# What changed in @openid4vc/utils

> 11 changes in @openid4vc/utils 0.5 to 0.8 from its official release notes, upgrade guides and advisories: 1 breaking, 1 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@openid4vc/utils/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @openid4vc/utils 0.8

### Security

- Always returns a valid header value by replacing control and non-ASCII characters with spaces and truncating error_description values longer than 500 characters. (0.8.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/openid4vc-utils/CHANGELOG.md#080)

### New APIs and options

- Adds isJwtTyp(value, typ) to check JWT typ values against their full media type form and casing. (0.8.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/d617bd9dac6c3ae7b9c478de5bfe310a40850829/packages/openid4vc-utils/CHANGELOG.md#081)
- Adds a schema that uses isJwtTyp to validate JWT typ values. (0.8.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/d617bd9dac6c3ae7b9c478de5bfe310a40850829/packages/openid4vc-utils/CHANGELOG.md#081)

### Fixes and other changes

- Accepts the full media type form and any casing for JWT typ headers in the listed token and proof contexts; created JWTs still use the short lowercase form. (0.8.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/d617bd9dac6c3ae7b9c478de5bfe310a40850829/packages/openid4vc-utils/CHANGELOG.md#081)
- Parsed header types now declare typ as string, preserving the typ value as sent. (0.8.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/d617bd9dac6c3ae7b9c478de5bfe310a40850829/packages/openid4vc-utils/CHANGELOG.md#081)
- Unescapes every escaped character in a quoted string, not only an escaped quote. (0.8.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/openid4vc-utils/CHANGELOG.md#080)

## @openid4vc/utils 0.7

### Fixes and other changes

- Data URLs with media type svg+xml are accepted when validating metadata instead of causing errors. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/openid4vc-utils/CHANGELOG.md#070)
- The DPoP proof htu claim is normalized like the request URL before comparison, ignoring query and fragment and avoiding mismatches from uppercase hosts or explicit default ports. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/openid4vc-utils/CHANGELOG.md#070)
- zHttpsUrl accepts the URL scheme case-insensitively. (0.7.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/openid4vc-utils/CHANGELOG.md#070)

## @openid4vc/utils 0.6

### Fixes and other changes

- Skips payload entries with undefined values when encoding WWW-Authenticate headers; null values are still encoded as bare parameter names. (0.6.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/openid4vc-utils/CHANGELOG.md#060)

## @openid4vc/utils 0.5

### Breaking changes

- The package remains ESM-only; its main entry now points to the ESM build, and type declarations are exposed through the types export condition. (0.5.6) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/openid4vc-utils/CHANGELOG.md#056)