@vanduo-oss/framework 1.4.4 → 1.4.6

package/CHANGELOG.md

@@ -0,0 +1,71 @@
+# Changelog
+
+All notable changes to the Vanduo Framework are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Full release notes — covering the framework, the documentation site, and
+ecosystem packages side by side — live at <https://vanduo.dev/#changelog>.
+
+## [1.4.6] - 2026-06-12
+
+### Added
+- Hand-written `dist/vanduo.d.ts` declaring the `Vanduo` runtime, exposed via the package `types` field.
+- No-icons `vanduo-core.css` / `vanduo-core.min.css` build artifact (`@vanduo-oss/framework/css/core`) for consumers who ship their own icon set.
+- This `CHANGELOG.md`.
+- Playwright regression coverage for the parallax component and the print stylesheet.
+
+### Changed
+- `css/vanduo.css` now bundles only the `regular` + `fill` icon weights, cutting the minified stylesheet ~47%. Import `css/icons/icons-all.css` for all six weights.
+- The build now ships only the icon weights the bundle references into `dist/icons/`; the full six-weight set still ships under `icons/` for `icons-all.css` consumers.
+- `check:versions` now also validates `README.md`, `SECURITY.md`, `llms.txt`, and this changelog — not just the dist banners.
+
+### Fixed
+- Parallax speed/direction modifiers and the print stylesheet's element hide-list now use the canonical `vd-` prefix left behind by the 1.4.1 rename. The parallax JS still accepts the legacy unprefixed `parallax-*` / `data-speed` forms for back-compat.
+
+### Removed
+- Unused internal `doc-tabs` styles dropped from the bundle.
+
+### Security
+- Documented Subresource Integrity (`integrity` + `crossorigin`) for CDN tags; an ESLint rule now flags raw `innerHTML` assignment. The docs site ships a Content Security Policy restricting origins to self + jsDelivr.
+
+## [1.4.5] - 2026-06-11
+
+### Fixed
+- Rounded-corner background bleed on draggable surfaces and input-group addons (`background-clip: padding-box`) at large `data-radius` presets.
+
+## [1.4.4] - 2026-06-07
+
+### Added
+- Theme Switcher icon-menu variant (System / Light / Dark) with tooltips and keyboard navigation; cycle and select variants remain available.
+
+## [1.4.3] - 2026-05-27
+
+### Changed
+- Music Player moved out of the core bundle into the ecosystem.
+
+### Fixed
+- Suggest autocomplete uses DOM-safe match highlighting.
+- Code Snippet HTML highlighting no longer corrupts extracted markup.
+
+## [1.4.2] - 2026-05-23
+
+### Fixed
+- Modal and dialog size tiers render as real desktop width steps matching the documented API.
+
+## [1.4.1] - 2026-05-23
+
+### Changed
+- Strict `--vd-*` token API: legacy unprefixed token aliases removed (see [TOKENS.md](TOKENS.md) for migration).
+- Removed the legacy font-preference migration path.
+
+## [1.4.0] - 2026-05-19
+
+### Changed
+- Scoped runtime and lifecycle architecture; canonical `lowerCamelCase` registry names.
+- Security and hygiene hardening across components.
+
+---
+
+Releases prior to 1.4.0 are documented at <https://vanduo.dev/#changelog>.

package/README.md

@@ -1,4 +1,4 @@
-# Vanduo Framework v1.4.4
+# Vanduo Framework v1.4.6
 
 <p align="center">
   <img src="vanduo-banner.svg" alt="Vanduo Framework Banner" width="100%">
@@ -25,25 +25,37 @@ Vanduo is a zero-dependency UI framework built with HTML, CSS, and vanilla JavaS
 - Theme Switcher menu variant for icon-only light/dark/system selection in navbars
 - Playwright-based browser coverage across Chromium, Firefox, and WebKit
 
