chore(release): version packages (#7834)

* chore(release): version packages

* deps: lock

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: shadcn <m@shadcn.com>

apps/v4/components/command-menu.tsx

@@ -36,11 +36,13 @@ export function CommandMenu({
   tree,
   colors,
   blocks,
+  navItems,
   ...props
 }: DialogProps & {
   tree: typeof source.pageTree
   colors: ColorPalette[]
   blocks?: { name: string; description: string; categories: string[] }[]
+  navItems?: { href: string; label: string }[]
 }) {
   const router = useRouter()
   const isMac = useIsMac()
@@ -162,12 +164,45 @@ export function CommandMenu({
           <DialogTitle>Search documentation...</DialogTitle>
           <DialogDescription>Search for a command to run...</DialogDescription>
         </DialogHeader>
-        <Command className="**:data-[slot=command-input-wrapper]:bg-input/50 **:data-[slot=command-input-wrapper]:border-input rounded-none bg-transparent **:data-[slot=command-input]:!h-9 **:data-[slot=command-input]:py-0 **:data-[slot=command-input-wrapper]:mb-0 **:data-[slot=command-input-wrapper]:!h-9 **:data-[slot=command-input-wrapper]:rounded-md **:data-[slot=command-input-wrapper]:border">
+        <Command
+          className="**:data-[slot=command-input-wrapper]:bg-input/50 **:data-[slot=command-input-wrapper]:border-input rounded-none bg-transparent **:data-[slot=command-input]:!h-9 **:data-[slot=command-input]:py-0 **:data-[slot=command-input-wrapper]:mb-0 **:data-[slot=command-input-wrapper]:!h-9 **:data-[slot=command-input-wrapper]:rounded-md **:data-[slot=command-input-wrapper]:border"
+          filter={(value, search, keywords) => {
+            const extendValue = value + " " + (keywords?.join(" ") || "")
+            if (extendValue.toLowerCase().includes(search.toLowerCase())) {
+              return 1
+            }
+            return 0
+          }}
+        >
           <CommandInput placeholder="Search documentation..." />
           <CommandList className="no-scrollbar min-h-80 scroll-pt-2 scroll-pb-1.5">
             <CommandEmpty className="text-muted-foreground py-12 text-center text-sm">
               No results found.
             </CommandEmpty>
+            {navItems && navItems.length > 0 && (
+              <CommandGroup
+                heading="Pages"
+                className="!p-0 [&_[cmdk-group-heading]]:scroll-mt-16 [&_[cmdk-group-heading]]:!p-3 [&_[cmdk-group-heading]]:!pb-1"
+              >
+                {navItems.map((item) => (
+                  <CommandMenuItem
+                    key={item.href}
+                    value={`Navigation ${item.label}`}
+                    keywords={["nav", "navigation", item.label.toLowerCase()]}
+                    onHighlight={() => {
+                      setSelectedType("page")
+                      setCopyPayload("")
+                    }}
+                    onSelect={() => {
+                      runCommand(() => router.push(item.href))
+                    }}
+                  >
+                    <IconArrowRight />
+                    {item.label}
+                  </CommandMenuItem>
+                ))}
+              </CommandGroup>
+            )}
             {tree.children.map((group) => (
               <CommandGroup
                 key={group.$id}

apps/v4/components/site-header.tsx

@@ -41,7 +41,11 @@ export function SiteHeader() {
           <MainNav items={siteConfig.navItems} className="hidden lg:flex" />
           <div className="ml-auto flex items-center gap-2 md:flex-1 md:justify-end">
             <div className="hidden w-full flex-1 md:flex md:w-auto md:flex-none">
-              <CommandMenu tree={pageTree} colors={colors} />
+              <CommandMenu
+                tree={pageTree}
+                colors={colors}
+                navItems={siteConfig.navItems}
+              />
             </div>
             <Separator
               orientation="vertical"

apps/v4/content/docs/(root)/changelog.mdx

@@ -4,6 +4,33 @@ description: Latest updates and announcements.
 toc: false
 ---
 
+## July 2025 - Universal Registry Items
+
+We've added support for universal registry items. This allows you to create registry items that can be distributed to any project i.e. no framework, no components.json, no tailwind, no react required.
+
+This new registry item type unlocks a lot of new workflows. You can now distribute code, config, rules, docs, anything to any code project.
+
+See the [docs](/docs/registry/examples) for more details and examples.
+
+## July 2025 - Local File Support
+
+The shadcn CLI now supports local files. Initialize projects and add components, themes, hooks, utils and more from local JSON files.
+
+```bash
+# Initialize a project from a local file
+npx shadcn init ./template.json
+
+# Add a component from a local file
+npx shadcn add ./block.json
+```
+
+This feature enables powerful new workflows:
+
+- **Zero setup** - No remote registries required
+- **Faster development** - Test registry items locally before publishing
+- **Enhanced workflow for agents and MCP** - Generate and run registry items locally
+- **Private components** - Keep proprietary components local and private.
+
 ## June 2025 - `radix-ui`
 
 We've added a new command to migrate to the new `radix-ui` package. This command will replace all `@radix-ui/react-*` imports with `radix-ui`.

apps/v4/content/docs/components/chart.mdx

@@ -4,9 +4,15 @@ description: Beautiful charts. Built using Recharts. Copy and paste into your ap
 component: true
 ---
 
