shadcn@4.13.1

itszeeshan/subdomainxshadcn@4.13.1Jul 17, 2026by github-actions[bot]

AI Summary

This patch release prioritizes security by preventing credential leakage and path traversal, while adding React Aria support for better accessibility.

Key Highlights

Security hardening: prevented credential leakage and path traversal
Protection against flag injection during installation
Integration of React Aria for accessibility

New Features

React Aria support
Security fixes for registry redirects and path validation

Full Release Notes

### Patch Changes

- [#11196](https://github.com/shadcn-ui/ui/pull/11196) [`c49c3061b5b86b130736d36bf20008349f89b416`](https://github.com/shadcn-ui/ui/commit/c49c3061b5b86b130736d36bf20008349f89b416) Thanks [@shadcn](https://github.com/shadcn)! - Drop custom registry headers on cross-origin redirects to prevent credential leakage.

- [#11191](https://github.com/shadcn-ui/ui/pull/11191) [`df2656111fc8ca030eb768ade2da26cef2fd11b5`](https://github.com/shadcn-ui/ui/commit/df2656111fc8ca030eb768ade2da26cef2fd11b5) Thanks [@shadcn](https://github.com/shadcn)! - Validate file paths for registry items without an explicit target to prevent path traversal.

- [#11195](https://github.com/shadcn-ui/ui/pull/11195) [`b8a8e9209659fa810514b61c60ad593bc81973f9`](https://github.com/shadcn-ui/ui/commit/b8a8e9209659fa810514b61c60ad593bc81973f9) Thanks [@shadcn](https://github.com/shadcn)! - Prevent flag injection from registry-supplied dependency strings during install.

- [#11208](https://github.com/shadcn-ui/ui/pull/11208) [`2b89d67e19ceda27381477e127b349f9aaa25355`](https://github.com/shadcn-ui/ui/commit/2b89d67e19ceda27381477e127b349f9aaa25355) Thanks [@shadcn](https://github.com/shadcn)! - Add React Aria support.