upgrade mysql-server (mariadb) can't log into root stuck in secure-auth

It kept saying Server is running in --secure-auth mode, but 'root'@'localhost' has a password in the old format; please change the password to the new format on debian

I tried adding skip-grant-tables and secure-auth=off to mysqld in my.cnf
but then it says
error: 'Access denied for user 'root'@'localhost' mysql debian

I'm using debian

please someone help