+<Callout>
+
+**Note:** We're working on upgrading to Recharts v3. In the meantime, if you'd like to start testing v3, see the code in the comment [here](https://github.com/shadcn-ui/ui/issues/7669#issuecomment-2998299159). We'll have an official release soon.
+
+</Callout>
+
 <ComponentPreview
   name="chart-bar-interactive"
-  className="theme-blue -mt-4 [&_.preview]:p-0 [&_.preview]:lg:min-h-[404px] [&_.preview>div]:w-full [&_.preview>div]:border-none [&_.preview>div]:shadow-none"
+  className="theme-blue [&_.preview]:h-auto [&_.preview]:p-0 [&_.preview]:lg:min-h-[404px] [&_.preview>div]:w-full [&_.preview>div]:border-none [&_.preview>div]:shadow-none"
   hideCode
 />
 

apps/v4/content/docs/registry/examples.mdx

@@ -368,3 +368,70 @@ Note: you need to define both `@keyframes` in css and `theme` in cssVars to use
   }
 }
 ```
+
+## Universal Items
+
+As of `2.9.0`, you can create universal items that can be installed without framework detection or components.json.
+
+To make an item universal i.e framework agnostic, all the files in the item must have an explicit target.
+
+Here's an example of a registry item that installs custom Cursor rules for _python_:
+
+```json title=".cursor/rules/custom-python.mdc" showLineNumbers {9}
+{
+  "$schema": "https://ui.shadcn.com/schema/registry-item.json",
+  "name": "python-rules",
+  "type": "registry:item",
+  "files": [
+    {
+      "path": "/path/to/your/registry/default/custom-python.mdc",
+      "type": "registry:file",
+      "target": "~/.cursor/rules/custom-python.mdc",
+      "content": "..."
+    }
+  ]
+}
+```
+
+Here's another example for installation custom ESLint config:
+
+```json title=".eslintrc.json" showLineNumbers {9}
+{
+  "$schema": "https://ui.shadcn.com/schema/registry-item.json",
+  "name": "my-eslint-config",
+  "type": "registry:item",
+  "files": [
+    {
+      "path": "/path/to/your/registry/default/custom-eslint.json",
+      "type": "registry:file",
+      "target": "~/.eslintrc.json",
+      "content": "..."
+    }
+  ]
+}
+```
+
+You can also have a universal item that installs multiple files:
+
+```json title="my-custom-starter-template.json" showLineNumbers {9}
+{
+  "$schema": "https://ui.shadcn.com/schema/registry-item.json",
+  "name": "my-custom-start-template",
+  "type": "registry:item",
+  dependencies: ["better-auth"]
+  "files": [
+    {
+      "path": "/path/to/file-01.json",
+      "type": "registry:file",
+      "target": "~/file-01.json",
+      "content": "..."
+    },
+    {
+      "path": "/path/to/file-02.vue",
+      "type": "registry:file",
+      "target": "~/pages/file-02.vue",
+      "content": "..."
+    }
+  ]
+}
+```

apps/v4/content/docs/registry/index.mdx

@@ -1,15 +1,14 @@
 ---
 title: Registry
-description: Run your own component registry.
+description: Run your own code registry.
 ---
 
-<Callout>
-  **Note:** This feature is currently experimental. Help us improve it by
-  testing it out and sending feedback. If you have any questions, please [reach
-  out to us](https://github.com/shadcn-ui/ui/discussions).
-</Callout>
+You can use the `shadcn` CLI to run your own code registry. Running your own registry allows you to distribute your custom components, hooks, pages, config, rules and other files to any project.
 
-You can use the `shadcn` CLI to run your own component registry. Running your own registry allows you to distribute your custom components, hooks, pages, and other files to any React project.
+<Callout>
+  **Note:** The registry works with any project type and any framework, and is
+  not limited to React.
+</Callout>
 
 <figure className="flex flex-col gap-4">
   <Image
@@ -27,12 +26,10 @@ You can use the `shadcn` CLI to run your own component registry. Running your ow
     className="mt-6 hidden w-full overflow-hidden rounded-lg border shadow-sm dark:block"
   />
   <figcaption className="text-center text-sm text-gray-500">
-    Distribute code to any React project.
+    A distribution system for code
   </figcaption>
 </figure>
 
-Registry items are automatically compatible with the `shadcn` CLI and `Open in v0`.
-
 ## Requirements
 
 You are free to design and host your custom registry as you see fit. The only requirement is that your registry items must be valid JSON files that conform to the [registry-item schema specification](/docs/registry/registry-item-json).

apps/v4/content/docs/registry/registry-item-json.mdx

@@ -107,6 +107,7 @@ The following types are supported:
 | `registry:file`      | Use for miscellaneous files.                     |
 | `registry:style`     | Use for registry styles. eg. `new-york`          |
 | `registry:theme`     | Use for themes.                                  |
+| `registry:item`      | Use for universal registry items.                |
 
 ### author
 

apps/v4/package.json

@@ -86,7 +86,7 @@
     "recharts": "2.15.1",
     "rehype-pretty-code": "^0.14.1",
     "rimraf": "^6.0.1",
-    "shadcn": "2.8.0",
+    "shadcn": "2.9.2",
     "shiki": "^1.10.1",
     "sonner": "^2.0.0",
     "tailwind-merge": "^3.0.1",

apps/v4/public/r/index.json

@@ -180,7 +180,7 @@
     "name": "chart",
     "type": "registry:ui",
     "dependencies": [
-      "recharts",
