Recently I've added new OAuth scope for connected app in managed package. Everything was good, clients were able to install the package via the direct link. The problem appeared when I tried to push upgrade this package to clients. It turned out according to the docs new OAuth scopes will fail push upgrade, only installation via direct link is allowed.
Installation via the link isn't a real scenario for me, because we have too many customers. But on the other hand, we have to somehow propagate new package version with new OAuth scope.
So did anybody have the same situation? In what way did you deal with it?