The password length requirement is configurable and defaults to 10, which is good. But it is possible to configure it to zero, without any warnings. There should be a warning when it is set below 8.

It looks like we'd have to support a severity / error level payload in our constraints. Not sure yet if that requires a big change.
https://symfony.com/doc/5.4/validation/severity.html

https://github.com/ibexa/core/blob/36c6bdf6982d3208a2b5e255add18ba576dd91fb/src/contracts/FieldType/ValidationError.php
https://github.com/ibexa/core/blob/36c6bdf6982d3208a2b5e255add18ba576dd91fb/src/lib/FieldType/ValidationError.php