+      "recharts@2.15.4",
       "lucide-react"
     ],
     "registryDependencies": [

apps/v4/public/r/styles/default/chart.json

@@ -4,7 +4,7 @@
   "type": "registry:ui",
   "author": "shadcn (https://ui.shadcn.com)",
   "dependencies": [
-    "recharts",
+    "recharts@2.15.4",
     "lucide-react"
   ],
   "registryDependencies": [

apps/v4/public/r/styles/new-york-v4/chart.json

@@ -3,7 +3,7 @@
   "name": "chart",
   "type": "registry:ui",
   "dependencies": [
-    "recharts",
+    "recharts@2.15.4",
     "lucide-react"
   ],
   "registryDependencies": [

apps/v4/public/r/styles/new-york/chart.json

@@ -4,7 +4,7 @@
   "type": "registry:ui",
   "author": "shadcn (https://ui.shadcn.com)",
   "dependencies": [
-    "recharts",
+    "recharts@2.15.4",
     "lucide-react"
   ],
   "registryDependencies": [

apps/v4/public/schema/registry-item.json

@@ -17,7 +17,8 @@
         "registry:theme",
         "registry:page",
         "registry:file",
-        "registry:style"
+        "registry:style",
+        "registry:item"
       ],
       "description": "The type of the item. This is used to determine the type and target path of the item when resolved for a project."
     },
@@ -79,7 +80,8 @@
               "registry:theme",
               "registry:page",
               "registry:file",
-              "registry:style"
+              "registry:style",
+              "registry:item"
             ],
             "description": "The type of the file. This is used to determine the type of the file when resolved for a project."
           },

apps/v4/registry.json

@@ -169,7 +169,7 @@
       "name": "chart",
       "type": "registry:ui",
       "dependencies": [
-        "recharts",
+        "recharts@2.15.4",
         "lucide-react"
       ],
       "registryDependencies": [

apps/v4/registry/new-york-v4/ui/calendar.tsx

@@ -73,7 +73,10 @@ function Calendar({
           "relative has-focus:border-ring border border-input shadow-xs has-focus:ring-ring/50 has-focus:ring-[3px] rounded-md",
           defaultClassNames.dropdown_root
         ),
-        dropdown: cn("absolute inset-0 opacity-0", defaultClassNames.dropdown),
+        dropdown: cn(
+          "absolute bg-popover inset-0 opacity-0",
+          defaultClassNames.dropdown
+        ),
         caption_label: cn(
           "select-none font-medium",
           captionLayout === "label"

apps/v4/registry/registry-ui.ts

@@ -155,7 +155,7 @@ export const ui: Registry["items"] = [
       },
     ],
     registryDependencies: ["card"],
-    dependencies: ["recharts", "lucide-react"],
+    dependencies: ["recharts@2.15.4", "lucide-react"],
   },
   {
     name: "checkbox",

apps/www/package.json

@@ -88,7 +88,7 @@
     "react-resizable-panels": "^2.0.22",
     "react-wrap-balancer": "^0.4.1",
     "recharts": "2.12.7",
-    "shadcn": "2.8.0",
+    "shadcn": "2.9.2",
     "sharp": "^0.32.6",
     "sonner": "^1.2.3",
     "swr": "2.2.6-beta.3",

apps/www/public/r/index.json

@@ -180,7 +180,7 @@
     "name": "chart",
     "type": "registry:ui",
     "dependencies": [
-      "recharts",
+      "recharts@2.15.4",
       "lucide-react"
     ],
     "registryDependencies": [

apps/www/public/r/styles/default/chart.json

@@ -4,7 +4,7 @@
   "type": "registry:ui",
   "author": "shadcn (https://ui.shadcn.com)",
   "dependencies": [
-    "recharts",
+    "recharts@2.15.4",
     "lucide-react"
   ],
   "registryDependencies": [

apps/www/public/r/styles/new-york-v4/chart.json

@@ -3,7 +3,7 @@
   "name": "chart",
   "type": "registry:ui",
   "dependencies": [
-    "recharts",
+    "recharts@2.15.4",
     "lucide-react"
   ],
   "registryDependencies": [

apps/www/public/r/styles/new-york/chart.json

@@ -4,7 +4,7 @@
   "type": "registry:ui",
   "author": "shadcn (https://ui.shadcn.com)",
   "dependencies": [
-    "recharts",
+    "recharts@2.15.4",
     "lucide-react"
   ],
   "registryDependencies": [

apps/www/registry/default/ui/calendar.tsx

@@ -73,7 +73,10 @@ function Calendar({
           "has-focus:border-ring border-input shadow-xs has-focus:ring-ring/50 has-focus:ring-[3px] relative rounded-md border",
           defaultClassNames.dropdown_root
         ),
-        dropdown: cn("absolute inset-0 opacity-0", defaultClassNames.dropdown),
+        dropdown: cn(
+          "bg-popover absolute inset-0 opacity-0",
+          defaultClassNames.dropdown
+        ),
         caption_label: cn(
           "select-none font-medium",
           captionLayout === "label"

apps/www/registry/new-york/ui/calendar.tsx

@@ -73,7 +73,10 @@ function Calendar({
           "has-focus:border-ring border-input shadow-xs has-focus:ring-ring/50 has-focus:ring-[3px] relative rounded-md border",
           defaultClassNames.dropdown_root
         ),
-        dropdown: cn("absolute inset-0 opacity-0", defaultClassNames.dropdown),
+        dropdown: cn(
+          "bg-popover absolute inset-0 opacity-0",
+          defaultClassNames.dropdown
+        ),
         caption_label: cn(
           "select-none font-medium",
           captionLayout === "label"

apps/www/registry/registry-ui.ts

@@ -155,7 +155,7 @@ export const ui: Registry["items"] = [
       },
     ],
     registryDependencies: ["card"],
