# What changed in @owf/token-status-list

> 4 changes in @owf/token-status-list 0.4 to 0.5 from its official release notes, upgrade guides and advisories: 2 breaking, 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/@owf/token-status-list/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @owf/token-status-list 0.5

### Breaking changes

- The CommonJS build is no longer published; the package is ESM-only, avoiding dual-package hazards in single-module-system runtimes. (0.5.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/token-status-list/CHANGELOG.md#050)

### Security

- JWT and CWT verification now reject tokens when the current time is exactly exp plus the skew, consistent with the requirement to reject tokens on or after exp. (0.5.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/token-status-list/CHANGELOG.md#050)

## @owf/token-status-list 0.4

### Breaking changes

- The constructor, setStatus and encoder now accept only integer status values from 0 to 2 ** bitsPerStatus - 1; invalid values throw an SLException instead of being encoded into neighbouring entries. (0.4.2) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/token-status-list/CHANGELOG.md#042)

### New APIs and options

- Adds a function to verify the Status List Token JWT header; verifyStatus now calls it before checking claims. (0.4.2) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/token-status-list/CHANGELOG.md#042)