@sarah Perhaps, but in practice the global function calling the app container has never caused any problems for me. And you definitely could inject the config repository where needed, it's just not conventional Laravel. I prefer sticking with conventions.
@heiglandreas That's a fair point, and the default max being discussed is 72 (due to bcrypt internals), so it would not violate the NIST recommendation.