password_hash defaults changed, and rehashing is free

PASSWORD_DEFAULT is explicitly allowed to change between releases, and it does. Anything storing the constant’s current value, or sizing a column for today’s output, is storing a decision that has already moved.

if (password_verify($plain, $hash)) {
    if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
        $hash = password_hash($plain, PASSWORD_DEFAULT);
        $this->users->updateHash($user, $hash);
    }
}

The rehash belongs on successful login because that is the only moment the plaintext is legitimately available. The column needs to be at least 255 characters — 60 is the current bcrypt length and the documentation has warned against relying on it since the function shipped. Upgrading the cost factor works the same way and costs nothing until someone logs in.