Versions 1.0.9 and 1.0.10 have both sat at NodeVersionStatusPending on the
Comfy Registry for hours, while every release up to 1.0.8 went Active in about
twenty seconds. The registry exposes no reason — neither the versions list nor
the per-version endpoint carries a field explaining the status.
Checking what actually changed: the published zips are clean (17 files, no
caches or stray artifacts), and no new eval/exec/pickle/subprocess use was
introduced. The subprocess calls that do exist are the file-manager launchers,
which shipped in the Active 1.0.8. The one genuinely new thing in 1.0.9 was
outbound HTTP to a host this project had never contacted before, and
"calls to non-allowlisted hosts" is a documented registry flag trigger
(Comfy-Org/ComfyUI#14129).
That is a correlation, not a confirmed cause, so this release tests it: the
integration is removed entirely and the code now contacts only huggingface.co,
api.github.com and raw.githubusercontent.com — the same hosts as the Active
1.0.8. If this goes Active the theory holds and the feature can come back with
evidence to support a review request; if it stays Pending the cause lies
elsewhere, most likely a registry-side backlog.
The hostname is gone from the source rather than merely obscured — evading a
security scan would be the wrong fix. Direct download URLs from any host still
work through the generic handler, since those come from a link the user pastes.
Paste Link keeps HuggingFace file/repo links, bare repo ids, GitHub blob/raw
links and plain direct URLs. Token handling is now HuggingFace-only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
