chore(release): new version (#247)

Signed-off-by: "github-actions[bot]" <"41898282+github-actions[bot]@users.noreply.github.com">

Author: github-actions[bot]

.changeset/key-attestation-spec-conformance.md

@@ -1,5 +1,17 @@
 # @openid4vc/oauth2
 
+## 0.5.2
+
+### Patch Changes
+
+- 33adaf0: Align wallet (client) attestation with draft 09 of OAuth 2.0 Attestation-Based Client Authentication.
+
+  - Client Attestation and Client Attestation PoP JWTs no longer emit the `iss` claim (removed in draft 08). Verification still accepts legacy JWTs that include `iss`.
+  - The Client Attestation PoP JWT uses the `challenge` claim (renamed from `nonce` in draft 06) and no longer includes `exp` (removed in draft 06). Verification accepts either `challenge` or the legacy `nonce`. The `nonce`/`expectedNonce` options are deprecated aliases for `challenge`/`expectedChallenge`.
+  - Added authorization server metadata parameters `client_attestation_signing_alg_values_supported` and `client_attestation_pop_signing_alg_values_supported` (draft 07), the `challenge_endpoint` parameter, the `attest_jwt_client_auth_dpop` authentication method, and the `OAuth-Client-Attestation-Challenge` header (draft 09).
+  - `verifyClientAttestationPopJwt` accepts an `expectedAudience` option so a resource server can verify a PoP JWT bound to its own identifier (draft 09).
+  - @openid4vc/utils@0.5.2
+
 ## 0.5.1
 
 ### Patch Changes

.changeset/small-views-clean.md

@@ -1,6 +1,6 @@
 {
   "name": "@openid4vc/oauth2",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "files": [
     "dist"
   ],

.changeset/wallet-attestation-draft-09.md

@@ -1,5 +1,21 @@
 # @openid4vc/openid4vci
 
+## 0.5.2
+
+### Patch Changes
+
+- 78cdbca: Bring key attestations in line with the OpenID4VCI 1.0/1.1 key attestation format.
+
+  - Emit `key-attestation+jwt` as the `typ` when creating a key attestation (previously the pre-final `keyattestation+jwt`). Verification still accepts the legacy value.
+  - Fix an inverted validation that rejected a JWT header carrying both `trust_chain` and `kid`; the spec requires `kid` to be present when `trust_chain` is used for signature verification (fixed for both the key attestation and the `jwt` proof type headers).
+  - Require `attested_keys` (and, when present, `key_storage`/`user_authentication`) to be non-empty arrays.
+  - Make the `nonce` claim optional at the schema level; it is only required when the Credential Issuer has a Nonce Endpoint, which is enforced via `expectedNonce` during verification.
+
+- fe01c0d: Fix credential response check to match spec definition
+- Updated dependencies [33adaf0]
+  - @openid4vc/oauth2@0.5.2
+  - @openid4vc/utils@0.5.2
+
 ## 0.5.1
 
 ### Patch Changes

packages/oauth2/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@openid4vc/openid4vci",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "files": [
     "dist"
   ],

packages/oauth2/package.json

@@ -1,5 +1,13 @@
 # @openid4vc/openid4vp
 
+## 0.5.2
+
+### Patch Changes
+
+- Updated dependencies [33adaf0]
+  - @openid4vc/oauth2@0.5.2
+  - @openid4vc/utils@0.5.2
+
 ## 0.5.1
 
 ### Patch Changes

packages/openid4vci/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@openid4vc/openid4vp",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "files": [
     "dist"
   ],

packages/openid4vci/package.json

@@ -1,5 +1,7 @@
 # @openid4vc/utils
 
+## 0.5.2
+
 ## 0.5.1
 
 ## 0.5.0