# What changed in @openid4vc/oauth2

> 21 changes in @openid4vc/oauth2 0.6 to 0.8 from its official release notes, upgrade guides and advisories: 7 breaking, 4 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/@openid4vc/oauth2/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @openid4vc/oauth2 0.8

### Breaking changes

- The function now requires the hash callback. (0.8.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#080)

### Security

- Fixes the cnf claim of a DPoP-bound access token on Hermes, where it could be a thumbprint string instead of an object containing jkt. (0.8.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#080)
- Always returns a valid header value by replacing control and non-ASCII characters with spaces and truncating error_description values longer than 500 characters, preventing header injection or errors when setting the header. (0.8.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#080)
- Authorization requests, token requests, and client-attestation verification accept this option to reject a client attestation for another client id. (0.8.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#080)
- Authorization requests, token requests, and client-attestation verification accept this option to reject a client attestation for another key; pass the thumbprint from an earlier request in later requests. (0.8.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#080)

### New APIs and options

- verifyClientAttestationJwt now returns the thumbprint of the client attestation's cnf key, which can be passed in later requests to bind authorization sessions and refresh tokens to the client instance key. (0.8.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#080)

### Fixes and other changes

- Now unescapes every escaped character in a quoted string, rather than only an escaped quote. (0.8.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#080)

## @openid4vc/oauth2 0.7

### Breaking changes

- Renames the DPoP option allowedClockSkewSeconds to allowedSkewInSeconds across the listed verification methods. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#070)

### New APIs and options

- Adds an optional clientAttestation verification option, defaulting to 0, for nbf and exp checks on both Client Attestation JWTs and PoP JWTs. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#070)
- Adds a server-level default allowed clock skew for DPoP and client attestation verification; per-call options override it, including 0. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#070)

### Fixes and other changes

- Normalizes the proof htu claim like the request URL before comparison, ignoring query and fragment and avoiding mismatches from uppercase hosts or explicit default ports. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#070)
- The verify*AccessTokenRequest methods now pass now to DPoP proof verification, so iat checks use the provided time rather than the current time. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#070)
- The method now honors its allowedSkewInSeconds option, which was previously ignored. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#070)
- Accepts the URL scheme case-insensitively. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#070)

## @openid4vc/oauth2 0.6

### Breaking changes

- A missing code_verifier in an access token request for an authorization code bound to a PKCE challenge now produces `invalid_grant` instead of `invalid_request`. (0.6.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#060)
- An access token request containing code_verifier but lacking pkce options in the verify function now fails with `invalid_grant`, preventing a PKCE downgrade attack. (0.6.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#060)
- allowRequestUri now defaults to false in parseJarRequest and validateJarRequestParams; request-by-reference JAR requests are rejected unless the option is explicitly set to true. (0.6.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#060)
- Pushed and interactive authorization requests containing request_uri are rejected with `invalid_request` instead of fetching the URI. (0.6.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#060)
- Schema validation failures for client attestation and client attestation PoP JWTs now report `invalid_client` with status `401`, including for the `attest_jwt_client_auth_dpop` method. (0.6.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#060)

### Fixes and other changes

- Undefined error, error_description, and scope payload entries are omitted from the WWW-Authenticate header; null values remain encoded as bare parameter names. (0.6.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#060)
- Authorization header authentication schemes are matched case-insensitively and resolved to their canonical form during verification. (0.6.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/oauth2/CHANGELOG.md#060)