Here's what you need to know for this month, including the latest deployments.
Rebel Insights
- 🚨 Security Alert: In Part 2 of our series "Here Comes AI," we look at the critical bugs that landed in October and what to do about malicious agents going forward.
- ⚠️ AI Fact-checking: Google issued new guidance that makes AI fact-checking mandatory, a possible indicator on what upcoming spam updates may target.
- 🧱 Building a New Website: It's more difficult to get a new brand off the ground, so we rounded up some tips.
Added Action in Dashboard to Send Selected Posts to Evergreen's “Generate Insight”
A new bulk action lets users select multiple posts in the Post Dashboard and send them all to Evergreen’s “Generate Insight” feature at once. It’s gated behind the evergreen_dashboard feature flag for a controlled rollout.
Why It Matters: Previously, generating insights required entering one Post ID at a time. This streamlines the workflow for sites with the flag enabled, letting teams process multiple posts in a single action instead of one by one.
Fixed a Confusing Error When Deleting Cross-site Images
Deleting an image that was uploaded on a different site/runner than the one you’re viewing it from previously triggered a misleading error, even though the image was actually deleted. This stemmed from a recent security fix that correctly blocks cross-site image deletion, but didn’t pair that block with accurate messaging.
Why It Matters: Users now get accurate feedback on whether an image deletion succeeded or was blocked, removing confusion about whether an asset is still there or was actually removed.
AI Core Integrated With Entry Editor
Connects AI Core, a new product, directly into Entry Editor.
Why It Matters: Brings additional AI-assisted capabilities into the editing workflow.
AI Editorial Tools: Default Prompts Aligned With SEO Checklist Lengths
The default prompts for the Teaser, Social, and SEO headline AI tools now generate headlines in the lengths the SEO checklist recommends: 40-55 characters for teaser headlines, and 59-70 characters for both social and SEO headlines.
Why It Matters: Previously, the AI tools’ output didn’t match the SEO checklist (for example, teaser headlines came out under 45 characters, and social headlines had no length guidance), so editors saw checklist warnings on AI-generated copy. Suggestions now meet the checklist targets from the start.
Fixed Stale Pages After Redirects and Unpublishing on Mobile, Tablet, and Reverse-proxied Sites
Clearing a URL from the CDN cache (triggered by creating a redirect, unpublishing a post, or using the CMS “purge URL” button) only cleared the desktop version of the page. Mobile and tablet versions, and pages on reverse-proxied sites, kept serving old content. Purges now reach every device variant and reverse-proxied sites.
Why It Matters: Redirects and unpublished posts now take effect everywhere right away, instead of the old page lingering for days or even weeks on certain devices.
Native “Previous/Next post” Source for Post Page Layouts
Layouts can now request the previous and next posts relative to the current post directly from the platform, with the usual section and tag filters. It’s opt-in, so existing layouts are unchanged. The newest post has no “next” and the oldest has no “previous.”
Why It Matters: Previous/Next story navigation no longer requires a custom per-site function that could fail silently and leave empty cards on cached pages. Sites get reliable internal linking without per-site custom code or a cap on how many posts are considered.
Listing Pagination: Out-of-range Pages Now Return 404, Plus rel="prev/next" Links
Pagination URLs beyond the last page (e.g., ?page=999) used to return a normal page with an empty listing. They now return a 404. Component-based listings that use pagination also now include rel="prev" and rel="next" links in the page head.
Why It Matters: This removes endless thin, empty duplicate pages that search crawlers could follow, and gives search engines clearer signals about how paginated listings connect. Page 1 and pages that still have posts are unaffected.
Site Setting to Override the RebelBoost Analytics Origin
A new site extra, rebelboost_analytics_origin, lets admins specify which origin the Stats proxy uses to look up a site’s RebelBoost Analytics data, instead of always using the site’s domain.
Why It Matters: Sites whose tracker origin differs from their domain (for example, a www. variant) can now get their analytics to display correctly, without a per-site code change. Previously, a mismatch meant Stats came back empty.
Improved Page Revalidation After Saving Posts
Saving a post from Entry Editor, Dashboard, or Public API used to refresh the cached page for mobile, but it left the desktop version missing until a visitor rebuilt it. Each device’s refresh now only replaces its own cached version.
Why It Matters: Desktop pages stay cached after a save, so bots and visitors get a fast, stable page instead of every request being rebuilt from scratch. This improves performance and reduces origin load.
Fixed a Security Issue in the Template Engine
Resolved a security vulnerability in how the platform’s Handlebars templating compiles templates, closing a gap left by an earlier fix.
Why It Matters: Strengthens protection for sites and publishers against malicious template input, keeping the platform and its content secure.
Evergreen Dashboard: Change Checkboxes Now Start Unchecked in Review
When an editor opens Evergreen Review for a post, all of the suggested-change checkboxes now start unchecked, instead of preselected.
Why It Matters: Editors must look at each suggestion and deliberately choose which ones to accept, which prevents unwanted changes from being applied by accident.
Broken Links Dashboard No Longer Lists Drafts
Fixed the filtering logic so the Broken Links Dashboard stops showing broken links found in draft posts, which were still appearing after an earlier fix.
Why It Matters: Teams see only links on posts that matter, rather than sorting through draft noise, so it’s quicker to find and fix broken links on live content.
Bluesky oEmbed Support in Entry Editor
Editors can paste a Bluesky post URL (bsky.app/profile/{handle}/post/{id}) into Assembler and it automatically turns into a working embed, with no manual HTML needed. Invalid or malformed URLs fail gracefully without leaving a broken or partial embed in the post body.
Why It Matters: Embedding Bluesky posts is now as simple as pasting a link, matching the ease of other supported social embeds and removing the need to hunt down embed code.
Target Users by Custom Fields in WHO
In the Experiences WHO section, you can now target users by your site’s custom field values. Each rule is a field, an operator, and a value, and you can add as many rules as you need (the same field can repeat). Operators match the field type (e.g., text, URL, number, boolean, single-select, multi-select).
Why It Matters: Sites can now show the right experience to the right users based on their own data. For example, a paywall only for users whose Plan isn’t “pro,” or a survey only for newsletter opt-ins aged 18 or over.
Evergreen Review: Change Cards Now Line up With the Preview Text
In Evergreen Review, the change cards on the left now stay vertically aligned with their matching paragraphs in the right-hand preview. Before, the cards took up more vertical space than normal paragraphs, so the two sides drifted out of sync as you scrolled.
Why It Matters: Editors can compare each suggested change against the rewritten text without hunting for where it landed, which makes reviewing long articles faster and less error-prone.
Fixed a Deprecated AI Model Error Showing on Content Pages
Some content pages were showing an error notification saying an older GPT model had been deprecated. It appeared across multiple pages for one publisher, although no functional harm was found.
Why It Matters: Publishers and visitors no longer see an internal model-deprecation message on content pages, so the AI integrations run quietly in the background.
Reduced Oversized Page Data on Post Pages
The full bootstrap data file that some post pages load on demand was exporting every
Why It Matters: Lighter bootstrap data means faster loading and less strain on the origin server, especially for post pages built from layouts with several content sources.
Security Updates Across the Dashboard and Entry Editor
Resolved several critical dependency vulnerabilities in the React Dashboard and Entry Editor. These include an IP-spoofing issue in a networking library, a Handlebars template issue, and a Brotli compression issue.
Why It Matters: Keeps the platform’s administrative tools protected against known security risks, with no change to how they work day to day.
Find these updates helpful? Share with your team and have them sign up for monthly product updates.
