> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

## Catalyst 1.11.1

Catalyst 1.11.1 is a patch release covering a Next.js security upgrade, date limits on product detail page date options, and a shared routing cache on BigCommerce Native Hosting.

* **Next.js security release** — Next.js is upgraded from 16.2.11 to 16.3.4. 16.3.3 patches two critical advisories: unauthenticated remote code execution on Windows-hosted servers ([GHSA-p293-qw3h-jr36](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36)), and unauthenticated remote code execution in the Image Optimization API when AVIF files are used ([GHSA-2xp9-vwfh-vxw4](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4)). 16.3.4 re-enables AVIF image optimization after that fix.
* **Date option limits on the PDP** — a Date modifier's earliest date, latest date, and limit mode now disable out-of-range days in the product detail page date picker, instead of letting shoppers pick any date.
* **A shared routing cache on Native Hosting** — `proxies/with-routes` now caches redirects and storefront status in a Cloudflare Workers KV namespace, instead of silently degrading to an in-process memory cache that is not shared across edge invocations. Vercel Runtime Cache still takes priority, with Upstash and memory as the remaining fallbacks.

See the full [1.11.1 release notes](/developer/docs/storefront/catalyst/release-notes/1-11-1) for details and release tags.