chore(release): new version

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@openid4vc/oauth2@0.5.2

Patch Changes

• 33adaf0: Align wallet (client) attestation with draft 09 of OAuth 2.0 Attestation-Based Client Authentication.

  • Client Attestation and Client Attestation PoP JWTs no longer emit the iss claim (removed in draft 08). Verification still accepts legacy JWTs that include iss.
  • The Client Attestation PoP JWT uses the challenge claim (renamed from nonce in draft 06) and no longer includes exp (removed in draft 06). Verification accepts either challenge or the legacy nonce. The nonce/expectedNonce options are deprecated aliases for challenge/expectedChallenge.
  • Added authorization server metadata parameters client_attestation_signing_alg_values_supported and client_attestation_pop_signing_alg_values_supported (draft 07), the challenge_endpoint parameter, the attest_jwt_client_auth_dpop authentication method, and the OAuth-Client-Attestation-Challenge header (draft 09).
  • verifyClientAttestationPopJwt accepts an expectedAudience option so a resource server can verify a PoP JWT bound to its own identifier (draft 09).
  • @openid4vc/utils@0.5.2

@openid4vc/openid4vci@0.5.2

Patch Changes

• 78cdbca: Bring key attestations in line with the OpenID4VCI 1.0/1.1 key attestation format.

  • Emit key-attestation+jwt as the typ when creating a key attestation (previously the pre-final keyattestation+jwt). Verification still accepts the legacy value.
  • Fix an inverted validation that rejected a JWT header carrying both trust_chain and kid; the spec requires kid to be present when trust_chain is used for signature verification (fixed for both the key attestation and the jwt proof type headers).
  • Require attested_keys (and, when present, key_storage/user_authentication) to be non-empty arrays.
  • Make the nonce claim optional at the schema level; it is only required when the Credential Issuer has a Nonce Endpoint, which is enforced via expectedNonce during verification.

• fe01c0d: Fix credential response check to match spec definition

• Updated dependencies [33adaf0]

  • @openid4vc/oauth2@0.5.2
  • @openid4vc/utils@0.5.2

@openid4vc/openid4vp@0.5.2

Patch Changes

• Updated dependencies [33adaf0]
  • @openid4vc/oauth2@0.5.2
  • @openid4vc/utils@0.5.2

@openid4vc/utils@0.5.2