-    dependencies: ["recharts", "lucide-react"],
+    dependencies: ["recharts@2.15.4", "lucide-react"],
   },
   {
     name: "checkbox",

packages/shadcn/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @shadcn/ui
 
+## 2.9.2
+
+### Patch Changes
+
+- [#7833](https://github.com/shadcn-ui/ui/pull/7833) [`d9cdc3f7ae69e571de7dc116effc381ad76685c3`](https://github.com/shadcn-ui/ui/commit/d9cdc3f7ae69e571de7dc116effc381ad76685c3) Thanks [@shadcn](https://github.com/shadcn)! - Revert "fix: handling of shouldOverwriteCssVars"
+
+## 2.9.1
+
+### Patch Changes
+
+- [#7829](https://github.com/shadcn-ui/ui/pull/7829) [`ed5237c231f3b70107131bd7ba517e73b8c9014d`](https://github.com/shadcn-ui/ui/commit/ed5237c231f3b70107131bd7ba517e73b8c9014d) Thanks [@shadcn](https://github.com/shadcn)! - fix handling of shouldOverwriteCssVars
+
+## 2.9.0
+
+### Minor Changes
+
+- [#7782](https://github.com/shadcn-ui/ui/pull/7782) [`06d03d64f437b543bf5fa07ccbc559f285538ffd`](https://github.com/shadcn-ui/ui/commit/06d03d64f437b543bf5fa07ccbc559f285538ffd) Thanks [@shadcn](https://github.com/shadcn)! - add universal registry items support
+
+### Patch Changes
+
+- [#7795](https://github.com/shadcn-ui/ui/pull/7795) [`6c341c16aeaf5ade177a4a1ba4fb9afcd33d5fee`](https://github.com/shadcn-ui/ui/commit/6c341c16aeaf5ade177a4a1ba4fb9afcd33d5fee) Thanks [@shadcn](https://github.com/shadcn)! - fix safe target handling
+
+- [#7757](https://github.com/shadcn-ui/ui/pull/7757) [`db93787712fe51346bf87dbae8b4cf4e38ed8c27`](https://github.com/shadcn-ui/ui/commit/db93787712fe51346bf87dbae8b4cf4e38ed8c27) Thanks [@shadcn](https://github.com/shadcn)! - implement registry path validation
+
 ## 2.8.0
 
 ### Minor Changes

packages/shadcn/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shadcn",
-  "version": "2.8.0",
+  "version": "2.9.2",
   "description": "Add components to your apps.",
   "publishConfig": {
     "access": "public"

packages/shadcn/src/commands/add.ts

@@ -1,13 +1,18 @@
+import fs from "fs"
 import path from "path"
 import { runInit } from "@/src/commands/init"
 import { preFlightAdd } from "@/src/preflights/preflight-add"
 import { getRegistryIndex, getRegistryItem } from "@/src/registry/api"
 import { registryItemTypeSchema } from "@/src/registry/schema"
-import { isLocalFile, isUrl } from "@/src/registry/utils"
+import {
+  isLocalFile,
+  isUniversalRegistryItem,
+  isUrl,
+} from "@/src/registry/utils"
 import { addComponents } from "@/src/utils/add-components"
 import { createProject } from "@/src/utils/create-project"
 import * as ERRORS from "@/src/utils/errors"
-import { getConfig } from "@/src/utils/get-config"
+import { createConfig, getConfig } from "@/src/utils/get-config"
 import { getProjectInfo } from "@/src/utils/get-project-info"
 import { handleError } from "@/src/utils/handle-error"
 import { highlighter } from "@/src/utils/highlighter"
@@ -78,13 +83,14 @@ export const add = new Command()
       })
 
       let itemType: z.infer<typeof registryItemTypeSchema> | undefined
+      let registryItem: any = null
 
       if (
         components.length > 0 &&
         (isUrl(components[0]) || isLocalFile(components[0]))
       ) {
-        const item = await getRegistryItem(components[0], "")
-        itemType = item?.type
+        registryItem = await getRegistryItem(components[0], "")
+        itemType = registryItem?.type
       }
 
       if (
@@ -130,6 +136,22 @@ export const add = new Command()
         }
       }
 
+      if (isUniversalRegistryItem(registryItem)) {
+        // Universal items only cares about the cwd.
+        if (!fs.existsSync(options.cwd)) {
+          throw new Error(`Directory ${options.cwd} does not exist`)
+        }
+
+        const minimalConfig = createConfig({
+          resolvedPaths: {
+            cwd: options.cwd,
+          },
+        })
+
+        await addComponents(options.components, minimalConfig, options)
+        return
+      }
+
       let { errors, config } = await preFlightAdd(options)
 
       // No components.json file. Prompt the user to run init.

packages/shadcn/src/registry/schema.ts

@@ -13,6 +13,7 @@ export const registryItemTypeSchema = z.enum([
   "registry:file",
   "registry:theme",
   "registry:style",
+  "registry:item",
 
   // Internal use only
   "registry:example",

packages/shadcn/src/registry/utils.test.ts

@@ -1,6 +1,11 @@
 import { describe, expect, it } from "vitest"
 
-import { getDependencyFromModuleSpecifier, isLocalFile, isUrl } from "./utils"
+import {
+  getDependencyFromModuleSpecifier,
+  isLocalFile,
+  isUniversalRegistryItem,
+  isUrl,
+} from "./utils"
 
 describe("getDependencyFromModuleSpecifier", () => {
   it("should return the first part of a non-scoped package with path", () => {
@@ -130,3 +135,139 @@ describe("isLocalFile", () => {
     expect(isLocalFile("/absolute/path")).toBe(false)
   })
 })
+
+describe("isUniversalRegistryItem", () => {
+  it("should return true when all files have targets", () => {
+    const registryItem = {
+      files: [
+        {
+          path: "file1.ts",
+          target: "src/file1.ts",
+          type: "registry:lib" as const,
+        },
+        {
+          path: "file2.ts",
