Catalyst 1.10.1

Catalyst v1.10.1 is a patch release covering a Next.js security upgrade, a localization fix, and promotion callout styling.

  • Next.js security release — Next.js is upgraded from 16.2.6 to 16.2.11 to pick up the July 2026 security release.
  • Localized content after ISR revalidation — product, category, and brand content no longer falls back to the default language after revalidation. generateMetadata fetched page data before calling setRequestLocale, so during background regeneration next-intl could not resolve the locale and the default-locale response poisoned the memoized cache for the whole render.
  • Promotion callout styling — promotion callouts now use Storefront Kit’s built-in warning variant instead of custom Tailwind classes, bumping storefront-kit to ^0.32.3 so its stylesheet imports cleanly under Turbopack.

See the full 1.10.1 release notes for details and release tags.


Catalyst 1.11.0

Catalyst v1.11.0 is now available.

  • Runtime locale subfolders — merchant-configured locale subfolders such as /fr-fr and /es-es are now read from BigCommerce at runtime and cached in KV, instead of being baked into build-config.json at build time. Incomplete locale data at build time no longer 404s every localized URL until the next deploy.
  • Breaking: redirect and permanentRedirect moved — import them from ~/i18n/navigation-server instead of ~/i18n/routing, and await them. i18n/locales.ts is removed.
  • Wallet payment buttons on the cart — the cart page now renders wallet payment buttons, such as PayPal, when payment wallets are configured, initialized through the BigCommerce Checkout SDK.
  • Inventory accuracy — the PDP disables Add to Cart and shows an error when the requested quantity exceeds available-to-sell, and the cart’s “ready to ship” message now appears only when part of the line item is backordered.
  • Session, consent, and SEO fixes — session cookies are now actually deleted on logout, consent-gated cookies work on stores with cookie consent disabled, the product og:image no longer emits an unfetchable placeholder URL, and Account Registration hides State/Province for countries that have none.
  • Cache behavior — entries in the in-memory KV layer now expire after 60 seconds and its capacity rises from 500 to 4096, so processes pick up values the shared store already holds instead of each refetching from the origin.

See the full 1.11.0 release notes for migration details and release tags.


Catalyst CLI 1.3.0

The Catalyst CLI (@bigcommerce/catalyst) reaches 1.3.0 with plural resource commands, DNS record output on domains add, dependency-aware upgrades, and a set of native hosting caching fixes.

  • Plural resource commandscatalyst project is now catalyst projects and catalyst channel is now catalyst channels, matching the already-plural domains and logs. The singular form of every resource command remains as an alias, so existing scripts keep working.
  • domains add prints DNS records — the A and CNAME values that point the domain at the project are shown with the success message, along with which to publish and a note that they are only returned when the domain is added. The records survive --wait.
  • catalyst upgrade moves @bigcommerce/catalyst* versions — dependency bumps now travel through the upgrade merge like any other package.json change, and projects still on workspace:^ get an opt-in prompt to swap to published versions.
  • logs tail --format request prints every request — including requests that emitted no log messages, which previously disappeared from the stream. The format now reads [timestamp] METHOD URL (status) [LEVEL] message in both logs tail and logs query.
  • No re-login after catalyst create — credentials from the initial authentication are written to the new project’s .bigcommerce/project.json on every scaffold, not just --hosting commerce.
  • catalyst deploy preserves stored environment variables — Commerce Hosting setup rebuilt .bigcommerce/project.json from scratch, silently discarding the env block, the persisted apiHost, and stored credentials. Setup now merges into the existing file.
  • Immutable caching for static assets — builds now ship a _headers file, so content-hashed files under /_next/static/* are served public,max-age=31536000,immutable instead of being revalidated on every repeat page view.
  • Correct cache invalidation on native hosting — a non-functional CDN cache purge is replaced by tag checking on regional cache hits, so revalidateTag now takes effect there. ISR revalidation also moves from a Durable Object queue, which cannot bind on native hosting, to a self-fetch queue.

For details, see the Catalyst CLI reference.


Product page titles and meta descriptions follow the shopper’s language

Thanks to user feedback, translated SEO fields now render on multi-language Stencil storefronts. Product page titles and meta descriptions previously stayed in the channel’s default language even when a shopper selected a different one.

  • Page Title — the pageTitle translation for the shopper’s active language now renders in the page <title> and the browser tab
  • Meta Description — the metaDescription translation for the shopper’s active language now renders in <meta name="description">
  • Single-language stores — unaffected, as are multi-language stores viewed in their default language

We are beginning to roll this out, so you may notice product page titles and meta descriptions change over the coming weeks. Search engines re-index the updated values as they recrawl.

For details, see Translations for Products.


Rewritten single-click app tutorial

The single-click app tutorial is rebuilt around a new Next.js starter app that takes you from a mock-data UI to a fully authenticated, multitenant app storing encrypted per-store tokens.

  • Modernized stack — the tutorial and its starter app use the Next.js App Router, React 19, BigDesign 5, pnpm, and Node.js 24, replacing the previous sample app.
  • Dependency-free local setup — SQLite is the default credentials store, created automatically as a local file, so there is no external database to provision before the first install.
  • Production-ready patterns — stored access tokens are encrypted at rest, the app’s own session cookie is signed separately from BigCommerce’s inbound signed payloads, and the OAuth redirect_uri is pinned to a configured origin rather than derived from the request.
  • Hosting support - scaffolding and a Postgres driver that makes the app ready for deployment to Vercel.
  • Flexible development and deployment — three data modes (MOCK, STATIC, MULTITENANT) let you build the UI before wiring up auth, and a pluggable credentials-store driver swaps SQLite for a production driver when you deploy.
  • Five-part structure — build a BigDesign UI, integrate BigCommerce data, add single-click authentication, manage sessions, and persist to a database, building a working gift certificates manager throughout.
  • Refreshed Quick Start — the Apps Quick Start now covers the new starter app’s setup: pnpm and Node.js 24, the /api/app/* callback URLs, the environment variables that replace the old database and JWT settings, and the OAuth scopes the app requires.
  • Updated app extensions guide — the App Extensions guide no longer repeats the draft app setup steps, and instead focuses on creating an app profile before linking to the Quick Start.
  • Sample app references updated — 14 pages across the apps guides, app extensions docs, and tools and SDKs list now point to the new starter app repository in place of the retired sample-app-nodejs.

For details, see the single-click app tutorial and the Apps Quick Start.