> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# Catalyst version 1.11.1 release notes

> Catalyst 1.11.1 upgrades Next.js to pick up two critical remote code execution advisories, applies control panel date limits to the PDP date picker, and gives the routing cache a shared Cloudflare Workers KV store on Native Hosting.

Catalyst 1.11.1 is a patch release. It upgrades Next.js to pick up two critical security advisories, makes product detail page date options respect the date limits set in the control panel, and replaces the routing cache's in-process fallback with a shared Cloudflare Workers KV store on BigCommerce Native Hosting. For a full list of Catalyst changes, see the [changeset on GitHub](https://github.com/bigcommerce/catalyst/blob/canary/core/CHANGELOG.md#1111).

## Next.js security release

Next.js is upgraded from 16.2.11 to 16.3.4.

16.3.3 patches two critical advisories:

* [GHSA-p293-qw3h-jr36](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36) — unauthenticated remote code execution on Windows-hosted servers.
* [GHSA-2xp9-vwfh-vxw4](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4) — unauthenticated remote code execution in the Image Optimization API when AVIF files are used.

16.3.4 re-enables AVIF image optimization, which the fix for the second advisory had turned off.

The upgrade also picks up backported fixes for optimistic-routing bugs that caused repeated prefetch loops, a Nav Inspector request loop on repeat captures, and cache-entry reuse that discarded only entries predating a tag revalidation rather than all of them.

## Date option limits on product detail pages

A product's Date modifier can set an earliest date, a latest date, or both, along with a limit mode that selects which of those apply. The product detail page date picker ignored all of it and accepted any date a shopper chose.

Out-of-range days are now disabled in the picker, following the earliest date, latest date, and limit mode configured in the control panel.

## Routing cache on Native Hosting

`proxies/with-routes` caches redirects and storefront status through the KV abstraction in `lib/kv`. That abstraction had no Cloudflare option, so on Native Hosting it silently degraded to an in-process memory cache, which is not shared across edge invocations and so was repopulated far more often than intended.

When the per-project `CATALYST_ROUTES_KV` namespace is bound to the Worker, `createKVAdapter` now selects a `CloudflareKvAdapter`. Vercel Runtime Cache still takes priority where it is present, and Upstash and memory remain the fallbacks. The binding is duck-typed, so an unrelated environment variable of the same name falls through cleanly instead of throwing.

The namespace is bound at deploy time by the Catalyst CLI from version 1.4.0 onward.

## Release tags

* [**@bigcommerce/catalyst-core@1.11.1**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-core%401.11.1)
* [**@bigcommerce/create-catalyst@2.0.5**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcreate-catalyst%402.0.5)

Latest stable:

* [**@bigcommerce/catalyst-core@latest**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-core%40latest)
* [**@bigcommerce/catalyst-makeswift@latest**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-makeswift%40latest)