jrfnl mentioned this pull request

> Password hashing algorithm identifiers are now nullable strings rather
>  than integers.
>
>  * PASSWORD_DEFAULT was int 1; now is null
>  * PASSWORD_BCRYPT was int 1; now is string '2y'
>  * PASSWORD_ARGON2I was int 2; now is string 'argon2i'
>  * PASSWORD_ARGON2ID was int 3; now is string 'argon2id'
>
>  Applications correctly using the constants PASSWORD_DEFAULT,
>  PASSWORD_BCRYPT, PASSWORD_ARGON2I, and PASSWORD_ARGON2ID will continue to
function correctly.

Refs:
* https://wiki.php.net/rfc/password_registry
* https://github.com/php/php-src/blob/86d751f696786bcb95c580482c9884e41ccf2406/UPGRADING#L131-L141
* php/php-src@534df87

Includes unit tests.

**Note**: while deprecated in name, it looks like the deprecation warning for use of the _constant value_ rather than the _constant_ has not been implemented.
All the more reason, of course, that the sniff is necessary.

wimg approved these changes Aug 28, 2019