Drop support for crypt() without explicit salt

crypt() without salt generates a weak $1$ MD5 hash. It has been
throwing a notice since 2013 and we provide a much better alternative
in password_hash() (which can auto-generate salts for strong
password hashes), so keeping this is just a liability.

1 files changed, 3 insertions, 0 deletions

diff --git a/UPGRADING b/UPGRADING
index d18bc98eeb..0621d8eade 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -576,6 +576,9 @@ PHP 8.0 UPGRADE NOTES
 
         $ctx = stream_context_create(['http' => ['protocol_version' => '1.0']]);
         echo file_get_contents('http://example.org', false, $ctx);
+  . Calling crypt() without an explicit salt is no longer supported. If you
+    would like to produce a strong hash with an auto-generated salt, use
+    password_hash() instead.
 
 - Sysvmsg:
   . msg_get_queue() will now return an SysvMessageQueue object rather than a