-## What's New in 1.4.4
+## What's New in 1.4.6
 
-- **Theme Switcher menu variant** — `.vd-theme-switcher[data-theme-ui="menu"]` opens an icon-only picker; option click applies the theme without cycling on toggle. Cycle (`button[data-toggle="theme"]`) and select variants are unchanged.
-- **New stylesheet** — `css/components/theme-switcher.css` for menu layout, active state, and navbar alignment.
-- **Optional tooltips** — add `data-tooltip` on the toggle or menu options when the Tooltips component is loaded (opt-in).
-- Normative API: [openspec/specs/theme-switcher/spec.md](openspec/specs/theme-switcher/spec.md).
+- **Leaner default CSS** — `css/vanduo.css` now bundles the `regular` + `fill` icon weights only (~45% smaller minified CSS). Need all six weights? Import `css/icons/icons-all.css`.
+- **No-icons core build** — new `dist/vanduo-core.min.css` (`@vanduo-oss/framework/css/core`) drops the bundled icons entirely (~123 KB lighter) for consumers who ship their own icon set.
+- **Smaller package** — the build ships only the icon weights the bundle actually uses into `dist/icons/`, instead of all six.
+- **TypeScript types** — a hand-written `dist/vanduo.d.ts` for the `Vanduo` runtime, exposed via the `types` field.
+- **In-repo changelog** — a new [CHANGELOG.md](CHANGELOG.md) (Keep a Changelog), now validated by `check:versions`.
+- **Version-consistency now covers prose** — `pnpm check:versions` validates README, `SECURITY.md`, `llms.txt`, and `CHANGELOG.md`, not just the dist banners.
+- **Lint guard** — raw `innerHTML` assignment is now flagged by ESLint outside the sanitization helpers.
+- **Parallax & print fixes (now tested)** — speed/direction classes and the print stylesheet's hide-list now use the canonical `vd-` prefix, with new Playwright regression specs; removed the unused internal `doc-tabs` styles from the bundle.
+
+## Previous: 1.4.5
+
+- **Rounded-corner background fixes** — draggable surfaces and input-group addons use `background-clip: padding-box` so opaque fills no longer bleed past border arcs at large `data-radius` presets.
+- **Background-clip audit** — Playwright `@audit` harness at `tests/audit/background-clip-audit.spec.ts` for regression checks.
+- Normative API: [openspec/specs/draggable/spec.md](openspec/specs/draggable/spec.md).
 
 ## Quick Start
 
 ### CDN
 
 ```html
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/vanduo-oss/framework@v1.4.4/dist/vanduo.min.css">
-<script src="https://cdn.jsdelivr.net/gh/vanduo-oss/framework@v1.4.4/dist/vanduo.min.js"></script>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/vanduo-oss/framework@v1.4.6/dist/vanduo.min.css">
+<script src="https://cdn.jsdelivr.net/gh/vanduo-oss/framework@v1.4.6/dist/vanduo.min.js"></script>
 <script>
   Vanduo.init();
 </script>
 ```
 
