npm / @openid4vc/openid4vci
@openid4vc/openid4vci
What changed in @openid4vc/openid4vci 0.6 to 0.8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.
5 breaking1 security8 new APIs and options
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@openid4vc/openid4vci 0.84 changes
New APIs and options 4
Adds optional Credential Issuer Metadata support for issuer_info following ETSI TS 119 472-3.
Adds the IssuerInfo export for optional issuer_info Credential Issuer Metadata support.
Adds the IssuerInfoEntry export for optional issuer_info Credential Issuer Metadata support.
Adds the zIssuerInfo export for optional issuer_info Credential Issuer Metadata support.
@openid4vc/openid4vci 0.78 changes
Breaking changes 3
Now requires issuerMetadata and performs the credential response encryption check against issuer metadata.
Checks requested credential response encryption against issuer metadata and rejects missing or unsupported encryption parameters.
Now requires issuerMetadata and performs the credential response encryption check against issuer metadata.
Security 1
Pass this value to jwt and attestation proof verification, including on Openid4vciIssuer, to verify issuer-required key attestation properties.
New APIs and options 4
Issuers that encrypt credential responses must advertise this field in their metadata.
Exports the credential response encryption check for direct use.
Can be called directly to verify that a key attestation meets issuer metadata requirements.
The issuer metadata schema now accepts zip_values_supported.
@openid4vc/openid4vci 0.62 changes
Breaking changes 2
Pushed or interactive authorization requests containing a request_uri parameter are rejected with invalid_request instead of fetching the request_uri.
Credential requests referencing an unsupported credential_configuration_id now return unknown_credential_configuration instead of invalid_credential_request.