bump manager version to 4.2.2

[ltdrdata]

Adds dedicated install flags so git_url/pip installs are controlled independently of the global security level (Comfy-Org/ComfyUI-Manager#2962), and hardens the pygit2 fallback path to prefer system git when available with follow-up fixes (Comfy-Org/ComfyUI-Manager#2972, Comfy-Org/ComfyUI-Manager#2974).

References:

• Diff: Comfy-Org/ComfyUI-Manager@4.2.1...4.2.2
• PyPI: https://pypi.org/project/comfyui-manager/4.2.2

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​comfyui-manager@​4.2.1 ⏵ 4.2.2	+1

View full report

[coderabbitai]

📝 Walkthrough

Walkthrough

The manager_requirements.txt file is updated to pin comfyui_manager at version 4.2.2, replacing the previous pin of 4.2.1. This is a single-line dependency version bump with no other changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and concisely describes the main change: bumping the manager version to 4.2.2.
Description check	✅ Passed	The description is directly related to the changeset, detailing the improvements included in version 4.2.2 with references to specific GitHub issues.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@manager_requirements.txt`:
- Line 1: The comfyui_manager dependency is pinned to version 4.2.2 which does
not exist on PyPI. Update the version specification for comfyui_manager to use
4.2.1 or another valid version that is available on PyPI to ensure the
dependency can be properly installed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 07beb3fb-fcc4-49eb-a401-84a44c54684e

📥 Commits

Reviewing files that changed from the base of the PR and between 5897d0c and 05aaad8.

📒 Files selected for processing (1)

• manager_requirements.txt

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

Is comfyui_manager version 4.2.2 available on PyPI, and are there any known security vulnerabilities or breaking changes in this release?

💡 Result:

As of June 14, 2026, version 4.2.2 of comfyui-manager is not available on PyPI [1]. The latest released version on PyPI is 4.2.1, which was published on April 22, 2026 [1]. Regarding version 4.2.1, it was released as a security-hardening update [2][3]. Key information regarding this release includes: Security Changes: The release introduced security-hardening measures related to Cross-Site Request Forgery (CSRF) protection, specifically by registering a server-push feature flag (extension.manager.supports_csrf_post) [2][3]. This allows clients to programmatically detect backend capability for POST-based state-mutation endpoints [2]. Breaking Changes: Version 4.2.1 includes "breaking-ish" API changes for state-mutating endpoints [2]. Users of programmatic clients are advised to review migration notes, as the update mandates that clients should treat the absence of the supports_csrf_post flag as an incompatibility with POST-only state-mutation endpoints [2]. Additionally, there were warnings during the development of 4.2.1 that incorrect ordering of frontend and backend updates could cause specific UI endpoints to break [3].

Citations:

• 1: https://pypi.org/project/comfyui-manager/
• 2: Comfy-Org/ComfyUI-Manager@01799f8
• 3: bump manager version to 4.2.1 #13516

---

Use an available version of comfyui_manager.

Version 4.2.2 does not exist on PyPI. The latest available version is 4.2.1 (released April 22, 2026). Update the requirement to use 4.2.1 or another valid version.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@manager_requirements.txt` at line 1, The comfyui_manager dependency is pinned
to version 4.2.2 which does not exist on PyPI. Update the version specification
for comfyui_manager to use 4.2.1 or another valid version that is available on
PyPI to ensure the dependency can be properly installed.