ComfyUI

v0.28.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 11d Model Serving & MLOps

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai comfy comfyui python pytorch stable-diffusion

ReleasePort's take

Moderate signal

editorial:auto 11d

Release v0.28.0 patches four security vulnerabilities and removes PyTorch 2.4 support.

Why it matters: Addresses GHSA-779p-m5rp-r4h4 with severity score 90; dropping PyTorch 2.4 requires migration before upgrade.

Summary

AI summary

Fixed Qwen3‑VL tokenizer crash, ByteDance partner node changes, security vulnerabilities, image processing fixes, and added advanced 3D nodes.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Fixes four vulnerabilities (GHSA-779p-m5rp-r4h4). Fixes four vulnerabilities (GHSA-779p-m5rp-r4h4). Source: llm_adapter@2026-07-15 Confidence: high	—
Breaking	High	Drops support for PyTorch 2.4. Drops support for PyTorch 2.4. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature
Feature	Medium	Adds basic text overlay node (CORE-137). Adds basic text overlay node (CORE-137). Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds Save 3D (Advanced) node family (CORE-329). Adds Save 3D (Advanced) node family (CORE-329). Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds namespaced model_type tags and aligns tag semantics. Adds namespaced model_type tags and aligns tag semantics. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds bboxes input to Create Bounding Boxes node. Adds bboxes input to Create Bounding Boxes node. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds SeedVR2 support (CORE-6). Adds SeedVR2 support (CORE-6). Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds Seedream 5 Pro model support (ByteDance). Adds Seedream 5 Pro model support (ByteDance). Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature	Low	Adds widget to disable thinking for Seedream nodes. Adds widget to disable thinking for Seedream nodes. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature	Low	Adds models-directory launch argument. Adds models-directory launch argument. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature	Low	Adds Save Text Node (CORE-176). Adds Save Text Node (CORE-176). Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Performance	Low	Small speedup for text model sampling. Small speedup for text model sampling. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Performance	Low	Optimizes int8 and int4 on Turing GPUs. Optimizes int8 and int4 on Turing GPUs. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Bugfix
Bugfix	Medium	Fixes crash when using UNetSelfAttentionMultiply. Fixes crash when using UNetSelfAttentionMultiply. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes AttributeError in VAE.is_dynamic() for VAEs without a patcher. Fixes AttributeError in VAE.is_dynamic() for VAEs without a patcher. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes Load3D failing path validation from double path resolution. Fixes Load3D failing path validation from double path resolution. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Restores Tencent3DPartNode FBX output (Tencent). Restores Tencent3DPartNode FBX output (Tencent). Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Bugfix	Medium	Fixes crash with Qwen3‑VL tokenizer and custom embeddings. Fixes crash with Qwen3‑VL tokenizer and custom embeddings. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Bugfix	Medium	Masks authorization headers in logs (auth). Masks authorization headers in logs (auth). Source: granite4.1:30b@2026-07-15-audit Confidence: low	—

