PCI DSS

For now, periodic password expiry is still supported; only deprecated.

The first removal only removed minimum password age, which AFAIK, no regulation mandates. IIRC, I did check PCI DSS some time ago, and it doesn't mandate it, right?

Auditors may complain about the lack of minimum password age, since that allows users to workaround password expiration policies, but you should complain to auditors saying that not allowing changing a password immediately is itself a security problem: if someone sees you while typing the new password, you should immediately change it (even if the age of that password is effectively 10 seconds), and you should also complain that the regulation doesn't require that. If the auditor doesn't recognize the security problem of not allowing 0-day password changes, you should report the incompetence of the auditor to the regulator.

Once that happens, please come to shadow-utils, and let us know the result of that litigation.

You would also do well pointing to this removal (and the deprecations that will be eventually removed in the future) to the authors of PCI-DSS, so that they decide whether they still believe in periodic password expiry or they want to accept it's bad.

If regulators are open to talk about removing this, and they need X years (such as maybe 5), we're open to slowing down on the removal, to reduce the friction.

If regulators on the other hand ignore this and refuse to talk, we're going to unilaterally remove this, eventually.

Also, we're not going to start conversations with every regulator. I tried to start conversations with the only regulator I know in my country. But users affected by other regulators (e.g., you by PCI-DSS) should talk to them. Please point them to this publication, and to the shadow-utils release notes.