fix: pin shadcn version instead of @latest

Merge PR #284: pin the shadcn CLI helper to a deterministic version fallback while still allowing project package.json overrides.
This commit is contained in:
xiaolai 2026-06-24 20:08:07 +08:00 committed by GitHub
parent a13b2a02fd
commit 381f01d9e5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -64,6 +64,20 @@ class ShadcnInstaller:
except (json.JSONDecodeError, KeyError, OSError):
return []
def _get_shadcn_version(self) -> str:
"""Read shadcn version from project package.json; fall back to a pinned default."""
pkg_json = self.project_root / "package.json"
if pkg_json.exists():
try:
pkg = json.loads(pkg_json.read_text())
for section in ("dependencies", "devDependencies"):
version = pkg.get(section, {}).get("shadcn")
if version:
return version.lstrip("^~>=<").split()[0]
except (json.JSONDecodeError, KeyError):
pass
return "2.3.0" # pinned fallback; update when newer stable release is needed
def add_components(
self, components: List[str], overwrite: bool = False
) -> tuple[bool, str]:
@ -98,7 +112,8 @@ class ShadcnInstaller:
)
# Build command
cmd = ["npx", "shadcn@latest", "add"] + components
shadcn_version = self._get_shadcn_version()
cmd = ["npx", f"shadcn@{shadcn_version}", "add"] + components
if overwrite:
cmd.append("--overwrite")
@ -144,7 +159,8 @@ class ShadcnInstaller:
"shadcn not initialized. Run 'npx shadcn@latest init' first",
)
cmd = ["npx", "shadcn@latest", "add", "--all"]
shadcn_version = self._get_shadcn_version()
cmd = ["npx", f"shadcn@{shadcn_version}", "add", "--all"]
if overwrite:
cmd.append("--overwrite")