shadow-utils 4.20.0 removes `expiry`, `groupmems` and `logoutd`, drops DES and MD5 password hashing, and ignores the minimum-password-age field

Sources: LWN article
Summary: The release removes three commands, expiry, groupmems and logoutd, and drops DES and MD5 as password hashing methods. It also stops honouring the minimum password age, the fourth field of /etc/shadow, which is now ignored and removed from the file if present. The article notes that login.defs still needs ENCRYPT_METHOD set explicitly, because other readers of the file such as libpam may still default to DES.
Why it matters: The fourth field of /etc/shadow is now ignored and removed if present, so a policy that depends on a minimum password age stops being enforced on upgrade with no error, and login.defs still needs ENCRYPT_METHOD set explicitly because other readers such as libpam may still default to DES.