[9.x] Update UPGRADE.md (#1240)

* Update UPGRADE.md

* Update UPGRADE.md

Co-authored-by: Taylor Otwell <[email protected]>

UPGRADE.md

@@ -1,5 +1,48 @@
 # Upgrade Guide
 
+## Upgrading To 9.0 From 8.0
+
+### Support For Multiple Guards
+
+PR: https://github.com/laravel/passport/pull/1220
+
+Passport now has support for multiple guard user providers. Because of this change, you must add a `provider` column to the `oauth_clients` database table:
+
+    Schema::table('oauth_clients', function (Blueprint $table) {
+        $table->string('provider')->after('secret')->nullable();
+    });
+
+### Client Credentials Secret Hashing
+
+PR: https://github.com/laravel/passport/pull/1145
+
+Client secrets may now be stored using a SHA-256 hash. However, before enabling this functionality, please consider the following. First, there is no way to reverse the hashing process once you have migrated your existing tokens. Secondly, when hashing client secrets, you will only have one opportunity to display the plain-text value to the user before it is hashed and stored in the database.
+
+You may enable client secret hashing by calling the `Passport::hashClientSecrets()` method within the `boot` method of your `AppServiceProvider`. For convenience, we've included a new Artisan command which you can run to hash all existing client secrets:
+
+    php artisan passport:hash
+
+**Again, please be aware that running this command cannot be undone. For extra precaution, you may wish to create a backup of your database before running the command.**
+
+### Client Credentials Middleware Changes
+
+PR: https://github.com/laravel/passport/pull/1132
+
+[After a lengthy debate](https://github.com/laravel/passport/issues/1125), it was decided to revert the change made [in a previous PR](https://github.com/laravel/passport/pull/1040) that introduced an exception when the client credentials middleware was used to authenticate first party clients.
+
+### Switch From `getKey` To `getAuthIdentifier`
+
+PR: https://github.com/laravel/passport/pull/1134
+
+Internally, Passport will now use the `getAuthIdentifier` method to determine a model's primary key. This is consistent with the framework and Laravel's first party libraries.
+
+### Remove Deprecated Functionality
+
+PR: https://github.com/laravel/passport/pull/1235
+
+The deprecated `revokeOtherTokens` and `pruneRevokedTokens` methods and the `revokeOtherTokens` and `pruneRevokedTokens` properties were removed from the `Passport` object.
+
+
 ## Upgrading To 8.0 From 7.0
 
 ### Minimum & Upgraded Versions