This is a BC break, which Symfony doesn't allow in minor versions. We need to deprecate passing empty strings at first, then convert the deprecation to an error in the next major version.

@chalasr Do I need to create a new UPGRADE-6.2.md myself right or have to wait until 6.2 branch is created?

We'll create the 6.2 after the stabilization period, you can then rebase this PR on the new 6.1 branch. I guess you can create a new UPGRADE-6.2.md file.

Thank you @bikalbasnet.

Just came across this in some application tests. Right now I get the 401 HTTP status code and the user deprecation. What is the upcoming target? From the other closed commits I assume 400 HTTP status code instead?

The naming Passing empty username or password parameter when using JsonLoginAuthenticator is not supported anymore is somewhat strange, as JSON clients still could send empty usernames and passwords or is there a change in this mechanic planned?

@adrianrudnik I'm not sure to truly understand what is the question here.
Anyway if you think there's something wrong or inconsistent, please consider opening a separate issue with enough details to reproduce.