DocsStorefrontCatalystRelease Notes

Catalyst version 1.11.1 release notes

Catalyst 1.11.1 is a patch release. It upgrades Next.js to pick up two critical security advisories, makes product detail page date options respect the date limits set in the control panel, and replaces the routing cache’s in-process fallback with a shared Cloudflare Workers KV store on BigCommerce Native Hosting. For a full list of Catalyst changes, see the changeset on GitHub.

Next.js security release

Next.js is upgraded from 16.2.11 to 16.3.4.

16.3.3 patches two critical advisories:

  • GHSA-p293-qw3h-jr36 — unauthenticated remote code execution on Windows-hosted servers.
  • GHSA-2xp9-vwfh-vxw4 — unauthenticated remote code execution in the Image Optimization API when AVIF files are used.

16.3.4 re-enables AVIF image optimization, which the fix for the second advisory had turned off.

The upgrade also picks up backported fixes for optimistic-routing bugs that caused repeated prefetch loops, a Nav Inspector request loop on repeat captures, and cache-entry reuse that discarded only entries predating a tag revalidation rather than all of them.

Date option limits on product detail pages

A product’s Date modifier can set an earliest date, a latest date, or both, along with a limit mode that selects which of those apply. The product detail page date picker ignored all of it and accepted any date a shopper chose.

Out-of-range days are now disabled in the picker, following the earliest date, latest date, and limit mode configured in the control panel.

Routing cache on Native Hosting

proxies/with-routes caches redirects and storefront status through the KV abstraction in lib/kv. That abstraction had no Cloudflare option, so on Native Hosting it silently degraded to an in-process memory cache, which is not shared across edge invocations and so was repopulated far more often than intended.

When the per-project CATALYST_ROUTES_KV namespace is bound to the Worker, createKVAdapter now selects a CloudflareKvAdapter. Vercel Runtime Cache still takes priority where it is present, and Upstash and memory remain the fallbacks. The binding is duck-typed, so an unrelated environment variable of the same name falls through cleanly instead of throwing.

The namespace is bound at deploy time by the Catalyst CLI from version 1.4.0 onward.

Release tags

Latest stable: