VdModal gains a fourth size tier — size="xl" (987px, via the --vd-modal-width-xl token and .vd-modal-panel-xl class) — for release notes, side-by-side content, and wider forms.

VdModal and VdOffcanvas now trap focus, restore it to the opener on close, and release the body scroll lock on unmount; VdTabs implements the full WAI-ARIA tabs pattern (arrow-key navigation + roving tabindex); VdCustomSelect exposes aria-activedescendant; VdRating is a valid single-checked radiogroup; and useTimepicker is now keyboard-operable.

sanitizeHtml now correctly keeps allow-listed inline SVG (a case-mismatched allowlist had silently stripped all SVG) and scrubs dangerous inline style values under allowStyle. useClickOutside now attaches when created already-enabled, and useStepper no longer emits a spurious change on mount.

A test-only guard asserts the generated token data stays in sync with the authored token source, catching drift in CI.

A zero-dependency generator emits @vanduo-oss/vd3/tokens.json and the typed token-data module; the authored CSS tree bundles into @vanduo-oss/vd3/css (full) and @vanduo-oss/vd3/css/core (tokens-only, no icons), with fonts and Phosphor icons shipped in-package.

The full typed Vd* component set — including the seven layout primitives — plus the interactive composables, carried over 1:1 as pure Vue.

VdBreadcrumb, VdFooter, VdFab (speed-dial), VdNavbar (burger + overlay + body-lock + glass-on-scroll), VdThemeSwitcher, VdThemeCustomizer (show-palette prop, vd:open-customizer window event), and VdDocSearch (combobox / listbox).

useThemePreference (the module-scope theme singleton behind both theme controls), useDocSearch, useLazyLoad (IntersectionObserver reveal + loadSection), useGrid + setGridSystem (per-container standard / fibonacci mode), and useClickOutside.

VdMenu ships, and the twelve interactive composables (useRipple, useSearch, useExpandingCards, useValidate, useTimeline, usePopover, useFlow, useTabs, useSpotlight, useDropdown, useImageBox, useDraggable) are pure-Vue rewrites that additively return an optional controller with a refresh() idiom.

VdTree's cascade prop now genuinely defaults to true via withDefaults: mounting VdTree without it cascades a parent check to its descendants. Pass :cascade="false" to opt out.

vd3 is pure Vue: there is no separate client-side runtime to bootstrap and no global window objects — theming and interactivity live entirely in typed composables and the VanduoVue plugin. See the migration guide.

useToast is a module-scope singleton with the same documented API (useToastStore, useToast, show(), typed helpers, reactive queue), and pinia is no longer a peer dependency.

VdChart now forwards mark clicks as Vue events — @bar-click, @point-click, and @slice-click, each carrying the typed ClickEvent. Charts component 1.1.0.

VdDraw and VdFlowchart now cap an untrusted or corrupt document on load (truncating, never throwing), so a hostile document cannot freeze the tab. The saved-document format is unchanged.

Draw undo no longer corrupts history after an undo; bar charts anchor correctly when yMin > 0; the music player stops at the end of a playlist instead of looping forever; hex grid removes its canvas listeners on destroy; and the code editor highlights an unterminated block comment correctly.

Drawing tool on @vanduo-oss/vd3-cbun/draw (+ /draw/css), exposing VdDrawCore alongside the component — a vector drawing / painting surface with a variable-width brush engine (pen, pencil, marker, highlighter), a color palette with recents, an eraser, selection / move / resize, a toggleable background grid with adjustable cell size, undo / redo history, self-contained SVG & PNG export, and a Phosphor-icon toolbar. Pure-Vue and SSR-safe with no new runtime dependency. Component 1.1.0.

Saved documents carry VD_DRAW_VERSION; older constant-width freehand strokes migrate to the brush model on load, so earlier drawings keep rendering unchanged.

Code editor on @vanduo-oss/vd3-cbun/code-editor (+ /code-editor/css) — a lightweight, secure textarea-overlay editor: a native <textarea> over a syntax-highlight layer painted by first-party, ReDoS-safe tokenizers for JavaScript/TypeScript, HTML, CSS, JSON, Markdown, Shell, and Python. Line-number gutter, auto-indent, bracket/quote auto-close, read-only mode, copy button, placeholder, and a large-input guard. Escaping-safe (no innerHTML), SSR-safe, and no new runtime dependency. Component 1.0.0.

Charts on @vanduo-oss/vd3-cbun/charts (+ /charts/css). Component 1.0.0.

Flowchart on @vanduo-oss/vd3-cbun/flowchart (+ /flowchart/css), exposing VdFlowchartCore alongside the component. Component 1.2.0.

Hex grid on @vanduo-oss/vd3-cbun/hex-grid with the /hex-grid/hex-math helpers — canvas-rendered, reading --vd-* tokens (no CSS). Component 1.0.0.

Music player on @vanduo-oss/vd3-cbun/music-player (+ /music-player/css). Component 1.0.0.

Each subpath re-exports both the Vue component and its framework-agnostic core; a build-time guard bundles every entry separately with vue external and fails if inputs cross a component boundary. Versions surface via VD3_CBUN_VERSIONS, with 261 tests across 15 vitest files plus a Playwright real-canvas smoke.