npm / @openid4vc/openid4vp

@openid4vc/openid4vp

What changed in @openid4vc/openid4vp 0.5 to 0.8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-27.

3 breaking1 security1 deprecations11 new APIs and options2 behavior and defaults8 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@openid4vc/openid4vp 0.85 changes

Indicates whether the client was authenticated; when false, an error can still be sent, but a redirect_uri returned by the response endpoint should not be opened.
0.8.2release notes

The new Openid4vpAuthorizationRequestError carries the authorization request payload so the wallet can send an error response to the verifier.
0.8.2release notes
resolveOpenid4vpAuthorizationRequest throws this error when a request is invalid and its payload is known; it extends Oauth2ServerErrorResponseError and carries the authorizationRequestPayload.
0.8.2release notes
Accepts an error payload to submit an OpenID4VP Authorization Error Response.
0.8.2release notes

Accepts an error payload to create an OpenID4VP Authorization Error Response, including without jarm options for a JARM response mode when the wallet cannot encrypt it.
0.8.2release notes

Authorization error responses now produce this error with the parsed errorResponse.
0.5.5release notes
Node 18 support is dropped; Node.js 20.19 or later is now the lowest supported version.
0.5.0release notes
Callers must now pass a responseMode object identifying the expected response mode group and its specific parameters; this replaces the top-level origin parameter.
0.5.0release notes

Type declarations are exposed through the types export condition.
0.5.6release notes
Add an optional callback to resolve authorization server metadata without a request; returning null indicates the metadata definitively does not exist.
0.5.5release notes
Add an optional callback to resolve JWK Sets without a request; returned values are validated with the JWK Set schema.
0.5.5release notes
The second parameter now accepts an object with fetch and the matching resolve callback, as well as the previously accepted Fetch implementation.
0.5.5release notes
The second parameter now accepts an object with fetch and the matching resolve callback, as well as the previously accepted Fetch implementation.
0.5.5release notes
Adds experimental support for the OpenID4VCI 1.1 draft endpoint, allowing presentation during issuance; the feature may change incompatibly in a patch release.
0.5.0release notes
Pass allowedSkewInSeconds to configure the permitted clock skew when verifying an attestation JWT.
0.5.0release notes
Pass allowedSkewInSeconds to configure the permitted clock skew when verifying client attestation.
0.5.0release notes

The main entry points to the ESM build.
0.5.6release notes
More errors use Oauth2ServerErrorResponseError, enabling better error handling.
0.5.0release notes

The pre-draft-27 parameter is ignored when the verifier also sends encrypted_response_enc_values_supported, avoiding Invalid authorization_encryption_enc failures when both metadata generations are present.
0.5.6release notes
The pre-draft-27 parameter is ignored when the verifier also sends encrypted_response_enc_values_supported, avoiding Invalid authorization_encryption_enc failures when both metadata generations are present.
0.5.6release notes
The package remains ESM-only; using require to load its ESM build requires Node.js 20.19 or later, or 22.12 or later.
0.5.6release notes
Authorization error responses are parsed and cause an Openid4vpAuthorizationResponseError with the parsed errorResponse, rather than a zod error about missing vp_token.
0.5.5release notes
Authorization error responses are parsed and cause an Openid4vpAuthorizationResponseError with the parsed errorResponse, rather than a zod error about missing vp_token.
0.5.5release notes
Signed OpenID4VP requests without an aud field now set aud to https://self-issued.me/v2.
0.5.0release notes
Node 26 is now supported.
0.5.0release notes