npm / shadcn
shadcn
What changed in shadcn 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
6 breaking3 security7 deprecations51 new APIs and options14 behavior and defaults8 tooling40 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initshadcn 4103 changes
Breaking changes 4
Zod errors expose issues instead of errors.
shadcn/schema and @shadcn/registry/schema now export Zod 4 schemas. They no longer typecheck with Zod 3's z; on Zod 3, use the exported types and schema methods instead of z.infer and z.array.
Initialization installs cn and generates a lib/utils export; registry components import cn from the package.
Radius calculations use multiplication instead of addition.
Security 3
Custom registry headers are dropped on cross-origin redirects to prevent credential leakage.
File paths for registry items without an explicit target are validated to prevent path traversal.
Registry-supplied dependency strings can no longer inject flags during install.
Deprecations 7
The --base-color flag is deprecated.
The create command is deprecated and becomes an alias of init.
The --no-base-style flag is deprecated.
The registry:build command is deprecated.
The registry:mcp command is deprecated.
The --css-variables flag is deprecated for shadcn add.
The --src-dir flag is deprecated.
New APIs and options 43
Adds the registry engine behind the CLI; shadcn/registry and shadcn/schema re-export it.
Adds a command to switch a project's base color.
Configure SOCKS4/SOCKS5 proxies for the registry HTTP stack with ALL_PROXY or all_proxy; non-SOCKS schemes are ignored.
Accepts explicit registry configuration instead of loading components.json.
Adds getRegistriesConfig for retrieving registries configuration.
Adds support for registries in package.json.
Adds a public API for installing registry items programmatically without invoking the CLI.
Adds support for Base UI Toast.
React Aria support is added.
Adds the scroll-fade utility.
Adds the shimmer utility.
Adds support for GitHub registries.
Adds the
npx shadcn ejectcommand.Adds the rhea style for developers to use.
Adds include to registry.json.
Adds the shadcn registry validate command for validating registries.
Registry item targets can now contain alias placeholders.
Package imports are now supported.
Adds commands for working with shadcn presets.
Adds the --pointer option to enable cursor: pointer on buttons.
Adds the --only option to shadcn apply.
Adds the sera style for developers to use.
Adds the shadcn apply command.
Adds luma as a style developers can use.
Adds chartColor.
Presets now include fontHeading.
Adds a dependency field to registry:font entries.
Adds support for translucent menus.
Adds Astro template support.
Adds mauve as a base color option.
Adds mist as a base color option.
Adds monorepo support for Vite, Start, and React Router.
Adds olive as a base color option.
Adds support for preset code.
Adds the --diff option to the add command.
Adds the --dry-run option to the add command.
Adds the --view option to the add command.
Adds the shadcn docs command.
Adds the --base option to shadcn init.
Adds a --preset flag to the init command.
Adds a --reinstall flag for init.
Adds shadcn/skills.
Adds taupe as a base color option.
Behavior and default changes 12
Validation messages now use Zod 4's wording.
Skips npm audit and the funding check when installing or removing dependencies, or creating a project.
GitHub registries support private repositories using GitHub CLI credentials or GH_TOKEN.
Registries from package.json and components.json are merged, and registries can be added to package.json when components.json is absent.
shadcn add, search, view, and init resolve registries from package.json in memory without persisting them to components.json.
Results now include registry item titles, and fuzzy matching uses those titles.
Search params are forwarded to registries to support server-side dynamic search.
base-ui is now the default.
The search command is improved.
Registry fetches send
User-Agent: shadcnso servers using HTTP content negotiation can reliably serve JSON to the CLI.getTailwindCssFile falls back to config.tailwind.css.
The info command outputs LLM-friendly output.
Tooling 6
Adds a command to replace clsx, tailwind-merge, and cnfast in Tailwind CSS v4 projects.
Adds support for icon migration.
The info command now includes preset information.
Templates can now be scaffolded from GitHub remotes.
Warns when running in a monorepo without cwd set.
Adds support for installing hooks, lib, and ui for workspaces.
Fixes and other changes 28
Search and list results now show the add command instead of [object Promise].
Font items skip editing the layout with a warning when the edit cannot be made safely, instead of writing a broken layout.
The config edit is skipped with a warning when it cannot be made safely, instead of writing a broken config.
Fixes ERR_REQUIRE_CYCLE_MODULE when running the CLI with pnpm dlx on Windows.
Accepts components.json files that start with a UTF-8 byte order mark.
Accepts package.json files that start with a UTF-8 byte order mark.
Only rewrites links on the ui.shadcn.com host.
Fixes reduced motion handling when shimmer is used with a variant.
Preserves leading comments when running the command.
The official shadcn/ui website was added to the package metadata.
File scans skip unreadable directories instead of failing with EACCES.
Monorepo target resolution skips unreadable directories.
Fixes shadcn behavior for projects with unreadable permission files.
Creates nested output directories before writing when registry item names contain path segments, preventing ENOENT failures.
Preserves existing dependency specifiers in package.json when running the command.
RTL transforms preserve quotes in className literals.
Template handling was updated.
An error now suggests using the previous version.
Fixes apply in monorepos.
Fixes chartColor in presets.
Registry fetches send an Accept header so servers using HTTP content negotiation can reliably serve JSON to the CLI.
Runs template post-init hooks only for newly created projects.
Bundles @antfu/ni and tinyexec to fix a missing module error when using npx.
Handling of init URLs was updated.
Fixed Apple metadata files in the template.
Fixed an issue resolving fallback styles.
Changes handling of the apply directive inside a utility.
Fixes keyboard key display in the tooltip.
shadcn 326 changes
Breaking changes 2
Restricted blocks were removed.
Renames middleware to proxy for Next.js 16.
New APIs and options 8
Adds RTL support.
Remix icons are now available for developers to use.
Adds a command for adding registries.
MCP support was added for opencode.
Phosphor icons were added.
Adds the npx shadcn create command.
Adds registry:base as an item type for registry entries.
Added support for color as var.
Behavior and default changes 2
App names are now validated when creating an app.
Adding themes no longer installs the base style.
Tooling 2
The migrate radix command was updated.
Adds Next.js 16 support to the init command.
Fixes and other changes 12
Fixes handling of nested aschild transforms.
Uses tw-merge for transform-style classes, improving how conflicting styles are merged.
Already installed fonts are now properly detected.
Skips all transforms for universal registry items.
Fixed the resolver for URLs.
Prevents duplicate keyframes when adding components.
Fixes handling of base styles when using the add command.
Updates color value detection for cssVars.
Fixes the utils import transform when a workspace alias does not start with @.
Fixes a regression with universal item detection.
Fixed adding a registry item that uses CSS at-property.
Fixed support for universal registry items that have dependencies but no files.