npm / @sd-jwt/sd-jwt-vc
@sd-jwt/sd-jwt-vc
What changed in @sd-jwt/sd-jwt-vc 0.21 to 0.23, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.
8 breaking1 security6 new APIs and options1 behavior and defaults5 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@sd-jwt/sd-jwt-vc 0.233 changes
Breaking changes 3
The CommonJS build is no longer published; only ESM is published, avoiding dual-package hazards in single-module-system runtimes.
The digest is compared as base64 instead of hex; with multiple hashes, only the strongest supported algorithm is checked, and any of its values may match. Metadata without a supported algorithm is rejected.
The digest is compared as base64 instead of hex; with multiple hashes, only the strongest supported algorithm is checked, and any of its values may match. Metadata without a supported algorithm is rejected.
@sd-jwt/sd-jwt-vc 0.2215 changes
Breaking changes 5
Credential expectedAudience no longer constrains the Key Binding JWT.
Applies to the issuer-signed SD-JWT payload rather than the Key Binding JWT or Status List Token.
Applies to the issuer-signed SD-JWT payload rather than the Key Binding JWT or Status List Token.
The constructor now takes an options object containing details, code, and cause instead of positional arguments.
verify and safeVerify reject a Status List Token with a missing or wrong typ header before verifying its signature; statuslist+jwt and application/statuslist+jwt are accepted.
Security 1
Use this option to constrain the Key Binding JWT's audience.
New APIs and options 4
Time-check failures throw JwtTimeClaimException with details describing the claim, value, current time, allowed clock skew, and maximum age where applicable.
SDJwtVcInstance and SDJWTVCConfig now take custom verification options as a type parameter, so options passed to verifier and statusVerifier are typed.
A credential whose status is not valid fails with code STATUS_INVALID and details containing uri, idx, and status.
The custom statusValidator receives the URI and index as a second argument.
Behavior and default changes 1
No longer constrains the Key Binding JWT or Status List Token; the Status List Token signature remains verified by the configured status verifier.
Fixes and other changes 4
Applies to the issuer-signed SD-JWT payload rather than the Key Binding JWT or Status List Token.
Applies to the issuer-signed SD-JWT payload rather than the Key Binding JWT or Status List Token.
Uses an SDJWTException's code for status and type metadata check failures; errors without a code fall back to STATUS_VERIFICATION_FAILED or VCT_VERIFICATION_FAILED.
When a status list token fails verification, the exception includes the status list URI in details and the original exception as cause.
@sd-jwt/sd-jwt-vc 0.213 changes
New APIs and options 2
Added the standard RFC 7519 aud claim to SdJwtVcPayload.
Added the standard RFC 7519 jti claim to SdJwtVcPayload.
Fixes and other changes 1
Propagated the ExtendedPayload generic through SDJwtInstance.decode, keys, presentableKeys, and getClaims, preserving the payload type across these APIs.