Changelog

September 11, 2026

Catalyst 1.11.1

Catalyst 1.11.1 is a patch release covering a Next.js security upgrade, date limits on product detail page date options, and a shared routing cache on BigCommerce Native Hosting.

  • Next.js security release — Next.js is upgraded from 16.2.11 to 16.3.4. 16.3.3 patches two critical advisories: unauthenticated remote code execution on Windows-hosted servers (GHSA-p293-qw3h-jr36), and unauthenticated remote code execution in the Image Optimization API when AVIF files are used (GHSA-2xp9-vwfh-vxw4). 16.3.4 re-enables AVIF image optimization after that fix.
  • Date option limits on the PDP — a Date modifier’s earliest date, latest date, and limit mode now disable out-of-range days in the product detail page date picker, instead of letting shoppers pick any date.
  • A shared routing cache on Native Hosting — proxies/with-routes now caches redirects and storefront status in a Cloudflare Workers KV namespace, instead of silently degrading to an in-process memory cache that is not shared across edge invocations. Vercel Runtime Cache still takes priority, with Upstash and memory as the remaining fallbacks.

See the full 1.11.1 release notes for details and release tags.

September 11, 2026

Checkout domains for Catalyst channels

Checkout is always served by BigCommerce, never by your Catalyst application, so the domain it runs on is channel configuration rather than anything in your storefront code. A new Checkout Domains page covers moving it onto a subdomain of your own storefront domain, and the Catalyst CLI reference now documents the commands that read and write it.

  • channels info — prints a channel’s storefront, canonical, and checkout URLs, and warns when checkout sits on a different main domain than the storefront. It is the default subcommand, so bare catalyst channels does the same thing.
  • channels update --checkout-url — sets the channel’s checkout URL, and --remove-checkout-url reverts to the shared checkout domain.
  • deploy --update-checkout-url — prompts for the checkout URL after a successful deploy, alongside the already-supported --update-site-url.
  • The same-main-domain requirement — BigCommerce rejects a checkout URL that does not share a main domain with the channel’s storefront URL, which is what keeps shopper sessions and carts carrying into checkout in browsers that restrict cross-domain cookies.
  • Channels on an auto-generated hostname — cannot take a custom checkout domain, because a certificate cannot be issued for a subdomain at that depth on a BigCommerce-managed zone. Those channels use the shared checkout domain, which is cross-domain from the storefront and best treated as a development setup.
  • catalyst domains add is not the command for this — it routes a domain to your Native Hosting project, and the project never serves checkout. The checkout domain is set on the channel, with a certificate provisioned on the BigCommerce side.

For details, see Checkout Domains.

September 11, 2026

Catalyst CLI 1.4.0

The Catalyst CLI (@bigcommerce/catalyst) reaches 1.4.0 with checkout domain support for channels, a substantial OpenNext Cloudflare adapter upgrade, and fixes to Windows builds, codegen, and credential handling.

  • Checkout domains for channels — catalyst channels info, now the default subcommand so bare catalyst channels does the same thing, prints a channel’s storefront, canonical, and checkout URLs. channels update gains --checkout-url and --remove-checkout-url, and deploy gains --update-checkout-url alongside --update-site-url. All of them warn when checkout sits on a different main domain than the storefront, which is where shopper sessions and carts stop carrying into checkout in browsers that restrict cross-domain cookies.
  • OpenNext Cloudflare adapter 1.17.3 to 1.20.6 — catalyst build and catalyst deploy now offer to update a project’s own @opennextjs/cloudflare pin when it has fallen behind the version the CLI targets, and reinstall so the worker compiles against it. That pin lives in the project’s package.json, so it previously stayed at whatever version the project was scaffolded with. The offer is skipped under --prebuilt and in non-interactive environments, which report the command to run instead. The range picked up includes a security fix for encoded paths bypassing middleware matching, a fix for /_next/static/* returning 404 on past deployments, and R2 cache population over remote dev, which is not subject to the Cloudflare API rate limit that failed builds for large catalogs.
  • Breaking: Node 20 is no longer supported — the engines range is now ^22.0.0 || ^24.0.0, because every Wrangler release the new adapter accepts requires Node 22 or later. In practice build and deploy already could not work on Node 20; what regresses is catalyst start.
  • build and deploy run GraphQL codegen — a fresh project no longer needs a manual pnpm build before its first deploy.
  • build and deploy work on native Windows — the generated open-next.config.ts hardcoded node_modules/.bin/next build, which OpenNext runs through cmd.exe, where the extensionless POSIX shim and forward-slash path fail to resolve. It now invokes node ./node_modules/next/dist/bin/next build, which works the same under both shells.
  • A CATALYST_ROUTES_KV namespace is bound at deploy — the generated Wrangler config binds the KV namespace backing the routing cache in proxies/with-routes, so it has a shared store on Native Hosting rather than a per-invocation in-memory cache. Pairs with the Cloudflare KV adapter in Catalyst 1.11.1.
  • catalyst create no longer writes CATALYST_ACCESS_TOKEN to .env.local — the CLI never read it back, so its only effect was to imply that env files supply CLI credentials, leading users to add CATALYST_STORE_HASH alongside it and then hit Missing credentials. .env.local now carries BIGCOMMERCE_* build variables only, and CLI configuration lives in .bigcommerce/project.json. Existing projects are unaffected; the stale entry is harmless and is left in place.

For details, see the Catalyst CLI reference.