Update dependency @openid4vc/oauth2 to v0.7.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@openid4vc/oauth2 (source)	0.6.0 → 0.7.0

---

Release Notes

openwallet-foundation-labs/identity-common-ts (@​openid4vc/oauth2)

v0.7.0

Minor Changes

• 222ed67: Unify the clock skew option name to allowedSkewInSeconds and add a server-level default.

  • Breaking: the DPoP allowedClockSkewSeconds option is renamed to allowedSkewInSeconds. This applies to verifyDpopJwt and to the dpop options of verifyPushedAuthorizationRequest, verifyAuthorizationChallengeRequest, the verify*AccessTokenRequest methods and verifyResourceRequest.
  • Add allowedSkewInSeconds to Oauth2AuthorizationServer as the default allowed clock skew for DPoP and client attestation verification in verifyPushedAuthorizationRequest, verifyAuthorizationChallengeRequest, the verify*AccessTokenRequest methods, verifyDpopJwt and verifyClientAttestation. A per-call allowedSkewInSeconds in the DPoP or client attestation options overrides the server default, including 0.
  • The verify*AccessTokenRequest methods now pass now to DPoP proof verification, so the DPoP iat checks use the provided time instead of the current time.

Patch Changes

• 1beaa04: Normalize the htu claim of a DPoP proof the same way as the request URL before comparing them, so query and fragment are ignored (RFC 9449 §4.3) and an uppercase host or explicit default port no longer cause a mismatch (RFC 3986 §6.2.2, §6.2.3). zHttpsUrl now accepts the URL scheme case-insensitively (RFC 3986 §3.1).

• c0107e4: Allow configuring clock skew for client attestation verification on the authorization server.

  • Add optional allowedSkewInSeconds (default 0) to the clientAttestation options of verifyPushedAuthorizationRequest, verifyAuthorizationChallengeRequest and the verify*AccessTokenRequest methods. It is applied to the nbf and exp checks of both the Client Attestation JWT and the Client Attestation PoP JWT, including the DPoP-bound attest_jwt_client_auth_dpop method.
  • verifyClientAttestationJwt now honours its allowedSkewInSeconds option, which was previously ignored.

• Updated dependencies [1beaa04]

• Updated dependencies [5d2179b]

  • @​openid4vc/utils@0.7.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Wednesday (* 0-6 * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.