# Changelog Roundup for November 2, 2026

> Content from operator nodes is now checked against a record made at upload. Also this week: encrypted portal deploys work again, Level 1 share links open, and portal deploys can convert images.

Published: November 2, 2026 · Author: John Federico · Category: Updates · Tags: roundup, changelog

Source: https://blog.evolvingedge.ai/post/changelog-roundup-2026-11-02/

The most important change this week is a security fix for operators and customers: every piece of a site that comes from an operator node is now checked against a record that nodes can't forge. **We made this fix proactively, and no incident has occurred.**

## For node operators

[Content from your node is now checked against a record it can't forge](https://changelog.evolvingedge.ai/2026-10-01-peer-content-checked-against-a-digest/). Until now, gateways and browsers checked the content a node sent against a description that the same node supplied. Now each block is checked against a digest recorded when the site was uploaded. A block that doesn't match is thrown away and fetched from the gateway instead. Browsers no longer accept a whole file from a node, only blocks they can check one by one. Some Level 1 sites don't have this record yet, so the gateway serves them and your node won't deliver them. You don't need to do anything.

**No incident of this has occurred. This is a proactive security fix.**

## For customers

[Gateways and browsers now check every block from an operator node against a digest recorded when you uploaded your site](https://changelog.evolvingedge.ai/2026-10-01-peer-content-checked-against-a-digest/). Before, a node could have sent altered content along with a description that matched it. Most sites already have the digest. A Level 1 site deployed from the portal before 26 October doesn't, so it's served from the gateway only until you deploy it again. Level 1 sites deployed with `ee-cdn-cli` don't send the digest yet and are also served from the gateway only. Nothing breaks.

**No incident of this has occurred. This is a proactive security fix.**

[Level 1 and Level 2 deploys from the portal work again](https://changelog.evolvingedge.ai/2026/10/portal-encrypted-deploys-work-again/). Since late September, every one of them failed with "body is not a .ee container". Level 0 deploys and `ee-cdn-cli` weren't affected. If one of these deploys failed for you, deploy the site again and save the key when it's shown, because we show it only once and can't recover it. Level 1 deploys now also send your site's integrity record. If the record isn't accepted, your site still goes online, and a warning tells you to deploy again.

[Level 1 sites without their own domain now open from their share link, images included](https://changelog.evolvingedge.ai/2026/10/level-1-share-links-open/). Before, the gateway refused the page. Links you've already shared still work, even without the trailing slash. On a first visit the page reloads once so its images can be decrypted. You don't need to deploy again.

[Portal deploys can now convert your JPEG and PNG images to WebP or AVIF](https://changelog.evolvingedge.ai/2026/10/portal-image-conversion/). To use it, turn on Image Conversion on a deployment target. Each deploy then converts your images and updates every reference to them before it deploys. Only the deployed files change, never the ones you uploaded. The format and PNG setting in the form override your `ee.jsonc`. The portal doesn't scale down wide images.

[A new deploy Action runs `ee-cdn-cli` as a single step in your build workflow](https://changelog.evolvingedge.ai/2026/10/github-action-deploy/). It works even for sites built with static site generators that don't use Node, and its inputs match the CLI's options. The step holds your deploy token, so pin an exact release such as v1.0.1. It deploys Level 0 and Level 2 sites, and it refuses Level 1 sites since Level 1 is designed so that no machine holds the key.

[Cache warming no longer counts toward your site's requests](https://changelog.evolvingedge.ai/2026/10/cache-warming-not-counted-as-requests/). Since 22 October, background fetches by visitors' browsers count only toward bandwidth. Real visits are counted exactly as before.

For everything else, see the [full changelog](https://changelog.evolvingedge.ai).