shadcn@4.13.1

jo-inc/camofox-browsershadcn@4.13.1Jul 17, 2026by github-actions[bot]

AI Summary

A security-focused patch release addressing credential leakage, path traversal, and flag injection vulnerabilities in the registry.

Key Highlights

Drop custom registry headers to prevent credential leakage
Validate file paths to prevent path traversal
Prevent flag injection from registry-supplied dependency strings

New Features

Add React Aria support
Enhanced security for registry installs

Full Release Notes

### Patch Changes

- [#11196](https://github.com/shadcn-ui/ui/pull/11196) [`c49c3061b5b86b130736d36bf20008349f89b416`](https://github.com/shadcn-ui/ui/commit/c49c3061b5b86b130736d36bf20008349f89b416) Thanks [@shadcn](https://github.com/shadcn)! - Drop custom registry headers on cross-origin redirects to prevent credential leakage.

- [#11191](https://github.com/shadcn-ui/ui/pull/11191) [`df2656111fc8ca030eb768ade2da26cef2fd11b5`](https://github.com/shadcn-ui/ui/commit/df2656111fc8ca030eb768ade2da26cef2fd11b5) Thanks [@shadcn](https://github.com/shadcn)! - Validate file paths for registry items without an explicit target to prevent path traversal.

- [#11195](https://github.com/shadcn-ui/ui/pull/11195) [`b8a8e9209659fa810514b61c60ad593bc81973f9`](https://github.com/shadcn-ui/ui/commit/b8a8e9209659fa810514b61c60ad593bc81973f9) Thanks [@shadcn](https://github.com/shadcn)! - Prevent flag injection from registry-supplied dependency strings during install.

- [#11208](https://github.com/shadcn-ui/ui/pull/11208) [`2b89d67e19ceda27381477e127b349f9aaa25355`](https://github.com/shadcn-ui/ui/commit/2b89d67e19ceda27381477e127b349f9aaa25355) Thanks [@shadcn](https://github.com/shadcn)! - Add React Aria support.