npm / oauth4webapi
oauth4webapi
What changed in oauth4webapi 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-23.
1 security2 performance9 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initoauth4webapi 312 changes
Security 1
ID Token subjects and DPoP identifiers are now validated as strings.
Performance 2
Imported issuer verification keys are cached by algorithm.
Compatible in-flight JWKS requests are coalesced.
Fixes and other changes 9
Explicit auth-time skips in authorization responses are now honored.
Credentials with runs of spaces are now accepted.
DPoP nonce errors are now recognized when multiple challenges are present.
Quoted pairs in HTTP authentication are now decoded correctly.
CryptoKey declarations are made portable.
The custom fetch duplex option is exposed in the types.
JWK declarations are made interoperable.
A missing header.jwk in a DPoP Proof JWT now produces an OPE instead of a TypeError.
Two ResourceServer metadata typings are fixed.