Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package comfyui for openSUSE:Factory checked in at 2026-08-26 19:53:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/comfyui (Old) and /work/SRC/openSUSE:Factory/.comfyui.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "comfyui" Wed Aug 26 19:53:28 2026 rev:4 rq:1373695 version:0.33.3 Changes: -------- --- /work/SRC/openSUSE:Factory/comfyui/comfyui.changes 2026-08-24 15:44:03.464649450 +0200 +++ /work/SRC/openSUSE:Factory/.comfyui.new.1258/comfyui.changes 2026-08-26 19:54:01.683387226 +0200 @@ -1,0 +2,27 @@ +Tue Aug 25 18:48:09 UTC 2026 - Martin Pluskal <[email protected]> + +- Depend on floors instead of exact versions for the comfy* packages, + so that comfyui does not become uninstallable whenever one of them + is updated on its own: + * comfyui-workflow-templates was pinned to = 0.11.44; Factory has + accepted 0.11.46, so that pin loses its provider as soon as the + build publishes. It is now >= 0.11.44 + * comfy-kitchen is now >= 0.2.31, comfyui-frontend-package + >= 1.50.6, comfyui-embedded-docs stays >= 0.5.9, and comfy-aimdo goes + back to upstream's declared >= 0.4.13 from the = 0.4.14 that was + tracking whatever happened to be packaged + * upstream's requirements.txt uses == for all of these, but its own + check_comfy_packages_versions() warns only when the installed + version is below the required one, so upstream treats them as + floors as well + * no upper bounds are set: comfy-aimdo and comfy-kitchen are both + imported at module scope, so an API removal in either would fail + at import, but the one comfy-kitchen minor bump so far removed no + exported names and comfy-aimdo's Python tree is unchanged between + 0.4.13 and 0.4.15. A speculative bound would recreate exactly the + unresolvable state these floors fix + * the frontend-package floor is a security floor, not a + compatibility one: 1.50.6 carries the fixes for + GHSA-2gr5-vw2p-2hcf, GHSA-j6xv-rx8r-mh6j and GHSA-8xxc-66vh-2pf3 + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ comfyui.spec ++++++ --- /var/tmp/diff_new_pack.fTxtPz/_old 2026-08-26 19:54:02.713423604 +0200 +++ /var/tmp/diff_new_pack.fTxtPz/_new 2026-08-26 19:54:02.718423781 +0200 @@ -45,11 +45,32 @@ Requires: %{primary_python}-alembic Requires: %{primary_python}-av >= 16.0.0 Requires: %{primary_python}-blake3 -Requires: %{primary_python}-comfy-aimdo = 0.4.14 -Requires: %{primary_python}-comfy-kitchen = 0.2.31 +# Upstream's requirements.txt uses "==" for the comfy* packages, but its own +# check_comfy_packages_versions() warns only when the installed version is +# BELOW the pinned one, so upstream itself treats these as floors. Encoding +# them as exact RPM pins makes comfyui uninstallable as soon as any one of +# them is updated on its own: the pin on comfyui-workflow-templates lost +# its provider the moment Factory accepted 0.11.46. +# frontend-package and embedded-docs are read only as data directories via +# importlib.resources. workflow-templates is used through its Python API +# (frontend_management.py imports iter_templates and get_asset_path), but +# that import is guarded and server.py switches on the installed version at +# 0.3.0, so comfyui handles both the old bundled-data layout and the new +# re-export shim. comfy-aimdo and comfy-kitchen are both imported at module +# scope, so an API removal in either is an import-time failure -- but no +# such break is known: the one comfy-kitchen minor bump so far (0.1 to +# 0.2) removed no exported names, and comfy-aimdo's Python tree is +# byte-identical between 0.4.13 and 0.4.15. A speculative upper bound would simply recreate +# the unresolvable state this floor exists to fix, so none is set; a real +# break gets a bound then, with the evidence. +Requires: %{primary_python}-comfy-aimdo >= 0.4.13 +Requires: %{primary_python}-comfy-kitchen >= 0.2.31 Requires: %{primary_python}-comfyui-embedded-docs >= 0.5.9 -Requires: %{primary_python}-comfyui-frontend-package = 1.50.6 -Requires: %{primary_python}-comfyui-workflow-templates = 0.11.44 +# Security floor, not a compatibility pin: 1.50.6 carries the XSS fixes +# GHSA-2gr5-vw2p-2hcf, GHSA-j6xv-rx8r-mh6j and GHSA-8xxc-66vh-2pf3. Do not +# lower it to whatever upstream's requirements.txt happens to name. +Requires: %{primary_python}-comfyui-frontend-package >= 1.50.6 +Requires: %{primary_python}-comfyui-workflow-templates >= 0.11.44 Requires: %{primary_python}-einops Requires: %{primary_python}-filelock Requires: %{primary_python}-numpy >= 1.25.0
