"Fix node (recreate)" rewired the inputs of the new node with
src_node.connect(link.origin_slot, dest.id, input.name).
LGraphNode.connect() looks its target up by id only when the id is a
number, so on a frontend whose node ids are strings the id was taken
for the node itself: the entry threw "findInputSlot is not a function"
and, because the original is removed only afterwards, left the wired
original and an unwired replacement on the canvas.
- Pass the node to connect(), as the output loop below already does
- Add a Playwright spec that clicks the entry in the node context menu
and checks the page errors and what every KSampler is wired to, with
node ids as the frontend issues them and with ids rewritten to
strings
- Add a CHANGELOG entry
Port of #3443 to v4 (#3126).
Four of the six share destinations of the legacy UI are gone: the
comfyworkflows.com domain registration has expired, the Copus API
answers 410 "ComfyUI direct publishing is no longer supported", the
OpenArt workflow API and pages return 404 or redirect to the home page,
and esheep.com no longer resolves. Manager still offered them, and the
ComfyWorkflows flow would hand the share key, the workflow and the
installed snapshot to whoever answers at that domain next.
- Remove ComfyWorkflows, Copus, OpenArt and eSheep from the share
chooser, the Share setting, the Workflow Gallery menu and the share
dialog, with their server routes, the two dialog modules and what the
Copus theme added to the chooser
- Treat a saved Share setting that names a removed site as All, and do
not open a removed site saved as the last visited Workflow Gallery
- Sharing to YouML and to Matrix is unchanged; the share request no
longer carries cw_auth or is_nsfw, which only ComfyWorkflows used
- Update README, CHANGELOG and the Playwright scenario notes
Defense-in-depth over GET→POST alone: reject the three CORS-safelisted
simple-form Content-Types (x-www-form-urlencoded, multipart/form-data,
text/plain) on 16 no-body POST handlers (glob + legacy) to block
<form method=POST> CSRF that bypasses method-only gating. Move
comfyui_switch_version to a JSON body so the preflight requirement applies.
Split db_mode/policy/update/channel_url_list into GET(read) + POST(write).
Tighten do_fix (high → high+) and gate three previously-ungated config
setters at middle. Resynchronize openapi.yaml (27 paths, 30 operations,
ComfyUISwitchVersionParams as a shared $ref component). Add E2E harness
variants, Playwright config, CSRF/secgate suites, 39-endpoint coverage,
and a CHANGELOG.
Breaking: legacy per-op POST routes (install/uninstall/fix/disable/update/
reinstall/abort_current) are removed; callers already use queue/batch.
Legacy /manager/notice (v1) is removed; /v2/manager/notice is retained.
Reported-by: XlabAI Team of Tencent Xuanwu Lab
CVSS: 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Dr.Lt.Data