Answer originally posted on another question which was more “why we can’t” instead of “how”: https://web.archive.org/web/20210408084000/https://wordpress.stackexchange.com/questions/135304/why-cant-i-update-username-through-wordpress-api/386265
Here is the solution I used to change the username properly (based on https://www.wpbeginner.com/wp-tutorials/how-to-change-your-wordpress-username/ which had missing information):
I was able to change the username simply with SQL using update wp_users set user_login = "old_username", user_nicename = "new_username" where id = user_id; (replace old_username, new_username and user_id with your values).
The old username will still be present in some other tables, for example “old_username changed the comment status to approved” in table wp_commentmeta, column meta_value but it looks like it is not necessary to change it.
In addition I did a permalink redirect in Apache with the rule RedirectPermanent /blog/author/old_username /blog/author/new_username to avoid 404 Not Found errors since the link was indexed by search engines.
I also updated my username for the comments I left on my website, using the comments menu in WordPress (not necessary but just to be consistent and avoid confusion for visitors).
There is another configuration to change if you are using a multisite installation, to stay a Network Admin.
This can be done by changing the line with the column meta_key that has the value site_admins (Add WordPress MU Network Admin via Database), for example with an SQL statement like update wp_sitemeta set meta_value = "a:1:{i:0;s:4:\"bapt\";}" where meta_id = 8; (note that the value 4 should match the length of the username, bapt in this case and the ID 8 can be different in your case). Note: with wp-cli search-replace function, you don’t need to worry about the length: Why can’t I update username through WordPress API?
Also if your website is open to username registration, for example with BuddyPress, I think another user will be able to create a username that is an old one of someone else and you could have issues with the Apache redirect (you would need to disable the redirect or forbid registration of old usernames in this case).