global supported_pt_extensions regardless of registration. Presentation-level filtering of match-all folders (e.g. hiding README/config noise that repository-downloading custom nodes leave in model directories) is deliberately left to the consumer. Co-authored-by: guill <jacob.e.segal@gmail.com>	2026-07-09 12:59:30 -07:00
Terry Jia	04a30fb375	fix: Load3D failing path validation from double path resolution (#14852)	2026-07-09 22:42:20 +08:00
Alexander Piskun	b35819712e	feat: allow --comfy-api-base target ephemeral testenvs (#14569) ... * feat: allow --comfy-api-base target ephemeral testenvs Signed-off-by: bigcat88 <bigcat88@icloud.com> * refactor: name /features data as backend flags, not frontend --------- Signed-off-by: bigcat88 <bigcat88@icloud.com> Co-authored-by: guill <jacob.e.segal@gmail.com>	2026-07-08 23:20:10 -07:00
comfyanonymous	d0008a8958	Fix qwen3vl reference images when used as a text encode models. (#14845) ... Should not affect use as a text generation model.	2026-07-09 01:50:25 -04:00
Simon Pinfold	55a15f87ce	feat(assets): add namespaced model_type tags and align tag semantics (#14511) ... * feat(assets): add namespaced model type tags * fix(assets): mark path-derived upload tags automatic * fix(assets): merge duplicate scan specs * test(assets): make duplicate path normalization portable * feat(assets): add loader_path as the authoritative loader locator (#14796) * fix(assets): filter model_type tags by bucket extension sets Buckets sharing a base directory (e.g. diffusion_models and a custom unet_gguf) tagged every file in the directory regardless of whether the bucket could load it, so .safetensors files were tagged model_type:unet_gguf and vice versa. Carry each bucket's registered extension set through get_comfy_models_folders and only emit a model_type tag when the file extension matches, keeping the empty-set match-all convention from folder_paths.filter_files_extensions. Files under a model base matching no bucket now keep only the models tag instead of every directory-matching model_type tag. * feat(assets): replace response file_path with persisted loader_path The old file_path response field was a namespaced storage locator (models/checkpoints/foo.safetensors): not an absolute path, not unique identity, and not the value a loader consumes. Nothing needs that shape on the wire (hash/ID-based locating is the long-term direction), so it is dropped rather than renamed; the storage-root matching stays internal, powering display_name. What loaders DO need is the in-root loader path (category dropped: models/checkpoints/foo/bar.safetensors -> foo/bar.safetensors). Serve it as a first-class loader_path field, persisted on asset_references (migration 0006) and written by every ingest pipeline at insert, so responses read the column verbatim. Like the model_type tags, loader_path is a seed-time derivative of the model folder registry, maintained by the same scan lifecycle (new files seed fresh values, pruning retires rows whose bucket disappeared). Rows predating the column serve a null loader_path; databases from before this stack already need recreating for the base branch's tag changes. loader_path resolves every registered base including extra_model_paths entries; display_name only the canonical storage roots. A file can therefore be loadable with no display name (extra-path models) or the reverse (unregistered files under the models root), and loader_path is null exactly when no loader can resolve the file. * test(assets): lock loader_path matrix (asymmetry, null, persist/read) Cover the behaviour that has no production change but is easy to regress: the extra-path asymmetry (loadable but no storage namespace), null loader_path persistence for orphan files, and the response reading the stored column with a compute fallback for un-backfilled rows. * fix(assets): persist subfolder-qualified loader_path for ingested outputs ingest_existing_file built its seed spec with the file's basename, so outputs saved into a subfolder persisted loader_path (and the