Challenge 2 / 2

Before the refactor, RegistrationFormType had just two constraints on plainPassword:

'constraints' => [
    new NotBlank(message: 'Please enter a password'),
    new Length(min: 6, max: 4096),
],

Then we replaced that whole array with new Password(). What did that do to the registration form?

It tightened it: the minimum jumped from 6 characters to 12, and registration picked up the strength and breach checks it never had.

Nothing - Compound merges its constraints with whatever is already on the field, so min: 6 still applies.

It loosened it - a compound constraint only runs on a non-empty value, so a blank password now gets through.

Nothing visible, since a compound constraint has to be registered as a service before it takes effect.