+          target: "src/utils/file2.ts",
+          type: "registry:lib" as const,
+        },
+      ],
+    }
+    expect(isUniversalRegistryItem(registryItem)).toBe(true)
+  })
+
+  it("should return false when some files lack targets", () => {
+    const registryItem = {
+      files: [
+        {
+          path: "file1.ts",
+          target: "src/file1.ts",
+          type: "registry:lib" as const,
+        },
+        { path: "file2.ts", target: "", type: "registry:lib" as const },
+      ],
+    }
+    expect(isUniversalRegistryItem(registryItem)).toBe(false)
+  })
+
+  it("should return false when no files have targets", () => {
+    const registryItem = {
+      files: [
+        { path: "file1.ts", target: "", type: "registry:lib" as const },
+        { path: "file2.ts", target: "", type: "registry:lib" as const },
+      ],
+    }
+    expect(isUniversalRegistryItem(registryItem)).toBe(false)
+  })
+
+  it("should return false when files array is empty", () => {
+    const registryItem = {
+      files: [],
+    }
+    expect(isUniversalRegistryItem(registryItem)).toBe(false)
+  })
+
+  it("should return false when files is undefined", () => {
+    const registryItem = {}
+    expect(isUniversalRegistryItem(registryItem)).toBe(false)
+  })
+
+  it("should return false when registryItem is null", () => {
+    expect(isUniversalRegistryItem(null)).toBe(false)
+  })
+
+  it("should return false when registryItem is undefined", () => {
+    expect(isUniversalRegistryItem(undefined)).toBe(false)
+  })
+
+  it("should return false when target is null", () => {
+    const registryItem = {
+      files: [
+        {
+          path: "file1.ts",
+          target: null as any,
+          type: "registry:lib" as const,
+        },
+      ],
+    }
+    expect(isUniversalRegistryItem(registryItem)).toBe(false)
+  })
+
+  it("should return false when target is undefined", () => {
+    const registryItem = {
+      files: [{ path: "file1.ts", type: "registry:lib" as const }],
+    }
+    expect(isUniversalRegistryItem(registryItem)).toBe(false)
+  })
+
+  it("should handle mixed file types correctly", () => {
+    const registryItem = {
+      files: [
+        {
+          path: "component.tsx",
+          target: "components/ui/component.tsx",
+          type: "registry:ui" as const,
+        },
+        {
+          path: "utils.ts",
+          target: "lib/utils.ts",
+          type: "registry:lib" as const,
+        },
+        {
+          path: "hook.ts",
+          target: "hooks/use-something.ts",
+          type: "registry:hook" as const,
+        },
+      ],
+    }
+    expect(isUniversalRegistryItem(registryItem)).toBe(true)
+  })
+
+  it("should return true when all targets are non-empty strings", () => {
+    const registryItem = {
+      files: [
+        { path: "file1.ts", target: " ", type: "registry:lib" as const }, // whitespace is truthy
+        { path: "file2.ts", target: "0", type: "registry:lib" as const }, // "0" is truthy
+      ],
+    }
+    expect(isUniversalRegistryItem(registryItem)).toBe(true)
+  })
+
+  it("should handle real-world example with path traversal attempts", () => {
+    const registryItem = {
+      files: [
+        {
+          path: "malicious.ts",
+          target: "../../../etc/passwd",
+          type: "registry:lib" as const,
+        },
+        {
+          path: "normal.ts",
+          target: "src/normal.ts",
+          type: "registry:lib" as const,
+        },
+      ],
+    }
+    // The function should still return true - path validation is handled elsewhere
+    expect(isUniversalRegistryItem(registryItem)).toBe(true)
+  })
+})

packages/shadcn/src/registry/utils.ts

@@ -256,3 +256,20 @@ export function isUrl(path: string) {
 export function isLocalFile(path: string) {
   return path.endsWith(".json") && !isUrl(path)
 }
+
+/**
+ * Check if a registry item is universal (framework-agnostic).
+ * A universal registry item has all files with explicit targets.
+ * It can be installed without framework detection or components.json.
+ */
+export function isUniversalRegistryItem(
+  registryItem:
+    | Pick<z.infer<typeof registryItemSchema>, "files">
+    | null
+    | undefined
+): boolean {
+  return (
+    !!registryItem?.files?.length &&
+    registryItem.files.every((file) => !!file.target)
+  )
+}

packages/shadcn/src/utils/add-components.ts

@@ -6,7 +6,10 @@ import {
   registryResolveItemsTree,
   resolveRegistryItems,
 } from "@/src/registry/api"
-import { registryItemSchema } from "@/src/registry/schema"
+import {
+  registryItemFileSchema,
+  registryItemSchema,
+} from "@/src/registry/schema"
 import {
   configSchema,
   findCommonRoot,
@@ -17,6 +20,7 @@ import {
 } from "@/src/utils/get-config"
 import { getProjectTailwindVersionFromConfig } from "@/src/utils/get-project-info"
 import { handleError } from "@/src/utils/handle-error"
+import { isSafeTarget } from "@/src/utils/is-safe-target"
 import { logger } from "@/src/utils/logger"
 import { spinner } from "@/src/utils/spinner"
 import { updateCss } from "@/src/utils/updaters/update-css"
@@ -79,6 +83,14 @@ async function addProjectComponents(
     registrySpinner?.fail()