user_metadata filename that preview URLs split for their subfolder param) as just the basename: the served locator pointed at a file that does not exist at that path. Scanner and seeder specs already derive fname via compute_loader_path; use the same derivation here. * fix(assets): only extension-matching buckets contribute a loader_path The model-base match in get_asset_category_and_relative_path ignored each bucket's extension set, so a file inside a registered base whose extension the bucket cannot load (e.g. a .txt uploaded into model_type:checkpoints) advertised a loader_path that no loader list would ever resolve, while the tag side of the same stack already excluded it. Apply the extension check used for backend tags (empty set accepts any extension), keeping loader_path null exactly when no loader can resolve the file. * fix(assets): refresh loader_path when re-ingesting an existing reference upsert_reference only wrote loader_path on the INSERT branch, so re-ingesting an existing reference (an output overwritten in place, or a file re-registered after its loader_path derivation changed) kept the stale or NULL value forever. Write it on the UPDATE branch too, with a null-safe change guard so a loader_path difference alone is enough to trigger the update, and identical values stay a no-op. * fix(assets): repair semantic merge breakage from #14796 and master Two textually-clean but semantically-broken merges: - routes.py lost its folder_paths import when #14796's import block superseded the base's, while the content-type hardening added via the base's master merge still calls folder_paths.is_dangerous_content_type. - master's SVG download-hardening test uploads with the pre-namespacing bare checkpoints tag, which this branch's destination validation rejects; use model_type:checkpoints. --------- Co-authored-by: guill <jacob.e.segal@gmail.com>	2026-07-08 22:00:08 -07:00
Daxiong (Lin)	6cc814437f	Update workflow templates to v0.11.6 (#14834)	2026-07-08 14:04:57 -07:00
Alexander Piskun	24d3ea3265	[Partner Nodes] feat(ByteDance): add Seedream 5 Pro model support (#14832)	2026-07-08 14:04:19 -07:00
j2gg0s	c6cb904994	Fix AttributeError in VAE.is_dynamic() for VAEs constructed without a patcher (#14826)	2026-07-08 16:01:43 -04:00
Silver	091b70edda	add models-directory launch argument (#9113)	2026-07-08 22:20:47 +08:00
comfyanonymous	ffbecfffb9	Fix crash when using UNetSelfAttentionMultiply (#14823)	2026-07-07 21:17:31 -07:00
comfyanonymous	b481bc15af	Support gqa on all attention backends, drop support for pytorch 2.4 (#14772)	2026-07-07 22:57:52 -04:00
comfyanonymous	6880614319	Update AGENTS.md (#14819)	2026-07-07 18:36:13 -07:00
Barish Ozbay	51bf508a0b	feat: Implement basic text overlay node (CORE-137) (#14610)	2026-07-07 21:26:52 +08:00
Alexander Piskun	a3020f107e	fix(Video): don't crash on videos with undecodable audio streams (#14746) ... * fix(Video): don't crash on videos with undecodable audio streams Signed-off-by: bigcat88 <bigcat88@icloud.com> * Update comfy_api_nodes/util/upload_helpers.py --------- Signed-off-by: bigcat88 <bigcat88@icloud.com> Co-authored-by: Alexis Rolland <alexisrolland@hotmail.com>	2026-07-07 15:59:49 +03:00
comfyanonymous	7cf4e78335	Delete symlink that breaks our updates. (#14803)	2026-07-06 22:24:05 -04:00
Alexis Rolland	7747c342d4	ci: add CLA Assistant workflow (#14582)	2026-07-07 06:44:19 +08:00
comfyanonymous	439bd807f8	Skip unloading dynamic model patchers in current workflow. (#14799)	2026-07-06 14:35:12 -07:00
Daxiong (Lin)	b08debceca	chore: update embedded docs to v0.5.7 (#14783)	2026-07-06 09:56:09 +08:00
comfyanonymous	000c6b784e	Small speedup for text model sampling. (#14773)	2026-07-05 18:39:24 -07:00
Alexander Piskun	985fb9d6ad	[Partner Nodes] fix(logs-auth): mask authorization headers in logs (#14774) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-07-05 13:55:29 +03:00
Alexis Rolland	7f287b705e	fix: Bug when setting transparency in color picker (#14764)	2026-07-04 19:13:38 -04:00
