# What changed in @sd-jwt/core

> 16 changes in @sd-jwt/core 0.21 to 0.23 from its official release notes, upgrade guides and advisories: 5 breaking, 1 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/@sd-jwt/core/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @sd-jwt/core 0.23

### Breaking changes

- The CommonJS build is dropped; only ESM is published, avoiding dual-package hazards that caused instanceof checks to fail in some runtimes. (0.23.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0230)

## @sd-jwt/core 0.22

### Breaking changes

- This check now applies to the issuer-signed SD-JWT payload rather than the Key Binding JWT or Status List Token. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0220)
- Use this option to constrain the Key Binding JWT audience; credential expectedAudience no longer applies to it. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0220)
- Time-claim failures now throw this SDJWTException subclass with structured details and error codes. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0220)
- The constructor now takes an options object with details, code, and cause instead of positional arguments. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0220)

### Security

- Adds a verifier option to restrict Key Binding JWT algorithms; allowedIssuerAlgorithms applies only to issuer-signed JWTs. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0220)

### New APIs and options

- Provides structured time-check details, including the claim, its value, current time, allowed clock skew, and maximum age when applicable. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0220)

### Fixes and other changes

- Issuer algorithm restrictions apply to issuer-signed JWTs, not Key Binding JWTs or Status List Tokens; status-list signatures remain verified by the configured status verifier. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0220)
- Time-check failures identify the Key Binding JWT and use dedicated expired, not-yet-valid, and too-old error codes. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0220)
- Uses the code on SDJWTException rather than matching message substrings; errors without a code are reported as UNKNOWN_ERROR. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0220)

## @sd-jwt/core 0.21

### New APIs and options

- Adds the standard RFC 7519 aud and jti claims to the payload type. (0.21.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0211)

### Fixes and other changes

- Propagates the ExtendedPayload generic through getClaims, improving payload typing. (0.21.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0211)
- Propagates the ExtendedPayload generic through keys, improving payload typing. (0.21.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0211)
- Propagates the ExtendedPayload generic through presentableKeys, improving payload typing. (0.21.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0211)
- Propagates the ExtendedPayload generic through decode, improving payload typing. (0.21.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0211)
- Nested disclosure values are cloned before recursive unpacking, preventing mutation during unpack. (0.21.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-core/CHANGELOG.md#0211)