Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package comfyui for openSUSE:Factory checked 
in at 2026-08-26 19:53:28
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/comfyui (Old)
 and      /work/SRC/openSUSE:Factory/.comfyui.new.1258 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "comfyui"

Wed Aug 26 19:53:28 2026 rev:4 rq:1373695 version:0.33.3

Changes:
--------
--- /work/SRC/openSUSE:Factory/comfyui/comfyui.changes  2026-08-24 
15:44:03.464649450 +0200
+++ /work/SRC/openSUSE:Factory/.comfyui.new.1258/comfyui.changes        
2026-08-26 19:54:01.683387226 +0200
@@ -1,0 +2,27 @@
+Tue Aug 25 18:48:09 UTC 2026 - Martin Pluskal <[email protected]>
+
+- Depend on floors instead of exact versions for the comfy* packages,
+  so that comfyui does not become uninstallable whenever one of them
+  is updated on its own:
+  * comfyui-workflow-templates was pinned to = 0.11.44; Factory has
+    accepted 0.11.46, so that pin loses its provider as soon as the
+    build publishes. It is now >= 0.11.44
+  * comfy-kitchen is now >= 0.2.31, comfyui-frontend-package
+    >= 1.50.6, comfyui-embedded-docs stays >= 0.5.9, and comfy-aimdo goes
+    back to upstream's declared >= 0.4.13 from the = 0.4.14 that was
+    tracking whatever happened to be packaged
+  * upstream's requirements.txt uses == for all of these, but its own
+    check_comfy_packages_versions() warns only when the installed
+    version is below the required one, so upstream treats them as
+    floors as well
+  * no upper bounds are set: comfy-aimdo and comfy-kitchen are both
+    imported at module scope, so an API removal in either would fail
+    at import, but the one comfy-kitchen minor bump so far removed no
+    exported names and comfy-aimdo's Python tree is unchanged between
+    0.4.13 and 0.4.15. A speculative bound would recreate exactly the
+    unresolvable state these floors fix
+  * the frontend-package floor is a security floor, not a
+    compatibility one: 1.50.6 carries the fixes for
+    GHSA-2gr5-vw2p-2hcf, GHSA-j6xv-rx8r-mh6j and GHSA-8xxc-66vh-2pf3
+
+-------------------------------------------------------------------

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ comfyui.spec ++++++
--- /var/tmp/diff_new_pack.fTxtPz/_old  2026-08-26 19:54:02.713423604 +0200
+++ /var/tmp/diff_new_pack.fTxtPz/_new  2026-08-26 19:54:02.718423781 +0200
@@ -45,11 +45,32 @@
 Requires:       %{primary_python}-alembic
 Requires:       %{primary_python}-av >= 16.0.0
 Requires:       %{primary_python}-blake3
-Requires:       %{primary_python}-comfy-aimdo = 0.4.14
-Requires:       %{primary_python}-comfy-kitchen = 0.2.31
+# Upstream's requirements.txt uses "==" for the comfy* packages, but its own
+# check_comfy_packages_versions() warns only when the installed version is
+# BELOW the pinned one, so upstream itself treats these as floors. Encoding
+# them as exact RPM pins makes comfyui uninstallable as soon as any one of
+# them is updated on its own: the pin on comfyui-workflow-templates lost
+# its provider the moment Factory accepted 0.11.46.
+# frontend-package and embedded-docs are read only as data directories via
+# importlib.resources. workflow-templates is used through its Python API
+# (frontend_management.py imports iter_templates and get_asset_path), but
+# that import is guarded and server.py switches on the installed version at
+# 0.3.0, so comfyui handles both the old bundled-data layout and the new
+# re-export shim. comfy-aimdo and comfy-kitchen are both imported at module
+# scope, so an API removal in either is an import-time failure -- but no
+# such break is known: the one comfy-kitchen minor bump so far (0.1 to
+# 0.2) removed no exported names, and comfy-aimdo's Python tree is
+# byte-identical between 0.4.13 and 0.4.15. A speculative upper bound would 
simply recreate
+# the unresolvable state this floor exists to fix, so none is set; a real
+# break gets a bound then, with the evidence.
+Requires:       %{primary_python}-comfy-aimdo >= 0.4.13
+Requires:       %{primary_python}-comfy-kitchen >= 0.2.31
 Requires:       %{primary_python}-comfyui-embedded-docs >= 0.5.9
-Requires:       %{primary_python}-comfyui-frontend-package = 1.50.6
-Requires:       %{primary_python}-comfyui-workflow-templates = 0.11.44
+# Security floor, not a compatibility pin: 1.50.6 carries the XSS fixes
+# GHSA-2gr5-vw2p-2hcf, GHSA-j6xv-rx8r-mh6j and GHSA-8xxc-66vh-2pf3. Do not
+# lower it to whatever upstream's requirements.txt happens to name.
+Requires:       %{primary_python}-comfyui-frontend-package >= 1.50.6
+Requires:       %{primary_python}-comfyui-workflow-templates >= 0.11.44
 Requires:       %{primary_python}-einops
 Requires:       %{primary_python}-filelock
 Requires:       %{primary_python}-numpy >= 1.25.0

Reply via email to