+> **Production tip:** harden CDN tags with Subresource Integrity — add `integrity="sha384-…" crossorigin="anonymous"`. Copy the hash from [jsdelivr.com](https://www.jsdelivr.com/) (per-file "SRI" button) or generate it with `openssl dgst -sha384 -binary dist/vanduo.min.js | openssl base64 -A`.
+
 ### Local Dist Files
 
 ```html
@@ -142,10 +154,12 @@ CI runs **Chromium Desktop smoke tests on pull requests** and the **full cross-b
 
 ## Release Notes
 
+- Changelog: [CHANGELOG.md](CHANGELOG.md)
 - Architecture notes: [ARCHITECTURE.md](ARCHITECTURE.md)
 - Token model: [TOKENS.md](TOKENS.md)
-- `1.4.1` token migration notes: [changes-v141.md](changes-v141.md)
 - Theme Switcher spec: [openspec/specs/theme-switcher/spec.md](openspec/specs/theme-switcher/spec.md)
+- Draggable spec: [openspec/specs/draggable/spec.md](openspec/specs/draggable/spec.md)
+- Changelog policy: [openspec/specs/changelog/spec.md](openspec/specs/changelog/spec.md)
 - QA strategy: [QA-Automation-Strategy.md](QA-Automation-Strategy.md)
 - Contributor workflow: [CONTRIBUTING.md](CONTRIBUTING.md)
 

package/css/components/draggable.css

@@ -60,6 +60,7 @@
   padding: var(--vd-draggable-padding);
   margin: var(--vd-draggable-margin);
   background-color: var(--vd-draggable-bg);
+  background-clip: padding-box;
   border: 1px solid var(--vd-draggable-border-color);
   border-radius: var(--vd-btn-border-radius);
   cursor: grab;
@@ -124,6 +125,7 @@
   padding: var(--vd-drop-zone-padding);
   margin: var(--vd-draggable-margin);
   background-color: var(--vd-drop-zone-bg);
+  background-clip: padding-box;
   border: 2px dashed var(--vd-drop-zone-border-color);
   border-radius: var(--vd-btn-border-radius);
   transition: var(--vd-draggable-transition);
@@ -169,6 +171,7 @@
   gap: var(--vd-draggable-margin);
   padding: var(--vd-draggable-padding);
   background-color: var(--vd-bg-secondary);
+  background-clip: padding-box;
   border: 1px solid var(--vd-border-color);
   border-radius: var(--vd-btn-border-radius);
 }
@@ -184,6 +187,7 @@
   min-width: 8rem; /* 128px */
   padding: var(--vd-draggable-padding);
   background-color: var(--vd-draggable-bg);
+  background-clip: padding-box;
   border: 1px solid var(--vd-draggable-border-color);
   border-radius: var(--vd-btn-border-radius);
   cursor: grab;

package/css/components/forms.css

@@ -397,6 +397,7 @@ label.label-lg {
   text-align: center;
   white-space: nowrap;
   background-color: var(--vd-bg-secondary);
+  background-clip: padding-box;
   border: var(--vd-input-border-width) solid var(--vd-input-border-color);
 }
 

package/css/utilities/print.css

@@ -61,38 +61,40 @@
     page-break-inside: avoid;
   }
 
-  /* Hide non-essential elements */
-  .navbar,
-  .navbar-menu,
-  .navbar-toggle,
-  .navbar-overlay,
-  .sidenav,
-  .modal,
-  .modal-backdrop,
-  .tooltip,
-  .dropdown-menu,
-  .btn-group,
-  .pagination,
+  /* Hide non-essential UI chrome */
+  .vd-navbar,
+  .vd-navbar-menu,
+  .vd-navbar-toggle,
+  .vd-navbar-overlay,
+  .vd-sidenav,
+  .vd-sidenav-overlay,
+  .vd-modal,
+  .vd-modal-backdrop,
+  .vd-tooltip,
+  .vd-dropdown-menu,
+  .vd-btn-group,
+  .vd-pagination,
   .skip-link,
-  .d-print-none {
+  .vd-d-print-none {
     display: none !important;
   }
 
   /* Show print-only elements */
-  .d-print-block {
+  .vd-d-print-block {
     display: block !important;
   }
 
-  .d-print-inline {
+  .vd-d-print-inline {
     display: inline !important;
   }
 
-  .d-print-inline-block {
+  .vd-d-print-inline-block {
     display: inline-block !important;
   }
 
   /* Container adjustments */
-  .container {
+  .vd-container,
+  .vd-container-responsive {
     width: 100% !important;
     max-width: none !important;
     padding: 0 !important;

package/css/vanduo.css

@@ -14,8 +14,8 @@
 @import url('core/grid.css');
 @import url('core/helpers.css');
 
-/* Layer 2: Icons */
-@import url('icons/icons-all.css');
+/* Layer 2: Icons (regular + fill; import css/icons/icons-all.css for all 6 weights) */
+@import url('icons/icons.css');
 
 /* Layer 3: Utilities */
 @import url('utilities/shadow.css');
@@ -55,7 +55,6 @@
 @import url('components/theme-customizer.css');
 @import url('components/theme-switcher.css');
 @import url('components/image-box.css');
-@import url('components/doc-tabs.css');
 @import url('components/doc-search.css');
 @import url('components/draggable.css');
 @import url('components/flow.css');

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.4.4",
-  "builtAt": "2026-06-07T19:14:20.877Z",
-  "commit": "781df0d",
+  "version": "1.4.6",
+  "builtAt": "2026-06-13T10:32:26.875Z",
+  "commit": "82019ff",
   "mode": "development+production"
 }