npm / @openid4vc/oauth2

@openid4vc/oauth2

What changed in @openid4vc/oauth2 0.6 to 0.8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

7 breaking4 security3 new APIs and options7 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@openid4vc/oauth2 0.87 changes

Fixes the cnf claim of a DPoP-bound access token on Hermes, where it could be a thumbprint string instead of an object containing jkt.
0.8.0release notes
Always returns a valid header value by replacing control and non-ASCII characters with spaces and truncating error_description values longer than 500 characters, preventing header injection or errors when setting the header.
0.8.0release notes
Authorization requests, token requests, and client-attestation verification accept this option to reject a client attestation for another client id.
0.8.0release notes
Authorization requests, token requests, and client-attestation verification accept this option to reject a client attestation for another key; pass the thumbprint from an earlier request in later requests.
0.8.0release notes

verifyClientAttestationJwt now returns the thumbprint of the client attestation's cnf key, which can be passed in later requests to bind authorization sessions and refresh tokens to the client instance key.
0.8.0release notes

Now unescapes every escaped character in a quoted string, rather than only an escaped quote.
0.8.0release notes

Renames the DPoP option allowedClockSkewSeconds to allowedSkewInSeconds across the listed verification methods.
0.7.0release notes

Adds an optional clientAttestation verification option, defaulting to 0, for nbf and exp checks on both Client Attestation JWTs and PoP JWTs.
0.7.0release notes
Adds a server-level default allowed clock skew for DPoP and client attestation verification; per-call options override it, including 0.
0.7.0release notes

Normalizes the proof htu claim like the request URL before comparison, ignoring query and fragment and avoiding mismatches from uppercase hosts or explicit default ports.
0.7.0release notes
The verify*AccessTokenRequest methods now pass now to DPoP proof verification, so iat checks use the provided time rather than the current time.
0.7.0release notes
The method now honors its allowedSkewInSeconds option, which was previously ignored.
0.7.0release notes
Accepts the URL scheme case-insensitively.
0.7.0release notes

A missing code_verifier in an access token request for an authorization code bound to a PKCE challenge now produces invalid_grant instead of invalid_request.
0.6.0release notes
An access token request containing code_verifier but lacking pkce options in the verify function now fails with invalid_grant, preventing a PKCE downgrade attack.
0.6.0release notes
allowRequestUri now defaults to false in parseJarRequest and validateJarRequestParams; request-by-reference JAR requests are rejected unless the option is explicitly set to true.
0.6.0release notes
Pushed and interactive authorization requests containing request_uri are rejected with invalid_request instead of fetching the URI.
0.6.0release notes
Schema validation failures for client attestation and client attestation PoP JWTs now report invalid_client with status 401, including for the attest_jwt_client_auth_dpop method.
0.6.0release notes

Undefined error, error_description, and scope payload entries are omitted from the WWW-Authenticate header; null values remain encoded as bare parameter names.
0.6.0release notes
Authorization header authentication schemes are matched case-insensitively and resolved to their canonical form during verification.
0.6.0release notes