Good tutorial around pacnew needed - #7 by cscs
pacman/Pacnew and Pacsave - ArchWiki
In your particular case of pam it was most likely this old thing which I wrote up as one of the first to try and document the ‘proper handling’ of that situation … as all pacnew situations can be wildly different in and of themselves, let alone system-dependent.
( which if you are interested … comes from this change: Deprecate pam_cracklib, pam_tally, and pam_tally2 · linux-pam/linux-pam@f49166c · GitHub )