## What happened
I am implementing the PKCE OAuth flow with dropbox-sdk-js 9.x in a browser app. I generate the auth URL with `getAuthenticationUrl` and the code challenge, save the `code_verifier`, and after redirect the token exchange rejects the `code_verifier`. The exact same code works on 8.x. Did 9.x break PKCE?
## The fix that worked
Yes, the PKCE flow was broken in dropbox-sdk-js 9.x — the token exchange rejected the `code_verifier` even though the same code worked on 8.x, and multiple users hit it at the same time. Downgrading to 8.x was the confirmed workaround while it was broken. The fix shipped in v9.4.0, so update to 9.4.0 or newer. After updating, follow the official PKCE-in-the-browser example in the repo (examples/javascript/pkce-browser) to make sure your flow matches the supported shape.