To answer your specific question – `password_confirmation` is probably not necessary here, but `password.present?` is, otherwise you won't be able to save a record with an existing (digested) password due to password confirmation not being present.

This is part of the reason why I don't think we should cherry pick a particular snapshot of this and backport that to address a particular problem. Multiple attempts has been made to fix different individual problems with these rules and most of them ended up causing other problems. Cherry picking one of these fixes is probably unsafe.