← All reportsPublic report

shadcn-ui/ui

A set of beautifully-designed, accessible components and a code distribution platform. Works with your favorite frameworks. Open Source. Open Code.

122k stars TypeScript View on GitHubprofiled 11d ago
Try GitZoid
112PRs this week
71Contributors
36Deps scanned
1Issues found
01 · Repo overview

How ui is put together

This is the shadcn/ui monorepo, a pnpm + Turborepo workspace that builds the shadcn CLI, the ui.shadcn.com documentation site, and supporting packages. The primary language is TypeScript with React; apps/v4 is a Next.js (canary) app using Tailwind CSS v4, Fumadocs MDX for docs content, and a large component registry under apps/v4/registry. The shadcn package is a Node.js CLI (commander-based) that fetches registry items over HTTP and writes them into user projects, plus an MCP server built on @modelcontextprotocol/sdk. Published packages (@shadcn/react, @shadcn/helpers) are bundled with tsup as ESM. No databases or server-side datastores are present; the site is largely static/docs-driven.

Languages

TypeScriptTSX/ReactMDXCSS

Frameworks

Next.js (16.3.0-canary.97)React 19Tailwind CSS v4Fumadocs (core/mdx/ui)Vite/VitestTurborepo

Infrastructure

Vercel Analytics (@vercel/analytics)Vercel Blob (@vercel/blob)Puppeteer (registry capture scripts)Playwright (browser tests in packages/react)Dockerfile present in templates/react-router-app

Major components

packages/shadcn (CLI)

The published `shadcn` npm CLI: adds components to projects from a registry URL, includes schema validation, MCP server entrypoint, and Tailwind preset.

apps/v4 (docs site)

The Next.js documentation site at ui.shadcn.com rendering MDX docs via Fumadocs, live component previews, and the browsable block/component registry.

Registry build pipeline

Scripts in apps/v4/scripts (build-registry.mts, capture-registry.mts, monitor-registries.mts, validate-registries.mts) build, validate, health-check, and screenshot-capture registry items.

packages/react (@shadcn/react)

Unstyled/headless React primitives (message-scroller, questionnaire) published as ESM with automatic 'use client' directive injection.

packages/helpers (@shadcn/helpers)

Small helper libraries for AI SDK (ai-sdk) and TanStack AI (tanstack-ai) integrations used by chat components.

templates/

Starter project templates (next-app, vite-app, astro-app, react-router-app, start-app, plus monorepo variants) scaffolded by the CLI when initializing new projects.

skills/

Agent-facing skill documentation (shadcn usage, radix-to-base migration guides) shipped alongside the repo.

apps/v4 UI components & styles

Site-level React components (component-preview, block-viewer, code-tabs, etc.) and global CSS themes in app/globals.css and app/style-registry.css.

Over the past month this project — the home of shadcn/ui and its component registry ecosystem — has been overwhelmingly focused on expanding its registry directory, welcoming dozens of third-party component libraries from around the community. Alongside that growth, the shadcn command-line tool got meaningful upgrades: support for private GitHub registries, dynamic registry search, a base-color migration command, SOCKS proxy support, and a wave of reliability fixes for edge-case errors. Documentation also kept pace with updates to data-table docs for TanStack Table v9 and new Figma resources.

Week by week

2026-08-24A quieter week focused on registry infrastructure hardening and release tooling fixes.latest4 changes

Feature

Registry health monitoring

The system can now automatically watch whether third-party component registries are up and responding.

Fix

OIDC blob store fix

Fixed how identity credentials pass through when publishing registry content to secure storage.

Fix

CI publish detection fix

Updated an internal publishing tool so automated releases are correctly detected by npm's newest version.

Docs

Private registries changelog

Added documentation explaining recent changes around private GitHub-based component registries.

2026-08-17Private GitHub registry support landed alongside a huge batch of eleven new community registries joining the directory.6 changes

Feature

Private repository support for GitHub registries

Teams can now pull components from private GitHub repos, not just public ones.

Feature

New 'migrate base-color' command

The CLI gained a command that updates a project's underlying color theme in one step.

Fix

Spinner cleanup fix

Fixed lingering loading indicators in the CLI and clarified how repeated notices are handled.

Fix

Accordion styling fix in docs

Corrected typography styles so accordion examples render properly on the documentation site.

Chore

Namespace rename to snapcn

Standardized a community registry's naming convention for consistency across the directory.

Feature

Eleven new community registries added

Libraries like Honest UI, motion-lexicon, brut-ui, better-auth-ui, flagcn, remotionui, and more joined the official directory.

2026-08-10The busiest week of the period, pairing a large influx of sixteen new registries with important CLI stability fixes around file permissions and multi-registry setups.6 changes

Fix

Permission-error handling in CLI migrations

The migration tools no longer crash when they hit files they don't have permission to read.

Feature

SOCKS proxy support

Users behind corporate or restricted networks can now route CLI traffic through a proxy server.

Fix

Merged registry sources from package.json and config

Registries defined in two different places now combine instead of one overriding the other.

Feature

AI SDK human-in-the-loop mocking helpers

New developer helpers make it easier to simulate AI interactions that pause for user approval during testing.

Docs

Render prop guidance in Base UI docs

Documentation examples were updated to use a modern rendering pattern replacing an older approach.

Feature

Sixteen new community registries added

Entries like knock-codes, motiq, benday, openmirai, blockforge, atroui, and more joined the directory, plus Figma resource updates.

2026-08-03Data-table documentation moved to the latest table library version, and a new questionnaire component shipped with four registry additions.5 changes

Feature

New questionnaire component

Added a reusable form-style questionnaire component with polished choice-card styling.

Docs

TanStack Table v9 docs

Rewrote the data-table documentation to match the newest major version of the popular table library.

Fix

Search results include titles

Searching the registry SDK now returns component titles, making results easier to scan.

Feature

Four new registries added

Interior, @23rd, @shoogle, and other community component collections joined the trusted directory.

Fix

Questionnaire control alignment

Polished the visual alignment of answer choices within the new questionnaire.

2026-07-27Registry infrastructure took center stage with dynamic search, package.json-based registry loading, performance sharding — plus fifteen new community registries.6 changes

Feature

Dynamic registry search

The CLI can now search registries on the fly rather than only using pre-built indexes.

Feature

Load registries from package.json

Projects can declare their component registries directly in their package file for easier setup.

Refactor

Sharded registry maps per style

Splitting lookup data by style made the build faster by reducing memory pressure.

Fix

Nested output directories in builds

Builds no longer fail when output folders need to be created several levels deep.

Chore

Next.js 16.3 canary upgrade for tests

Bumped the test framework to a newer version to work around memory issues in the bundler.

Feature

Fifteen new community registries added

Collections like @whiskeyjack, @retab, @kinetic, @neon-ui, @hexui, @diklein, and @shadcn-dashboard joined the directory.

03 · Security check

Dependencies and code review

36 dependencies scanned

Dependency advisories

Security Watch

1 vulnerable package (1 advisories) across 36 scanned dependencies.

warninghigh · npmfixed in 8.0.16

vite 7.3.2

1 advisory. Fixed in 8.0.16.

How it can be abusedAn attacker on the same network could ask a developer's running Vite dev server for files outside the allowed folder by using alternate Windows-style paths, potentially reading source code or secrets from their machine. This only matters if someone runs the Vite dev server locally on Windows while it is exposed to other machines.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required