Catalyst 1.10.1
Catalyst v1.10.1 is a patch release covering a Next.js security upgrade, a localization fix, and promotion callout styling.
- Next.js security release — Next.js is upgraded from 16.2.6 to 16.2.11 to pick up the July 2026 security release.
- Localized content after ISR revalidation — product, category, and brand content no longer falls back to the default language after revalidation.
generateMetadatafetched page data before callingsetRequestLocale, so during background regeneration next-intl could not resolve the locale and the default-locale response poisoned the memoized cache for the whole render. - Promotion callout styling — promotion callouts now use Storefront Kit’s built-in
warningvariant instead of custom Tailwind classes, bumpingstorefront-kitto^0.32.3so its stylesheet imports cleanly under Turbopack.
See the full 1.10.1 release notes for details and release tags.
Catalyst 1.11.0
Catalyst v1.11.0 is now available.
- Runtime locale subfolders — merchant-configured locale subfolders such as
/fr-frand/es-esare now read from BigCommerce at runtime and cached in KV, instead of being baked intobuild-config.jsonat build time. Incomplete locale data at build time no longer 404s every localized URL until the next deploy. - Breaking:
redirectandpermanentRedirectmoved — import them from~/i18n/navigation-serverinstead of~/i18n/routing, andawaitthem.i18n/locales.tsis removed. - Wallet payment buttons on the cart — the cart page now renders wallet payment buttons, such as PayPal, when payment wallets are configured, initialized through the BigCommerce Checkout SDK.
- Inventory accuracy — the PDP disables Add to Cart and shows an error when the requested quantity exceeds available-to-sell, and the cart’s “ready to ship” message now appears only when part of the line item is backordered.
- Session, consent, and SEO fixes — session cookies are now actually deleted on logout, consent-gated cookies work on stores with cookie consent disabled, the product
og:imageno longer emits an unfetchable placeholder URL, and Account Registration hides State/Province for countries that have none. - Cache behavior — entries in the in-memory KV layer now expire after 60 seconds and its capacity rises from 500 to 4096, so processes pick up values the shared store already holds instead of each refetching from the origin.
See the full 1.11.0 release notes for migration details and release tags.
Catalyst CLI 1.3.0
The Catalyst CLI (@bigcommerce/catalyst) reaches 1.3.0 with plural resource commands, DNS record output on domains add, dependency-aware upgrades, and a set of native hosting caching fixes.
- Plural resource commands —
catalyst projectis nowcatalyst projectsandcatalyst channelis nowcatalyst channels, matching the already-pluraldomainsandlogs. The singular form of every resource command remains as an alias, so existing scripts keep working. domains addprints DNS records — the A and CNAME values that point the domain at the project are shown with the success message, along with which to publish and a note that they are only returned when the domain is added. The records survive--wait.catalyst upgrademoves@bigcommerce/catalyst*versions — dependency bumps now travel through the upgrade merge like any otherpackage.jsonchange, and projects still onworkspace:^get an opt-in prompt to swap to published versions.logs tail --format requestprints every request — including requests that emitted no log messages, which previously disappeared from the stream. The format now reads[timestamp] METHOD URL (status) [LEVEL] messagein bothlogs tailandlogs query.- No re-login after
catalyst create— credentials from the initial authentication are written to the new project’s.bigcommerce/project.jsonon every scaffold, not just--hosting commerce. catalyst deploypreserves stored environment variables — Commerce Hosting setup rebuilt.bigcommerce/project.jsonfrom scratch, silently discarding theenvblock, the persistedapiHost, and stored credentials. Setup now merges into the existing file.- Immutable caching for static assets — builds now ship a
_headersfile, so content-hashed files under/_next/static/*are servedpublic,max-age=31536000,immutableinstead of being revalidated on every repeat page view. - Correct cache invalidation on native hosting — a non-functional CDN cache purge is replaced by tag checking on regional cache hits, so
revalidateTagnow takes effect there. ISR revalidation also moves from a Durable Object queue, which cannot bind on native hosting, to a self-fetch queue.
For details, see the Catalyst CLI reference.
Product page titles and meta descriptions follow the shopper’s language
Thanks to user feedback, translated SEO fields now render on multi-language Stencil storefronts. Product page titles and meta descriptions previously stayed in the channel’s default language even when a shopper selected a different one.
- Page Title — the
pageTitletranslation for the shopper’s active language now renders in the page<title>and the browser tab - Meta Description — the
metaDescriptiontranslation for the shopper’s active language now renders in<meta name="description"> - Single-language stores — unaffected, as are multi-language stores viewed in their default language
We are beginning to roll this out, so you may notice product page titles and meta descriptions change over the coming weeks. Search engines re-index the updated values as they recrawl.
For details, see Translations for Products.
Rewritten single-click app tutorial
The single-click app tutorial is rebuilt around a new Next.js starter app that takes you from a mock-data UI to a fully authenticated, multitenant app storing encrypted per-store tokens.
- Modernized stack — the tutorial and its starter app use the Next.js App Router, React 19, BigDesign 5, pnpm, and Node.js 24, replacing the previous sample app.
- Dependency-free local setup — SQLite is the default credentials store, created automatically as a local file, so there is no external database to provision before the first install.
- Production-ready patterns — stored access tokens are encrypted at rest, the app’s own session cookie is signed separately from BigCommerce’s inbound signed payloads, and the OAuth
redirect_uriis pinned to a configured origin rather than derived from the request. - Hosting support - scaffolding and a Postgres driver that makes the app ready for deployment to Vercel.
- Flexible development and deployment — three data modes (
MOCK,STATIC,MULTITENANT) let you build the UI before wiring up auth, and a pluggable credentials-store driver swaps SQLite for a production driver when you deploy. - Five-part structure — build a BigDesign UI, integrate BigCommerce data, add single-click authentication, manage sessions, and persist to a database, building a working gift certificates manager throughout.
- Refreshed Quick Start — the Apps Quick Start now covers the new starter app’s setup: pnpm and Node.js 24, the
/api/app/*callback URLs, the environment variables that replace the old database and JWT settings, and the OAuth scopes the app requires. - Updated app extensions guide — the App Extensions guide no longer repeats the draft app setup steps, and instead focuses on creating an app profile before linking to the Quick Start.
- Sample app references updated — 14 pages across the apps guides, app extensions docs, and tools and SDKs list now point to the new starter app repository in place of the retired
sample-app-nodejs.
For details, see the single-click app tutorial and the Apps Quick Start.