comfyanonymous	b7ba504e06	Try to make coderabbit enforce AGENTS.md (#14759)	2026-07-04 14:25:24 -04:00
Silver	6c62ca0b6b	fix: error when embedding is loaded with models using llama_template (#14744)	2026-07-04 17:06:09 +08:00
Robin Huang	3fe9f5fecb	Add CLAUDE.md as symlink to AGENTS.md (#14757)	2026-07-04 13:12:47 +08:00
Alexander Piskun	1073a74976	[Partner Nodes] chore(ByteDance): adjust category name (#14752) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-07-04 00:01:05 +03:00
comfyanonymous	de1b8f3e8d	Update AGENTS.md (#14738)	2026-07-03 13:08:24 -07:00
Alexander Piskun	77917ed3a6	[Partner Nodes] chore(StabilityAI): remove StabilityAI nodes (#14737) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-07-03 14:24:21 +03:00
Daxiong (Lin)	a04ebe05c2	chore: update workflow templates to v0.11.2 (#14741)	2026-07-03 19:08:11 +08:00
Alexander Piskun	9764381998	[Partner Nodes] feat(ByteDance): add support for Seed Audio 1.0 (#14731) ... Signed-off-by: bigcat88 <bigcat88@icloud.com>	2026-07-03 14:00:10 +03:00
comfyanonymous	1e04ced089	Update AGENTS.md (#14733)	2026-07-03 02:08:47 -04:00
Matt Miller	96e0e3585b	security: fix four vulnerabilities (GHSA-779p-m5rp-r4h4) (#14734) ... * security: fix five vulnerabilities (GHSA-779p-m5rp-r4h4) - CVE-2026-56670: force download of SVG/XML responses on /view to prevent stored XSS - CVE-2026-56671: contain /experiment/models/preview reads within the model folder - CVE-2026-56672: stop inline rendering of uploaded /userdata/{file} content - CVE-2026-56673: prevent path traversal in get_annotated_filepath (LoadImage /prompt input) - CVE-2026-56674: reject opaque/null Origin to close the CSRF middleware bypass Adds regression tests under tests-unit/security_test/ covering all five. * security: address review feedback on GHSA-779p fixes - Fix Windows CI failure in test_get_annotated_filepath: compare against os.path.abspath(...) to match the intentional abspath normalization added by the traversal hardening (abspath prepends the drive letter on Windows). - origin_check: narrow the bare `except:` in is_loopback() to ValueError so genuine interrupts aren't swallowed (review nit). - origin_check: guard .port access in is_cross_origin_forbidden() so a malformed/out-of-range port (e.g. Origin: http://127.0.0.1:99999) fails closed with a 403 instead of surfacing an uncaught 500 in the middleware. - server /view: escape backslash/quote in the Content-Disposition filename (RFC 6266 quoted-string) so a filename containing a double quote can't malform the response header. * security: address CodeRabbit review feedback on GHSA-779p tests - test #3: guard the symlink-escape test with a try/except skip so it no longer errors on Windows CI where os.symlink needs elevated privileges / Developer Mode (mirrors the guard in the sibling test #2). - test #5: refresh the stale module docstring to describe the actual /view gating (view_image closure calling folder_paths.is_dangerous_content_type, the normalising check) instead of the bypassable raw set-membership test. * revert(security): drop CVE-2026-56674 Origin: null CSRF change Per maintainer review, the reported CSRF is already mitigated by the pre-existing Sec-Fetch-Site: cross-site check for current browsers, and the null-origin rejection risked breaking legitimate sandboxed-iframe embeds. Restores origin_only_middleware and is_loopback in server.py to their prior state (the Sec-Fetch-Site check is retained) and removes utils/origin_check.py and its regression test. The other four GHSA-779p fixes are unaffected.	2026-07-02 20:44:54 -07:00
comfyanonymous	35c1470935	Update AGENTS.md (#14726)	2026-07-02 15:05:55 -04:00
Alexander Piskun	694815f498	[Partner Nodes] chore(Ideogram): remove IdeogramV1 and IdeogramV2 nodes (#14712) ... Signed-off-by: bigcat88 <bigcat88@icloud.com> Co-authored-by: Alexis Rolland <alexisrolland@hotmail.com>	2026-07-02 08:35:11 +03:00
comfyanonymous	92594ca84c	Update AGENTS.md with more stuff. (#14725)	2026-07-01 21:55:13 -04:00
Silver	2c935de1b1	Fix Qwen3-VL tokenizer crash with custom embeddings (#14713)	2026-07-01 21:15:07 +03:00