7.2 added Argon2i to password_hash, and the useful detail is that it did not change the default. Code that passes PASSWORD_DEFAULT still gets bcrypt, deliberately, because the default is allowed to change between versions and a stored hash has to remain verifiable.
$hash = password_hash($plain, PASSWORD_DEFAULT); // bcrypt in 7.2
$hash = password_hash($plain, PASSWORD_ARGON2I, [
'memory_cost' => 1 << 17, // 128 MB
'time_cost' => 4,
'threads' => 2,
]);
// and the line most applications never write
if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
$this->store(password_hash($plain, PASSWORD_DEFAULT));
}
password_verify reads the algorithm out of the hash string, so a database can hold both while a migration runs — there is nothing to coordinate. The line worth adding is the rehash check inside the successful login path, because it is the only moment the plaintext is available. Without it, a cost increase applies to new accounts only and the old ones stay at whatever was cheap in 2013.