# What changed in @sd-jwt/sd-jwt-vc

> 21 changes in @sd-jwt/sd-jwt-vc 0.21 to 0.23 from its official release notes, upgrade guides and advisories: 8 breaking, 1 security, 6 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/@sd-jwt/sd-jwt-vc/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @sd-jwt/sd-jwt-vc 0.23

### Breaking changes

- The CommonJS build is no longer published; only ESM is published, avoiding dual-package hazards in single-module-system runtimes. (0.23.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0230)
- The digest is compared as base64 instead of hex; with multiple hashes, only the strongest supported algorithm is checked, and any of its values may match. Metadata without a supported algorithm is rejected. (0.23.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0230)
- The digest is compared as base64 instead of hex; with multiple hashes, only the strongest supported algorithm is checked, and any of its values may match. Metadata without a supported algorithm is rejected. (0.23.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0230)

## @sd-jwt/sd-jwt-vc 0.22

### Breaking changes

- Credential expectedAudience no longer constrains the Key Binding JWT. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- Applies to the issuer-signed SD-JWT payload rather than the Key Binding JWT or Status List Token. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- Applies to the issuer-signed SD-JWT payload rather than the Key Binding JWT or Status List Token. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- The constructor now takes an options object containing details, code, and cause instead of positional arguments. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- verify and safeVerify reject a Status List Token with a missing or wrong typ header before verifying its signature; statuslist+jwt and application/statuslist+jwt are accepted. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)

### Security

- Use this option to constrain the Key Binding JWT's audience. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)

### New APIs and options

- Time-check failures throw JwtTimeClaimException with details describing the claim, value, current time, allowed clock skew, and maximum age where applicable. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- SDJwtVcInstance and SDJWTVCConfig now take custom verification options as a type parameter, so options passed to verifier and statusVerifier are typed. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- A credential whose status is not valid fails with code STATUS_INVALID and details containing uri, idx, and status. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- The custom statusValidator receives the URI and index as a second argument. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)

### Behavior and default changes

- No longer constrains the Key Binding JWT or Status List Token; the Status List Token signature remains verified by the configured status verifier. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)

### Fixes and other changes

- Applies to the issuer-signed SD-JWT payload rather than the Key Binding JWT or Status List Token. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- Applies to the issuer-signed SD-JWT payload rather than the Key Binding JWT or Status List Token. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- Uses an SDJWTException's code for status and type metadata check failures; errors without a code fall back to STATUS_VERIFICATION_FAILED or VCT_VERIFICATION_FAILED. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)
- When a status list token fails verification, the exception includes the status list URI in details and the original exception as cause. (0.22.0) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0220)

## @sd-jwt/sd-jwt-vc 0.21

### New APIs and options

- Added the standard RFC 7519 aud claim to SdJwtVcPayload. (0.21.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0211)
- Added the standard RFC 7519 jti claim to SdJwtVcPayload. (0.21.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0211)

### Fixes and other changes

- Propagated the ExtendedPayload generic through SDJwtInstance.decode, keys, presentableKeys, and getClaims, preserving the payload type across these APIs. (0.21.1) — [release notes](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/4f0b8736a475d2b457d8c7d770df0e65187661d9/packages/sd-jwt-vc/CHANGELOG.md#0211)