Version Packages (canary)

chanceaclark · chanceaclark · commit 0c93b6a851cf · 2026-05-13T11:21:36.000-06:00
diff --git a/.changeset/security-bump-nextjs-react.md b/.changeset/security-bump-nextjs-react.md
diff --git a/core/CHANGELOG.md b/core/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.6.3
+
+### Patch Changes
+
+- [#3007](https://github.com/bigcommerce/catalyst/pull/3007) [`13b3c2e`](https://github.com/bigcommerce/catalyst/commit/13b3c2e5c85bf47a07e999315a8f12988ab96d3f) Thanks [@chanceaclark](https://github.com/chanceaclark)! - Bump Next.js and React to address security vulnerabilities
+  - `next`: ~16.1.6 → ~16.2.6 — fixes middleware bypass, SSRF, XSS, and cache poisoning CVEs
+  - `react` / `react-dom`: 19.1.5 → 19.1.7 — fixes GHSA-rv78-f8rc-xrxh (DoS via OOM/CPU exhaustion on server function endpoints)
+
 ## 1.6.2
 
 ### Patch Changes
diff --git a/core/package.json b/core/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@bigcommerce/catalyst-core",
   "description": "BigCommerce Catalyst is a Next.js starter kit for building headless BigCommerce storefronts.",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "private": true,
   "engines": {
     "node": ">=24.0.0"

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@bigcommerce/catalyst-core",`
`3`	`3`	`"description": "BigCommerce Catalyst is a Next.js starter kit for building headless BigCommerce storefronts.",`
`4`		`- "version": "1.6.2",`
	`4`	`+ "version": "1.6.3",`
`5`	`5`	`"private": true,`
`6`	`6`	`"engines": {`
`7`	`7`	`"node": ">=24.0.0"`