shadcn@4.13.1

VoltAgent/voltagentshadcn@4.13.1Jul 17, 2026by github-actions[bot]

AI Summary

This patch release introduces React Aria support alongside critical security updates to prevent credential leakage, path traversal, and flag injection.

Key Highlights

Added React Aria support
Fixed credential leakage on cross-origin redirects
Validated file paths to prevent path traversal
Prevented flag injection from registry-supplied dependencies

New Features

React Aria support

Full Release Notes

### Patch Changes

- [#11196](https://github.com/shadcn-ui/ui/pull/11196) [`c49c3061b5b86b130736d36bf20008349f89b416`](https://github.com/shadcn-ui/ui/commit/c49c3061b5b86b130736d36bf20008349f89b416) Thanks [@shadcn](https://github.com/shadcn)! - Drop custom registry headers on cross-origin redirects to prevent credential leakage.

- [#11191](https://github.com/shadcn-ui/ui/pull/11191) [`df2656111fc8ca030eb768ade2da26cef2fd11b5`](https://github.com/shadcn-ui/ui/commit/df2656111fc8ca030eb768ade2da26cef2fd11b5) Thanks [@shadcn](https://github.com/shadcn)! - Validate file paths for registry items without an explicit target to prevent path traversal.

- [#11195](https://github.com/shadcn-ui/ui/pull/11195) [`b8a8e9209659fa810514b61c60ad593bc81973f9`](https://github.com/shadcn-ui/ui/commit/b8a8e9209659fa810514b61c60ad593bc81973f9) Thanks [@shadcn](https://github.com/shadcn)! - Prevent flag injection from registry-supplied dependency strings during install.

- [#11208](https://github.com/shadcn-ui/ui/pull/11208) [`2b89d67e19ceda27381477e127b349f9aaa25355`](https://github.com/shadcn-ui/ui/commit/2b89d67e19ceda27381477e127b349f9aaa25355) Thanks [@shadcn](https://github.com/shadcn)! - Add React Aria support.