> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# Catalyst version 1.3.5 Release Notes

This Catalyst v1.3.5 release addresses a **critical security vulnerability ([CVE-2025-55182](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components))** that affects React Server Components.

## Key Changes

* **Next.js 15.5.7**: Upgraded from Next.js 15.5.1-canary.4 to 15.5.7 (no more canary)
* **React 19**: Upgraded to React 19.1.2 and React DOM 19.1.2
* **Partial Prerendering (PPR) Removed**: Removed partial prerendering as it's unsupported in non-canary versions of Next.js 15.

## Next.js 15.5.7 Upgrade

Catalyst has been upgraded to Next.js 15.5.7. This upgrade moves from the canary release to the stable release and requires [migration steps](#migration-guide) for existing stores to fix a security vulnerability.

## Critical Security Update

**This upgrade addresses a critical security vulnerability ([CVE-2025-55182](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components))** that affects React Server Components. The vulnerability allowed unauthenticated remote code execution on servers running React Server Components. This upgrade includes:

* Next.js 15.5.7 with the security patch

> **Note**
>
> All users are strongly encouraged to upgrade immediately.

## Partial Prerendering (PPR) Removed

> **Note**
>
> **Important**: PPR (Partial Prerendering) has been **removed** in this
> release. PPR was only available in the Next.js 15.5.1-canary.4 release and is
> not supported in the stable 15.5.7 release.

* The `ppr` experimental flag has been removed from `next.config.ts`
* This may result in different performance characteristics compared to the Next.js 15.5.1-canary.4 + PPR setup

## Migration Guide

### Step 1: Update Dependencies

If you're maintaining a custom Catalyst store, update your `package.json`:

```json showLineNumbers={false}
{
	"dependencies": {
		"next": "15.5.7",
		"react": "^19.1.2",
		"react-dom": "^19.1.2"
	},
	"devDependencies": {
		"@next/bundle-analyzer": "15.5.7",
		"eslint-config-next": "15.5.7"
	}
}
```

Then run:

```bash showLineNumbers={false}
pnpm install
```

> **Note**
>
> **Note**: `next` will automatically update your `tsconfig.json` file.

### Step 2: Update next.config.ts

Remove or comment out PPR configuration:

```typescript showLineNumbers={false}
// Remove or disable:
// experimental: {
//   ppr: 'incremental',
// }
```

Remove or comment out eslint config

```typescript showLineNumbers={false}
// eslint: {
//     ignoreDuringBuilds: !!process.env.CI,
//     dirs: [
//     'app',
//     'auth',
//     'build-config',
//     'client',
//     'components',
//     'data-transformers',
//     'i18n',
//     'lib',
//     'middlewares',
//     'scripts',
//     'tests',
//     'vibes',
//     ],
// },
```

### Step 3: Remove `experimental_ppr` flag

Remove all `export const experimental_ppr` declarations from your codebase, regardless of whether they are set to `true` or `false`.

## Release Tags

We have published new tags for the Core and Makeswift versions of Catalyst. Target these tags to pull the latest code:

* [**@bigcommerce/catalyst-core@1.3.5**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-core%401.3.5)
* [**@bigcommerce/catalyst-makeswift@1.3.6**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-makeswift%401.3.6)

And as always, you can pull the latest stable release with these tags:

* [**@bigcommerce/catalyst-core@latest**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-core%40latest)
* [**@bigcommerce/catalyst-makeswift@latest**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-makeswift%40latest)