WordPress 6.8 is due to switch their password hashing to bcrypt, and their application passwords to BLAKE2b.
Great news:
They disarmed the 72 char footgun with bcrypt in the way I recommended (HMAC, rather than just SHA2, to prevent hash shucking, and base64 to prevent NUL truncation).