the 1.21 change:

from: protected String createPasswordHash(String username, String password)
to: protected String createPasswordHash(String username, String password, String digestOption)

breaks existing code.
If subclassing overrides the method createPasswordHash ("to provide customized password hashing" as stated in the doc), the subclass method will not be called, because of parameter change.