For AI agents: a documentation index is available at the root level at /llms.txt and /llms-full.txt. Append /llms.txt to any URL for a page-level index, or .md for the markdown version of any page.
Dev Portal
DocsAPI ReferenceLearnCommunityChangelog
DocsAPI ReferenceLearnCommunityChangelog
  • Overview
    • Quick Start
    • Sandboxes
    • Tools & SDKs
    • Support
  • Docs
      • Getting Started
        • Overview
          • 1.6.0
          • 1.5.0
          • 1.4.0
          • 1.3.7
          • 1.3.6
          • 1.3.5
          • 1.3.0
          • 1.2.0
    • Archive
    • Closed Beta Programs
Dev Portal
LogoLogo
On this page
  • Key Changes
  • Migration Guide
  • Release Tags
DocsStorefrontCatalystRelease Notes

Catalyst version 1.3.7 Release Notes

Was this page helpful?
Previous

1.4.0

Next

1.3.6

Built with

A high-severity Denial of Service (CVE-2025-55184) and a medium-severity Source Code Exposure (CVE-2025-55183) related to React Server Components have been disclosed affecting React versions 19.0. This includes Next.js which is used for internal applications at Commerce as well as customers building storefronts using Catalyst and Makeswift. To avoid exposure, Next.js and React need to be updated to their latest patched versions.

The initial fix was incomplete and did not fully prevent denial-of-service attacks for all payload types, resulting in CVE-2025-67779.

Important: This release provides an additional security patch for the same CVEs addressed in 1.3.6. You should upgrade to 1.3.7 to receive the latest security fixes.

Catalyst v1.3.7 release addresses these security vulnerabilities, including the additional CVE-2025-67779.

Key Changes

  • Next.js 15.5.9: Upgraded from Next.js 15.5.8 to 15.5.9
  • React 19: Upgraded to React 19.1.4 and React DOM 19.1.4

Migration Guide

1

Update Dependencies

Update dependencies in your package.json:

{
	"dependencies": {
		"next": "15.5.9",
		"react": "19.1.4",
		"react-dom": "19.1.4"
	},
	"devDependencies": {
		"@next/bundle-analyzer": "15.5.9",
		"eslint-config-next": "15.5.9"
	}
}
2

Run pnpm install

pnpm install

Note: next will automatically update your tsconfig.json file.

Release Tags

We have published new tags for the Core and Makeswift versions of Catalyst. Target these tags to pull the latest code:

  • @bigcommerce/catalyst-core@1.3.7
  • @bigcommerce/catalyst-makeswift@1.3.8

And as always, you can pull the latest stable release with these tags:

  • @bigcommerce/catalyst-core@latest
  • @bigcommerce/catalyst-makeswift@latest