Raise declared dependency floors to non-vulnerable versions: diffusers
0.38.0 fixes the trust_remote_code/custom_pipeline RCE advisories
(CVE-2026-44513/44827/45804), and pytest 9.0.3 fixes the tmpdir handling
issue. uv.lock is gitignored, so only pyproject floors are tracked; the
local lock was refreshed and the suite re-run (20 passed) to verify the
upgraded resolution still works.
Closes#9
- 20 tests covering node registration, loader, decode, encode, and model wrapper
- conftest.py mocks ComfyUI-specific modules (folder_paths, comfy.model_management)
- Use absolute import in __init__.py for test compatibility
- Setup uv for dependency management
Katsuhide Tsuruta