comfyui-image-oasis@1.4.0 flagged by registry security scan (2 info-level false positives) - listing info missing

Hey, dev of comfyui-image-oasis here, following up on the flags for 1.4.0. Both are info level and I believe both are benign:

requirements.txt line 28 (contains_custom_url_dependency): the URL is inside a comment block that's explicitly labeled "Non-pip dependency (NOT installable here)". It's just documentation pointing users at city96's ComfyUI-GGUF custom node, which is optional and only needed for the GGUF source type. Nothing in the file actually installs from a URL, pip never touches that line. Happy to reword the comment to drop the raw URL in the next release if that keeps the scanner quiet.

web/image_oasis.js line 2362 (python_network_operations): this one looks like a false positive. The flagged code is the node's onAdded lifecycle override, it just calls the original handler and registers the widget. There's no network operation at that line, and it's JavaScript being matched by a Python rule. The only network calls in that file are fetches to ComfyUI's own local /api routes, which is standard for any DOM widget node.

Let me know what I need to do to get Image Oasis 1.4.0 to populate the Custom Node Manager correctly. Thanks!

Reproduce the registry security scan and listing behavior for comfyui-image-oasis 1.4.0, then inspect requirements.txt line 28 and web/image_oasis.js line 2362 in the submitted package. Confirm whether these info-level findings prevent the package from populating Custom Node Manager, and verify that the listing appears correctly once the false positives are handled.

Written by the indexing model from the issue text.