Password length when recovering password in Laravel?

Question

Laravel

Good evening.
It costs laravel 5.8, I don’t understand why the password length is not taken into account in the validation rule?
Passes only from 8 and above, before that an error pops up that they say you need from 8 and that's it, although 4 is indicated in general.
Or maybe I'm looking in the wrong place?
The trait ResetsPassword

/**
     * Get the password reset validation rules.
     *
     * @return array
     */
    protected function rules()
    {
        return [
            'token'    => 'required',
            'email'    => 'email',
            'password' => 'required|confirmed|min:4',
        ];
    }

Answer 1

In the ResetsPasswords trait, replace the method with mine and it will work. Up to and including laravel 5.8

public function reset(Request $request)
    {
        $request->validate([
            'token' => 'required',
            'email' => 'required|email',
            'password' => 'required|confirmed|min:6',
        ], $this->validationErrorMessages());

        // Here we will attempt to reset the user's password. If it is successful we
        // will update the password on an actual user model and persist it to the
        // database. Otherwise we will parse the error and return the response.
        $this->broker()->validator(function ($credentials) {
            return mb_strlen($credentials['password']) >= 6;
        });

        $response = $this->broker()->reset(
            $this->credentials($request),
            function ($user, $password) {
                $this->resetPassword($user, $password);
            }
        );

        // If the password was successfully reset, we will redirect the user back to
        // the application's home authenticated view. If there is an error we can
        // redirect them back to where they came from with their error message.
        return $response == Password::PASSWORD_RESET
            ? $this->sendResetResponse($request, $response)
            : $this->sendResetFailedResponse($request, $response);
    }

Answer 2

oh damn, he sewed it up somewhere in the core ...
In my opinion, in 6.0 they took it out of there and allowed me to change it :(
I don’t remember exactly where, but the problem is popular.