shadcn@4.13.1

shadcn-ui/uishadcn@4.13.1Jul 17, 2026by github-actions[bot]

AI Summary

Adds React Aria support and implements several security hardening measures for registry operations.

Key Highlights

React Aria support added
Security: Dropped custom registry headers to prevent credential leakage
Security: Validated file paths to prevent path traversal
Security: Prevented flag injection from dependency strings

New Features

React Aria support
Security hardening

Full Release Notes

### Patch Changes

- [#11196](https://github.com/shadcn-ui/ui/pull/11196) [`c49c3061b5b86b130736d36bf20008349f89b416`](https://github.com/shadcn-ui/ui/commit/c49c3061b5b86b130736d36bf20008349f89b416) Thanks [@shadcn](https://github.com/shadcn)! - Drop custom registry headers on cross-origin redirects to prevent credential leakage.

- [#11191](https://github.com/shadcn-ui/ui/pull/11191) [`df2656111fc8ca030eb768ade2da26cef2fd11b5`](https://github.com/shadcn-ui/ui/commit/df2656111fc8ca030eb768ade2da26cef2fd11b5) Thanks [@shadcn](https://github.com/shadcn)! - Validate file paths for registry items without an explicit target to prevent path traversal.

- [#11195](https://github.com/shadcn-ui/ui/pull/11195) [`b8a8e9209659fa810514b61c60ad593bc81973f9`](https://github.com/shadcn-ui/ui/commit/b8a8e9209659fa810514b61c60ad593bc81973f9) Thanks [@shadcn](https://github.com/shadcn)! - Prevent flag injection from registry-supplied dependency strings during install.

- [#11208](https://github.com/shadcn-ui/ui/pull/11208) [`2b89d67e19ceda27381477e127b349f9aaa25355`](https://github.com/shadcn-ui/ui/commit/2b89d67e19ceda27381477e127b349f9aaa25355) Thanks [@shadcn](https://github.com/shadcn)! - Add React Aria support.