# Changelog Roundup for October 26, 2026 > Three proactive security fixes for operators and customers, with no incident. Also this week: visitors are offered the fastest operator nodes, browsers keep and prefetch node files, and ee-cdn-cli can convert and scale images. Published: October 26, 2026 · Author: John Federico · Category: Updates · Tags: roundup, changelog Source: https://blog.evolvingedge.ai/post/changelog-roundup-2026-10-26/ The most important changes this week are three security fixes that affect operators and customers alike. **We made all three proactively, and no incident has occurred.** If you run a node and have Remote Config enabled, you'll receive the update automatically. Otherwise, update to v0.0.128 or later to pick up everything below. ## For node operators [Only operator nodes and Evolving Edge Regional Gateways can now connect to the control plane's tracker](https://changelog.evolvingedge.ai/2026/10/tracker-known-nodes-only/). Until now, a page without a list of nodes could find them through the tracker and take pieces from any client that answered. Browsers no longer use the tracker, and a page without a node list is now served by the Regional Gateway. Update to v0.0.122 or later to keep your tracker connection. Older nodes are refused and keep retrying, but what they do for visitors isn't affected. [A node can no longer check in as another node or advertise addresses it wasn't asked for](https://changelog.evolvingedge.ai/2026/10/nodes-cant-pose-as-other-nodes/). The control plane now refuses a check-in whose credential wasn't issued for the node it names. From v0.0.127, a node ignores replies about where content is held unless they answer a question it asked. If you've set `NODE_ID` by hand, remove it, or your node will be refused on every check-in. [Regional Gateways now offer visitors the operator nodes most likely to deliver fastest](https://changelog.evolvingedge.ai/2026/10/fastest-operator-nodes-offered/). Each visitor requests content from up to four nodes. The nodes with the best latency for nearby visitors come first, and one slot goes to a node that hasn't been measured yet. Each Regional Gateway sends your node a small `/health` request every minute. After two failed checks in a row your node is no longer offered, unless browsers can reach it over WebRTC. Make sure your node is reachable from the internet or over WebRTC. Check your node profile in your dashboard to be sure. [Nodes that open their port with UPnP now stay reachable after the first hour](https://changelog.evolvingedge.ai/2026/10/upnp-mappings-renewed/). The TCP mapping via UPnP lapsed after an hour, and on older routers the UDP mapping lapsed too, which could quietly take your node off the target list. From v0.0.124, both mappings are renewed every 30 minutes, and the startup log shows which ones worked. [Connected browsers now measure latency on each edge node](https://changelog.evolvingedge.ai/2026/10/latency-checks-and-prefetch/) by fetching a site's two smallest blocks every 10 minutes. Connected browsers may also fetch files from your node in the background. Both count toward your node's speed measurement. [Nodes can save their settings again when `settings.json` is in a folder they can't write to](https://changelog.evolvingedge.ai/2026/10/node-settings-save-again/). In v0.0.127, those saves failed, and a read-only `settings.json` could be replaced. Update to v0.0.128 or later. If you have Remote Config enabled, the update happens automatically. ## For customers [Another account can no longer take over your deployed site or bind your domain](https://changelog.evolvingedge.ai/2026/10/sites-and-domains-stay-yours/). Re-uploading a copy of someone else's site could make the upload its owner, and a portal deploy could bind a domain another customer had claimed. Both gaps have been proactively closed since 15 October. The first project to upload a site's content owns it. A portal deploy that the control plane refuses now fails with the reason, where before it reported success. [Visitors' browsers now connect only to operator nodes we know](https://changelog.evolvingedge.ai/2026/10/tracker-known-nodes-only/). Your content was never at risk of being altered, because every piece is checked against the record made when you uploaded your site. [Visitors are now offered the operator nodes most likely to deliver fastest](https://changelog.evolvingedge.ai/2026/10/fastest-operator-nodes-offered/). Nodes their browsers can't reach are left out. Pages still come from the Regional Gateway, as do any files a node can't deliver for whatever reason. [Browsers now cache files from operator nodes and fetch the next pages' files early](https://changelog.evolvingedge.ai/2026/10/browsers-keep-node-files/). Stored files belong to one deploy, so visitors never see stale copies after you deploy again. When the browser is idle, it reads up to four linked pages and fetches up to 2 MB of the files they use, every 30 minutes. That means up to four extra page requests to your site per visit. Nothing is fetched early when the visitor has Data Saver on or is on a 2G-class mobile wireless connection. [`ee-cdn-cli` 0.4.0 can convert images to WebP or AVIF and scale down oversized photos](https://changelog.evolvingedge.ai/2026/10/cli-image-conversion/). Both options are off unless you add `--images` or `--image-max-width` to your deploy command, and they change only the files that are deployed. Portal deploys don't support them yet. If you've pinned an older version, pin `:latest` or remove the pin. [Portal deploys now read `ee.jsonc` files with comments and trailing commas](https://changelog.evolvingedge.ai/2026/10/ee-jsonc-comments-and-trailing-commas/). Before, those files were silently ignored. Now a file that is really broken fails the deploy and names the line. Check your `ee.jsonc`, because settings that were being ignored take effect on your next portal deploy. For everything else, see the [full changelog](https://changelog.evolvingedge.ai).