Full changelog

What's Changed

Add AGENTS.md by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14696
Add some more stuff to AGENTS.md by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14704
Fix Qwen3-VL tokenizer crash with custom embeddings by @silveroxides in https://github.com/Comfy-Org/ComfyUI/pull/14713
Update AGENTS.md with more stuff. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14725
[Partner Nodes] chore(Ideogram): remove IdeogramV1 and IdeogramV2 nodes by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14712
Update AGENTS.md by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14726
security: fix four vulnerabilities (GHSA-779p-m5rp-r4h4) by @mattmillerai in https://github.com/Comfy-Org/ComfyUI/pull/14734
Update AGENTS.md by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14733
[Partner Nodes] feat(ByteDance): add support for Seed Audio 1.0 by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14731
Update workflow templates to v0.11.2 by @comfyui-wiki in https://github.com/Comfy-Org/ComfyUI/pull/14741
[Partner Nodes] chore(StabilityAI): remove StabilityAI nodes by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14737
Update AGENTS.md by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14738
[Partner Nodes] chore(ByteDance): adjust category name by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14752
Add CLAUDE.md as symlink to AGENTS.md by @robinjhuang in https://github.com/Comfy-Org/ComfyUI/pull/14757
fix: error when embedding is loaded with models using llama_template by @silveroxides in https://github.com/Comfy-Org/ComfyUI/pull/14744
Try to make coderabbit enforce AGENTS.md by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14759
fix: Bug when setting transparency in color picker by @alexisrolland in https://github.com/Comfy-Org/ComfyUI/pull/14764
[Partner Nodes] fix(logs-auth): mask authorization headers in logs by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14774
Small speedup for text model sampling. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14773
Update embedded docs to v0.5.7 by @comfyui-wiki in https://github.com/Comfy-Org/ComfyUI/pull/14783
Skip unloading dynamic model patchers in current workflow. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14799
ci: add CLA Assistant workflow by @alexisrolland in https://github.com/Comfy-Org/ComfyUI/pull/14582
Delete symlink that breaks our updates. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14803
fix(Video): don't crash on videos with undecodable audio streams by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14746
feat: Implement basic text overlay node (CORE-137) by @drozbay in https://github.com/Comfy-Org/ComfyUI/pull/14610
Update AGENTS.md by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14819
Support gqa on all attention backends, drop support for pytorch 2.4 by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14772
Fix crash when using UNetSelfAttentionMultiply by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14823
add models-directory launch argument by @silveroxides in https://github.com/Comfy-Org/ComfyUI/pull/9113
Fix AttributeError in VAE.is_dynamic() for VAEs constructed without a patcher by @j2gg0s in https://github.com/Comfy-Org/ComfyUI/pull/14826
[Partner Nodes] feat(ByteDance): add Seedream 5 Pro model support by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14832
Update workflow templates to v0.11.6 by @comfyui-wiki in https://github.com/Comfy-Org/ComfyUI/pull/14834
feat(assets): add namespaced model_type tags and align tag semantics by @synap5e in https://github.com/Comfy-Org/ComfyUI/pull/14511
Fix qwen3vl reference images when used as a text encode models. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14845
feat: allow --comfy-api-base target ephemeral testenvs by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14569
fix: Load3D failing path validation from double path resolution by @jtydhr88 in https://github.com/Comfy-Org/ComfyUI/pull/14852
feat(api): expose effective extension filter on /experiment/models by @synap5e in https://github.com/Comfy-Org/ComfyUI/pull/14797
Update cla.yml by @alexisrolland in https://github.com/Comfy-Org/ComfyUI/pull/14851
Support convrot int4 models. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14859
Try to fix the model reloading issue some people have. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14822
Fix FP8 activation quantization for >2D activations in mixed_precision_ops by @liminfei-amd in https://github.com/Comfy-Org/ComfyUI/pull/14643
Enable comfy-kitchen Triton backend by default on ROCm/AMD by @liminfei-amd in https://github.com/Comfy-Org/ComfyUI/pull/14862
Fix black image on turing when using int4 models. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14864
Add SeedVR2 support (CORE-6) by @pollockjj in https://github.com/Comfy-Org/ComfyUI/pull/14424
[Partner Nodes] feat(Seedream): add widget to disable thinking by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14853
[Partner Nodes] fix(Tencent): restore Tencent3DPartNode FBX output by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14867
Only auto-enable the ROCm comfy-kitchen Triton backend on matrix-core GPUs by @liminfei-amd in https://github.com/Comfy-Org/ComfyUI/pull/14869
Save Text Node (CORE-176) by @yousef-rafat in https://github.com/Comfy-Org/ComfyUI/pull/14102
feat: add bboxes input to Create Bounding Boxes node by @jtydhr88 in https://github.com/Comfy-Org/ComfyUI/pull/14724
CORE-329 feat: add Save 3D (Advanced) node family by @jtydhr88 in https://github.com/Comfy-Org/ComfyUI/pull/14701
fix: Undeprecate the text node by @alexisrolland in https://github.com/Comfy-Org/ComfyUI/pull/14870
chore: Update preview nodes by @alexisrolland in https://github.com/Comfy-Org/ComfyUI/pull/14871
Try to fix some issues with the seedvr VAE. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14877
Temporarily disable auto enabling triton by default on AMD. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14878
Try to fix flash attention related issue on AMD. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14880
Fix SaveVideo description: says images, saves video by @gmhelmold in https://github.com/Comfy-Org/ComfyUI/pull/14885
Support PID 1.5 models. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14894
[Partner Nodes] feat(client): send ComfyUI Core version in request headers by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14910
fix(image): correct HLG inverse-OETF clamp in hlg_to_linear by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14762
fix(image): support single-channel images in Save Image (Advanced) by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14761
[Partner Nodes] chore(Google): reroute Gemini Image preview models to release versions by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14917
Update embedded docs to v0.5.8 by @comfyui-wiki in https://github.com/Comfy-Org/ComfyUI/pull/14920
chore(openapi): sync shared API contract from cloud@491db61 by @comfy-pr-bot in https://github.com/Comfy-Org/ComfyUI/pull/14815
Update workflow templates to v0.11.9 by @comfyui-wiki in https://github.com/Comfy-Org/ComfyUI/pull/14924
Fix hidream o1 regression. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14923
More optimized int8 and int4 on turing. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14927
Fix 3D advanced nodes crashing in API mode (no UI) by @jtydhr88 in https://github.com/Comfy-Org/ComfyUI/pull/14930
Fix int8 performance regression on 16xx series. by @comfyanonymous in https://github.com/Comfy-Org/ComfyUI/pull/14941
[Partner Nodes] feat(sync.so): add support for "sync-3" model by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14928
Fix cached outputs missing from job results when prompt has no client_id by @bigcat88 in https://github.com/Comfy-Org/ComfyUI/pull/14939
Bump comfyui-frontend-package to 1.45.21 by @comfy-pr-bot in https://github.com/Comfy-Org/ComfyUI/pull/14944

New Contributors

@j2gg0s made their first contribution in https://github.com/Comfy-Org/ComfyUI/pull/14826
@liminfei-amd made their first contribution in https://github.com/Comfy-Org/ComfyUI/pull/14643
@gmhelmold made their first contribution in https://github.com/Comfy-Org/ComfyUI/pull/14885

Full Changelog: https://github.com/Comfy-Org/ComfyUI/compare/v0.27.0...v0.28.0

Breaking Changes

[Partner Nodes] chore(Ideogram): remove IdeogramV1 and IdeogramV2 nodes
[Partner Nodes] chore(StabilityAI): remove StabilityAI nodes
drop support for pytorch 2.4

Security Fixes

security: fix four vulnerabilities (GHSA-779p-m5rp-r4h4)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ComfyUI

Get notified when new releases ship.

About ComfyUI

The most powerful and modular diffusion model GUI, api and backend with a graph/nodes interface.