     return handleError(new Error("Failed to fetch components from registry."))
   }
+
+  try {
+    validateFilesTarget(tree.files ?? [], config.resolvedPaths.cwd)
+  } catch (error) {
+    registrySpinner?.fail()
+    return handleError(error)
+  }
+
   registrySpinner?.succeed()
 
   const tailwindVersion = await getProjectTailwindVersionFromConfig(config)
@@ -147,6 +159,13 @@ async function addWorkspaceComponents(
   const filesUpdated: string[] = []
   const filesSkipped: string[] = []
 
+  const files = payload.flatMap((item) => item.files ?? [])
+  try {
+    validateFilesTarget(files, config.resolvedPaths.cwd)
+  } catch (error) {
+    return handleError(error)
+  }
+
   const rootSpinner = spinner(`Installing components.`)?.start()
 
   for (const component of payload) {
@@ -317,3 +336,20 @@ async function shouldOverwriteCssVars(
       component.type === "registry:theme" || component.type === "registry:style"
   )
 }
+
+function validateFilesTarget(
+  files: z.infer<typeof registryItemFileSchema>[],
+  cwd: string
+) {
+  for (const file of files) {
+    if (!file?.target) {
+      continue
+    }
+
+    if (!isSafeTarget(file.target, cwd)) {
+      throw new Error(
+        `We found an unsafe file path "${file.target} in the registry item. Installation aborted.`
+      )
+    }
+  }
+}

packages/shadcn/src/utils/get-config.ts

@@ -225,3 +225,64 @@ export async function getTargetStyleFromConfig(cwd: string, fallback: string) {
   const projectInfo = await getProjectInfo(cwd)
   return projectInfo?.tailwindVersion === "v4" ? "new-york-v4" : fallback
 }
+
+type DeepPartial<T> = {
+  [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P]
+}
+
+/**
+ * Creates a config object with sensible defaults.
+ * Useful for universal registry items that bypass framework detection.
+ *
+ * @param partial - Partial config values to override defaults
+ * @returns A complete Config object
+ */
+export function createConfig(partial?: DeepPartial<Config>): Config {
+  const defaultConfig: Config = {
+    resolvedPaths: {
+      cwd: process.cwd(),
+      tailwindConfig: "",
+      tailwindCss: "",
+      utils: "",
+      components: "",
+      ui: "",
+      lib: "",
+      hooks: "",
+    },
+    style: "",
+    tailwind: {
+      config: "",
+      css: "",
+      baseColor: "",
+      cssVariables: false,
+    },
+    rsc: false,
+    tsx: true,
+    aliases: {
+      components: "",
+      utils: "",
+    },
+  }
+
+  // Deep merge the partial config with defaults
+  if (partial) {
+    return {
+      ...defaultConfig,
+      ...partial,
+      resolvedPaths: {
+        ...defaultConfig.resolvedPaths,
+        ...(partial.resolvedPaths || {}),
+      },
+      tailwind: {
+        ...defaultConfig.tailwind,
+        ...(partial.tailwind || {}),
+      },
+      aliases: {
+        ...defaultConfig.aliases,
+        ...(partial.aliases || {}),
+      },
+    }
+  }
+
+  return defaultConfig
+}

packages/shadcn/src/utils/is-safe-target.test.ts

@@ -0,0 +1,156 @@
+import { describe, expect, test } from "vitest"
+
+import { isSafeTarget } from "./is-safe-target"
+
+describe("isSafeTarget", () => {
+  const cwd = "/foo/bar"
+
+  describe("should reject path traversal attempts", () => {
+    test.each([
+      {
+        description: "basic path traversal with ../",
+        target: "../../etc/passwd",
+      },
+      {
+        description: "nested path traversal",
+        target: "ui/../../../etc/hosts",
+      },
+      {
+        description: "path traversal with ~/../",
+        target: "~/../../../.ssh/authorized_keys",
+      },
+      {
+        description: "absolute paths outside project",
+        target: "/etc/passwd",
+      },
+      {
+        description: "paths that resolve outside project root",
+        target: "foo/bar/../../../../etc/passwd",
+      },
+      {
+        description: "URL-encoded path traversal",
+        target: "%2e%2e%2f%2e%2e%2fetc%2fpasswd",
+      },
+      {
+        description: "double URL-encoded sequences",
+        target: "%252e%252e%252fetc%252fpasswd",
+      },
+      {
+        description: "mixed encoded/plain traversal",
+        target: "..%2f..%2fetc%2fpasswd",
+      },
+      {
+        description: "null byte injection",
+        target: "valid/path\0../../etc/passwd",
+      },
+      {
+        description: "Windows-style path traversal",
+        target: "..\\..\\Windows\\System32\\config",
+      },
+      {
+        description: "Windows absolute paths",
+        target: "C:\\Windows\\System32\\drivers\\etc\\hosts",
+      },
+      {
+        description: "mixed separator traversal",
+        target: "foo\\..\\../etc/passwd",
+      },
+      {
+        description: "current directory reference attacks",
+        target: "foo/./././../../../etc/passwd",
+      },
+      {
+        description: "control characters in paths",
+        target: "foo/\x01\x02/../../etc/passwd",
+      },
+      {
+        description: "Unicode normalization attacks",
+        target: "foo/../\u2025/etc/passwd",
+      },
+      {
+        description:
+          "path traversal with square brackets outside [...] pattern",
+        target: "foo/[bar]/../../etc/passwd",
+      },
