* fix: release 3.2.3 — metadata parsing, null-safe saves, auto-hide, tag search
- fix(#75): stop SaveImage patch from writing the last-run prompt into every
PromptManager node (negative prompts were saved as copies of the positive)
- fix(#75): replace four duplicated metadata parsers with a shared
web/js/comfy-metadata.js that traces sampler links (KSampler, CFGGuider /
SamplerCustomAdvanced, LoRA chains, ControlNet pass-through, any checkpoint
loader) and recovers per-node text for images saved by older versions
- fix(#143): treat null JSON body fields as empty in prompt API handlers
- fix(#149): keep auto-hide timeout 0 (disabled) instead of falling back to
the default; validate result_timeout on save
- feat(#150): support tag:name filters in the node search box
- docs(#142): scan dialog mentions A1111/Forge metadata support
- docs(#144): fix ComfyUI-Lora-Manager links
- ci: run JS tests with node --test
* fix: bound metadata graph traversal to prevent tab freeze on crafted PNGs
Link resolution tried every linked input recursively with only a depth cap,
so a PNG whose prompt graph has cycles and fan-out could force ~inputs^25
paths and hang the gallery/metadata page. Each lookup now shares a visited
set (each node expanded once) with a hard cap of 500 visits.
* fix: read the matching output of multi-output settings nodes
KSampler settings linked to a node like SamplerCombo all resolved to its
first value, so steps, cfg and sampler showed the sampler name. Scalar
resolution now prefers the linked node's input with the same field name.
* fix: address review — trust API text, restore workflow-only parsing
- Workflow widget text now only replaces API text for metadata showing the
pre-3.2.3 corruption signature (2+ PromptManager nodes with identical API
text but different widgets). Otherwise the API graph wins, so expanded
dynamic prompts and linked text display what actually ran.
- Images with only a UI workflow are converted to the API graph shape and
traced the same way: prompts, KSamplerAdvanced, UNET/checkpoint loaders,
KJNodes Set/Get, Reroute, bypassed and muted nodes.
- Add code-quality.yml: Black formatting check, flake8 linting, bandit
security scan
- Add dependabot.yml: weekly updates for pip deps and GitHub Actions
- Add requirements-dev.txt: single source of truth for CI dependencies
- Harden test.yml: add permissions, pip caching, use requirements-dev.txt
- Add Black/flake8/bandit config to pyproject.toml (line-length=88)
Vito