# What changed in oauth4webapi

> 12 changes in oauth4webapi 3 from its official release notes, upgrade guides and advisories: 1 security. Each one cited. Sources checked 2026-10-23. HTML: https://unstale.sh/npm/oauth4webapi/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## oauth4webapi 3

### Security

- ID Token subjects and DPoP identifiers are now validated as strings. (3.8.8) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.8)

### Performance

- Imported issuer verification keys are cached by algorithm. (3.8.8) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.8)
- Compatible in-flight JWKS requests are coalesced. (3.8.8) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.8)

### Fixes and other changes

- Explicit auth-time skips in authorization responses are now honored. (3.8.8) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.8)
- Credentials with runs of spaces are now accepted. (3.8.8) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.8)
- DPoP nonce errors are now recognized when multiple challenges are present. (3.8.8) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.8)
- Quoted pairs in HTTP authentication are now decoded correctly. (3.8.8) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.8)
- CryptoKey declarations are made portable. (3.8.7) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.7)
- The custom fetch duplex option is exposed in the types. (3.8.7) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.7)
- JWK declarations are made interoperable. (3.8.7) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.7)
- A missing header.jwk in a DPoP Proof JWT now produces an OPE instead of a TypeError. (3.8.6) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.6)
- Two ResourceServer metadata typings are fixed. (3.8.6) — [release notes](https://github.com/panva/oauth4webapi/releases/tag/v3.8.6)