+    ])("$description", ({ target }) => {
+      expect(isSafeTarget(target, cwd)).toBe(false)
+    })
+  })
+
+  describe("should accept safe paths", () => {
+    test.each([
+      {
+        description: "simple relative path",
+        target: "ui/button.tsx",
+      },
+      {
+        description: "nested relative path",
+        target: "components/ui/button.tsx",
+      },
+      {
+        description: "home directory expansion",
+        target: "~/foo.json",
+      },
+      {
+        description: "nested home directory path",
+        target: "~/components/button.tsx",
+      },
+      {
+        description: "dot in filename",
+        target: "components/.env.local",
+      },
+      {
+        description: "path with spaces",
+        target: "my components/button.tsx",
+      },
+      {
+        description: "path with special characters",
+        target: "components/@ui/button.tsx",
+      },
+      {
+        description: "framework routing with square brackets",
+        target: "pages/[id].tsx",
+      },
+      {
+        description: "catch-all routes with [...param]",
+        target: "server/api/auth/[...].ts",
+      },
+      {
+        description: "optional catch-all routes",
+        target: "pages/[[...slug]].tsx",
+      },
+      {
+        description: "dollar sign routes",
+        target: "routes/$userId.tsx",
+      },
+      {
+        description: "complex routing patterns",
+        target: "app/[locale]/[...segments]/page.tsx",
+      },
+    ])("$description", ({ target }) => {
+      expect(isSafeTarget(target, cwd)).toBe(true)
+    })
+  })
+
+  describe("edge cases", () => {
+    test("should handle empty string", () => {
+      expect(isSafeTarget("", cwd)).toBe(true)
+    })
+
+    test("should handle single dot", () => {
+      expect(isSafeTarget(".", cwd)).toBe(true)
+    })
+
+    test("should reject malformed URL encoding", () => {
+      expect(isSafeTarget("%zz%ff%2e%2e%2f", cwd)).toBe(false)
+    })
+
+    test("should handle paths at project root", () => {
+      expect(isSafeTarget("/foo/bar/test.txt", cwd)).toBe(true)
+    })
+
+    test("should reject paths just outside project root", () => {
+      expect(isSafeTarget("/foo/test.txt", cwd)).toBe(false)
+    })
+  })
+})

packages/shadcn/src/utils/is-safe-target.ts

@@ -0,0 +1,98 @@
+import path from "path"
+
+export function isSafeTarget(targetPath: string, cwd: string): boolean {
+  // Check for null bytes which can be used to bypass validations.
+  if (targetPath.includes("\0")) {
+    return false
+  }
+
+  // Decode URL-encoded sequences to catch encoded traversal attempts.
+  let decodedPath: string
+  try {
+    // Decode multiple times to catch double-encoded sequences.
+    decodedPath = targetPath
+    let prevPath = ""
+    while (decodedPath !== prevPath && decodedPath.includes("%")) {
+      prevPath = decodedPath
+      decodedPath = decodeURIComponent(decodedPath)
+    }
+  } catch {
+    // If decoding fails, treat as unsafe.
+    return false
+  }
+
+  // Normalize both paths to handle different path separators.
+  // Convert Windows backslashes to forward slashes for consistent handling.
+  const normalizedTarget = path.normalize(decodedPath.replace(/\\/g, "/"))
+  const normalizedRoot = path.normalize(cwd)
+
+  // Check for explicit path traversal sequences in both encoded and decoded forms.
+  // Allow [...] pattern which is common in framework routing (e.g., [...slug])
+  const hasPathTraversal = (path: string) => {
+    // Remove [...] patterns before checking for ..
+    const withoutBrackets = path.replace(/\[\.\.\..*?\]/g, "")
+    return withoutBrackets.includes("..")
+  }
+
+  if (
+    hasPathTraversal(normalizedTarget) ||
+    hasPathTraversal(decodedPath) ||
+    hasPathTraversal(targetPath)
+  ) {
+    return false
+  }
+
+  // Check for current directory references that might be used in traversal.
+  // First, remove [...] patterns to avoid false positives
+  const cleanPath = (path: string) => path.replace(/\[\.\.\..*?\]/g, "")
+  const cleanTarget = cleanPath(targetPath)
+  const cleanDecoded = cleanPath(decodedPath)
+
+  const suspiciousPatterns = [
+    /\.\.[\/\\]/, // ../ or ..\
+    /[\/\\]\.\./, // /.. or \..
+    /\.\./, // .. anywhere
+    /\.\.%/, // URL encoded traversal
+    /\x00/, // null byte
+    /[\x01-\x1f]/, // control characters
+  ]
+
+  if (
+    suspiciousPatterns.some(
+      (pattern) => pattern.test(cleanTarget) || pattern.test(cleanDecoded)
+    )
+  ) {
+    return false
+  }
+
+  // Allow ~/ at the start (home directory expansion within project) but reject ~/../ patterns.
+  if (
+    (targetPath.includes("~") || decodedPath.includes("~")) &&
+    (targetPath.includes("../") || decodedPath.includes("../"))
+  ) {
+    return false
+  }
+
+  // Check for Windows drive letters (even on non-Windows systems for safety).
+  const driveLetterRegex = /^[a-zA-Z]:[\/\\]/
+  if (driveLetterRegex.test(decodedPath)) {
+    // On Windows, check if it starts with the project root.
+    if (process.platform === "win32") {
+      return decodedPath.toLowerCase().startsWith(cwd.toLowerCase())
+    }
+    // On non-Windows systems, reject all Windows absolute paths.
