npm / @openid4vc/utils
@openid4vc/utils
What changed in @openid4vc/utils 0.5 to 0.8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-27.
1 breaking1 security2 new APIs and options7 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@openid4vc/utils 0.86 changes
Security 1
Always returns a valid header value by replacing control and non-ASCII characters with spaces and truncating error_description values longer than 500 characters.
New APIs and options 2
Adds isJwtTyp(value, typ) to check JWT typ values against their full media type form and casing.
Adds a schema that uses isJwtTyp to validate JWT typ values.
Fixes and other changes 3
Accepts the full media type form and any casing for JWT typ headers in the listed token and proof contexts; created JWTs still use the short lowercase form.
Parsed header types now declare typ as string, preserving the typ value as sent.
Unescapes every escaped character in a quoted string, not only an escaped quote.
@openid4vc/utils 0.73 changes
Fixes and other changes 3
Data URLs with media type svg+xml are accepted when validating metadata instead of causing errors.
The DPoP proof htu claim is normalized like the request URL before comparison, ignoring query and fragment and avoiding mismatches from uppercase hosts or explicit default ports.
zHttpsUrl accepts the URL scheme case-insensitively.
@openid4vc/utils 0.61 changes
Fixes and other changes 1
Skips payload entries with undefined values when encoding WWW-Authenticate headers; null values are still encoded as bare parameter names.
@openid4vc/utils 0.51 changes
Breaking changes 1
The package remains ESM-only; its main entry now points to the ESM build, and type declarations are exposed through the types export condition.