[PeterHewat]

Requested by Peter · project thread

What changed

Adds a Password row (Planned, last in build order) to the roadmap table in docs/README.md, and a design file docs/apps/password.md: random passwords and passphrases from crypto.getRandomValues, entropy shown, nothing generated is stored.

Also bumps @happy-dom/global-registrator to ^21.0.4 (test-only). CI's bun audit was failing on main because of GHSA-834v-8h66-3h79, which affects happy-dom up to 21.0.3.

Checks

• bun run verify passes
• Tried it in the browser (n/a, docs and a dev dependency only)

🤖 Generated with Claude Code

https://claude.ai/code/session_01AKV86EkDaxh9KPDPCoyHWo

[PeterHewat]

Lint, typecheck, test, build fails at the bun audit --audit-level=high step, and this PR doesn't cause it. happy-dom 21.0.1 (via @happy-dom/global-registrator) has a high advisory, GHSA-834v-8h66-3h79, covering every version up to 21.0.3. I get the same audit failure on origin/main locally. This PR only changes docs.

No existing fix clears it. The open Dependabot dev-deps branch only goes to ^21.0.3, which is still in the affected range, and it also brings a TypeScript major bump. The fix I'd propose is a separate PR that bumps @happy-dom/global-registrator to ^21.0.4 and refreshes bun.lock. I'm not adding that here so this PR stays docs-only.

---

Generated by Claude Code