+    return false
+  }
+
+  // If it's an absolute path, ensure it's within the project root.
+  if (path.isAbsolute(normalizedTarget)) {
+    return normalizedTarget.startsWith(normalizedRoot + path.sep)
+  }
+
+  // For relative paths, resolve and check if within project bounds.
+  const resolvedPath = path.resolve(normalizedRoot, normalizedTarget)
+  return (
+    resolvedPath.startsWith(normalizedRoot + path.sep) ||
+    resolvedPath === normalizedRoot
+  )
+}

packages/shadcn/src/utils/updaters/update-files.ts

@@ -51,7 +51,9 @@ export async function updateFiles(
 
   const [projectInfo, baseColor] = await Promise.all([
     getProjectInfo(config.resolvedPaths.cwd),
-    getRegistryBaseColor(config.tailwind.baseColor),
+    config.tailwind.baseColor
+      ? getRegistryBaseColor(config.tailwind.baseColor)
+      : Promise.resolve(undefined),
   ])
 
   let filesCreated: string[] = []

packages/shadcn/test/utils/get-config.test.ts

@@ -1,7 +1,11 @@
 import path from "path"
-import { expect, test } from "vitest"
+import { describe, expect, test } from "vitest"
 
-import { getConfig, getRawConfig } from "../../src/utils/get-config"
+import {
+  createConfig,
+  getConfig,
+  getRawConfig,
+} from "../../src/utils/get-config"
 
 test("get raw config", async () => {
   expect(
@@ -183,3 +187,129 @@ test("get config", async () => {
     },
   })
 })
+
+describe("createConfig", () => {
+  test("creates default config when called without arguments", () => {
+    const config = createConfig()
+
+    expect(config).toMatchObject({
+      resolvedPaths: {
+        cwd: expect.any(String),
+        tailwindConfig: "",
+        tailwindCss: "",
+        utils: "",
+        components: "",
+        ui: "",
+        lib: "",
+        hooks: "",
+      },
+      style: "",
+      tailwind: {
+        config: "",
+        css: "",
+        baseColor: "",
+        cssVariables: false,
+      },
+      rsc: false,
+      tsx: true,
+      aliases: {
+        components: "",
+        utils: "",
+      },
+    })
+  })
+
+  test("overrides cwd in resolvedPaths", () => {
+    const customCwd = "/custom/path"
+    const config = createConfig({
+      resolvedPaths: {
+        cwd: customCwd,
+      },
+    })
+
+    expect(config.resolvedPaths.cwd).toBe(customCwd)
+    expect(config.resolvedPaths.components).toBe("")
+    expect(config.resolvedPaths.utils).toBe("")
+  })
+
+  test("overrides style", () => {
+    const config = createConfig({
+      style: "new-york",
+    })
+
+    expect(config.style).toBe("new-york")
+  })
+
+  test("overrides tailwind settings", () => {
+    const config = createConfig({
+      tailwind: {
+        baseColor: "slate",
+        cssVariables: true,
+      },
+    })
+
+    expect(config.tailwind.baseColor).toBe("slate")
+    expect(config.tailwind.cssVariables).toBe(true)
+    expect(config.tailwind.config).toBe("")
+    expect(config.tailwind.css).toBe("")
+  })
+
+  test("overrides boolean flags", () => {
+    const config = createConfig({
+      rsc: true,
+      tsx: false,
+    })
+
+    expect(config.rsc).toBe(true)
+    expect(config.tsx).toBe(false)
+  })
+
+  test("overrides aliases", () => {
+    const config = createConfig({
+      aliases: {
+        components: "@/components",
+        utils: "@/lib/utils",
+      },
+    })
+
+    expect(config.aliases.components).toBe("@/components")
+    expect(config.aliases.utils).toBe("@/lib/utils")
+  })
+
+  test("handles complex partial overrides", () => {
+    const config = createConfig({
+      style: "default",
+      resolvedPaths: {
+        cwd: "/my/project",
+        components: "/my/project/src/components",
+      },
+      tailwind: {
+        baseColor: "zinc",
+        prefix: "tw-",
+      },
+      aliases: {
+        ui: "@/components/ui",
+      },
+    })
+
+    expect(config.style).toBe("default")
+    expect(config.resolvedPaths.cwd).toBe("/my/project")
+    expect(config.resolvedPaths.components).toBe("/my/project/src/components")
+    expect(config.resolvedPaths.utils).toBe("")
+    expect(config.tailwind.baseColor).toBe("zinc")
+    expect(config.tailwind.prefix).toBe("tw-")
+    expect(config.tailwind.css).toBe("")
+    expect(config.aliases.ui).toBe("@/components/ui")
+    expect(config.aliases.components).toBe("")
+  })
+
+  test("returns new object instances", () => {
+    const config1 = createConfig()
+    const config2 = createConfig()
+
+    expect(config1).not.toBe(config2)
+    expect(config1.resolvedPaths).not.toBe(config2.resolvedPaths)
+    expect(config1.tailwind).not.toBe(config2.tailwind)
+    expect(config1.aliases).not.toBe(config2.aliases)
+  })
+})

pnpm-lock.yaml

@@ -322,7 +322,7 @@ importers:
         specifier: ^6.0.1
         version: 6.0.1
       shadcn:
-        specifier: 2.8.0
+        specifier: 2.9.2
         version: link:../../packages/shadcn
       shiki:
         specifier: ^1.10.1
@@ -602,7 +602,7 @@ importers:
         specifier: 2.12.7
         version: 2.12.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       shadcn:
-        specifier: 2.8.0
+        specifier: 2.9.2
         version: link:../../packages/shadcn
       sharp:
         specifier: ^0.32.6