In the config of Devise I have the password min length to be 8.
# config/initializers/devise.rb
config.password_length = 8..128
However, my rspec test passes when a password 4 characters:
u = User.new({
password: "test",
# ....
})
expect(u).to be_valid