Components / Composable shadcn/ui component registry
Kibo UI
Higher-level React components for teams that already use shadcn/ui and need more than basic controls.
Understand the resource
What it is.
Kibo UI provides a registry of composable components built for the shadcn/ui ecosystem. Its catalog includes richer product interactions such as comboboxes, calendars and project-management views. Adding one can save assembly work, but the copied code and any additional dependencies become part of the application you maintain.
When it is useful
Use it when an existing React and shadcn/ui product needs a specific richer interaction and the team is prepared to inspect its implementation. It is a better fit for deliberate component selection than for installing a whole catalog without a use case.
A proposed application
Put it to work.
This example illustrates a possible use. The proposed workflow and expected result are separate from the bounded checks recorded below.
Try this
Prototype a searchable environment selector with a small synthetic list such as Development, Staging and Production. Start from the combobox pattern, verify search and keyboard selection, then add an explicit label and enforce permitted values on the server before connecting it to deployment controls.
Result to aim for
A usable selection control with an understood dependency footprint and an application-owned authorization boundary.
Before you start
What you need.
- A compatible React application with shadcn/ui initialized and Tailwind configured.
- The CSS Variables theming mode described in Kibo’s setup guide.
- Time to review added dependencies and maintain copied component code.
The practical boundaries
What to watch for.
- The setup workflow adds code and required dependencies. Review the selected component, package versions and resulting changes before accepting an install command.
- A rich demo is not a backend. Upload handling, permissions, validation, collaboration and persistence need their own implementation and testing.
- The setup documentation gives minimum versions; use a currently supported runtime and confirm compatibility instead of treating an old minimum as a security recommendation.
- A component advertised as accessible still needs labels, content and behavior testing in the surrounding product.
Review record
What we could establish.
- Why included — 2026-10-19: the current official repository is shadcnblocks/kibo; its GitHub API snapshot showed 3,966 stars and 180 forks. The last push was dated 4 May 2026, so this review treats it as an established-interest catalog addition and does not claim fresh release activity or verified trend growth.
- One public combobox was searched and selected by keyboard, then reopened and dismissed with Escape. No CLI, dependency installation, file upload, account or backend workflow was run.
The source-review notes describe documentation and identity. The account-free evaluation below records exactly which public interaction or local fixture was checked, what happened, and what remains untested.
Check current access, terms, licensing and data handling before using a resource with your own material.
Runtime and security evaluation
What the evaluation covers.
The public combobox filtered to SvelteKit, selected it by keyboard, and returned focus after Escape closed the reopened popup. No registry installer, backend or application package was run.
Methods: Public HTTP response · Public browser sample · Source review. A completed check covers the stated sample; it is not a safety certification.
- Target
- https://www.kibo-ui.com/components/combobox
- Version or capture
- Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.
- Integrity scope
- Recorded document SHA-256 ee015e8d22cdbf2ae69fba17591d90e76882a8a2bdb3326c2b943273712b9b3f. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service.
Test conditions
- Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.
- GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.
- Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence.
Individual checks and observations
Public document response
passPublic HTTP response: Navigate to the recorded public target in a fresh anonymous browser.
Observed: The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was ee015e8d22cdbf2ae69fba17591d90e76882a8a2bdb3326c2b943273712b9b3f; this fingerprints only the recorded HTML response.
Keyboard search and selection
passPublic browser sample: Open the first framework picker with Enter; type Svelte, then use ArrowDown and Enter on the filtered list.
Observed: The filtered list contained SvelteKit. The same trigger changed its label to SvelteKit and reported aria-expanded=false after selection.
Escape and focus return
passPublic browser sample: Reopen the selected picker, press Escape and inspect focus after the close transition settled.
Observed: The popup closed and aria-expanded returned false. After 350 ms, focus was back on the same trigger.
Primary-source scope review
passSource review: Read the official pages and relevant repository or standard references linked below.
Observed: Reviewed the current official repository, documented setup requirements and combobox examples. Repository metadata establishes current identity and a dated interest snapshot, not security or trend growth.
Broader workflow and assurance coverage
not-runPublic browser sample: Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.
Observed: No CLI, dependency installation, upload, editor persistence, collaborative service, server validation, screen reader or authenticated workflow was tested. Early selector and immediate-focus probes were superseded by the stable-element check after the close transition.
Security findings and boundaries
Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.
Observed · info
Public demo and external resources
The sample requested four origins, including Plausible and third-party image/CDN hosts. No non-GET request or page error was recorded. One external avatar request returned 404 without preventing the control checks.
Documented · caution
Installation changes your project
Kibo’s setup guide says its CLI or shadcn workflow adds component code and required dependencies. That is a code and dependency review boundary; the hosted demo does not establish those downloads’ safety.
Practical advice · caution
Selection is not permission
Client-side filtering and selection do not authorize a deployment, account change or other sensitive action. Validate the chosen value and the caller’s permissions on the server before using it.
Practical caveats
- Choose a single component for a real use case, inspect its dependencies and keep its code maintainable.
- Retest naming, focus and keyboard behavior with your actual content and validation; this pass covers one default combobox only.
What remains untested
- No CLI, dependency installation, upload, editor persistence, collaborative service, server validation, screen reader or authenticated workflow was tested. Early selector and immediate-focus probes were superseded by the stable-element check after the close transition.
- One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.
- Proposed use-case examples in this review were not implemented as a production workflow.
Security limits
- No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.
- The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling.
Evaluation sources
Follow the evidence
Sources and further reading.
Keep exploring