comfyui-vrm-pose-editor: 0.13.0+ flagged, latest_version stuck at 0.12.0 (manual review request)

**Publisher:** `statsu`
**Node:** `comfyui-vrm-pose-editor`
**Repo:** https://github.com/ketle-man/comfyui-vrm-pose-editor

### Problem

Every version since **0.13.0** has been flagged by the Registry security scan, so `latest_version` is frozen at **0.12.0** (published 2026-08-08). ComfyUI-Manager therefore offers no update — explicit `/install` of a specific version still works, but the normal update path (and the "latest" shown in Manager/Registry) delivers nothing newer than 0.12.0.

That gap now covers three releases (0.13.0, 0.13.1, and today's 0.14.0) and roughly a month of bug fixes and new features (Light & Pose Editor unified modal, keyframe timeline with pose/camera/shape-key animation, WebM/GIF export, etc.).

### Status from the public API

`GET https://api.comfy.org/nodes/comfyui-vrm-pose-editor/versions`

| Version | Status | Published |
|---|---|---|
| 0.14.0 | 🕓 Pending | 2026-09-03 |
| 0.13.1 | 🚩 Flagged | 2026-09-02 |
| 0.13.0 | 🚩 Flagged | 2026-08-26 |
| 0.12.0 | ✅ Active (= current `latest_version`) | 2026-08-08 |
| 0.11.0 and earlier | ✅ Active | — |

`latest_version.version` = **0.12.0**, `latest_version.status` = `NodeVersionStatusActive`.

### What changed at 0.13.0

0.13.0 added camera FOV/Near clip sliders — pure logic changes in `js/pose_editor_3d.js` / `js/pose_editor_core.js`, no new third-party dependency, no new network call, no new vendored library. I can't find anything in that diff that looks network-related.

I checked our own source (excluding the vendored Three.js/OrbitControls/GLTFLoader/three-vrm libraries under `js/vendor/`, which have been bundled unchanged since 0.1.x) for the pattern mentioned in #3059's later comments as a known false-positive source for `python_network_operations`:

$ grep -rn ".bind(|.connect(" --include=*.js js/ | grep -v js/vendor/
(no matches)

No `.bind(`/`.connect(` outside the vendored files. If the scanner also scans the vendor bundles (present unchanged since early Active releases), I don't understand why 0.12.0 and earlier passed but 0.13.0 onward did not.

There is also no `eval`/`exec`/`os.system`/`pickle`/`__import__`/`compile()` anywhere in the Python backend, and no `subprocess` usage at all.

### Ask

1. Manual review and activation of the 0.13.0–0.14.0 line (or at minimum 0.14.0, once its scan finishes), so `latest_version` advances and users receive the backlog.
2. If there's a specific pattern/file the scanner is catching, I'd like to know so I can address it directly — the version-status endpoint doesn't expose a `status_reason`, so I have nothing to work from on my side.

This looks like the same class of issue as #3059, #3085, #3111, and #3215 — all resolved (or explained) via manual review.

Start with GET https://api.comfy.org/nodes/comfyui-vrm-pose-editor/versions and compare the reported statuses for 0.13.0–0.14.0. Review the mentioned changes in js/pose_editor_3d.js and js/pose_editor_core.js, excluding js/vendor/, alongside related issues #3059, #3085, #3111, and #3215. Done means the flagged versions are manually reviewed or the scanner’s specific reason is identified and communicated.

Written by the indexing model from the issue text.