diff --git a/pyproject.toml b/pyproject.toml
index 0b743a1fe..e73a51aa2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -143,13 +143,14 @@ dependencies = [
     "pygments>=2.20.0",                 # CVE-2026-4539 (>=2.20.0); transitive via rich
     "cryptography>=46.0.7",             # CVE-2026-39892 (>=46.0.7); transitive via pyjwt[crypto]
     "pydicom>=3.0.2",                   # CVE-2026-32711 (>=3.0.2); transitive via dicomweb-client/wsidicom/highdicom
-    "pyasn1>=0.6.3",                    # CVE-2026-30922 (>=0.6.3); transitive via cryptography
+    "pyasn1>=0.6.5",                    # CVE-2026-30922 (>=0.6.3); CVE-2026-119194..7 (>=0.6.5); transitive via cryptography
     "lxml-html-clean>=0.4.4",           # CVE-2026-28348, CVE-2026-28350 (>=0.4.4); transitive via html-sanitizer
     "python-multipart>=0.0.26",         # CVE-2026-24486 (>=0.0.22), CVE-2026-40347 (>=0.0.26); transitive via fastapi/starlette
     "protobuf>=6.33.5",                 # CVE-2026-0994 (>=6.33.5); transitive via google-cloud-storage/sentry-sdk
     "opentelemetry-api>=1.45.1",        # CVE-2026-114603 (>=1.45.1); transitive via google-api-core/fastmcp
     "authlib>=1.9.1",                   # CVE-2026-96760, CVE-2026-114615, CVE-2026-114617, CVE-2026-114618, CVE-2026-114620 (>=1.9.0); CVE-2026-114616 (>=1.9.1); transitive via fastmcp
     "dnspython>=2.9.0",                 # CVE-2026-114605; transitive via email-validator
+    "joserfc>=1.7.6",                   # CVE-2026-119284 (>=1.7.6); transitive via authlib/fastmcp
 ]
 
 [project.optional-dependencies]
diff --git a/uv.lock b/uv.lock
index d367bfb7c..e63f0fab5 100644
--- a/uv.lock
+++ b/uv.lock
@@ -71,6 +71,7 @@ dependencies = [
     { name = "humanize" },
     { name = "idc-index-data" },
     { name = "ijson" },
+    { name = "joserfc" },
     { name = "jsf" },
     { name = "jsonschema", extra = ["format-nongpl"] },
     { name = "loguru" },
@@ -217,6 +218,7 @@ requires-dist = [
     { name = "idc-index-data", specifier = "==24.0.3" },
     { name = "ijson", specifier = ">=3.4.0.post0,<4" },
     { name = "ipython", marker = "extra == 'marimo'", specifier = ">=9.8.0,<10" },
+    { name = "joserfc", specifier = ">=1.7.6" },
     { name = "jsf", specifier = ">=0.11.2,<1" },
     { name = "jsonschema", extras = ["format-nongpl"], specifier = ">=4.25.1,<5" },
     { name = "jupyter", marker = "extra == 'jupyter'", specifier = ">=1.1.1,<2" },
@@ -244,7 +246,7 @@ requires-dist = [
     { name = "protobuf", specifier = ">=6.33.5" },
     { name = "psutil", specifier = ">=7.1.3,<8" },
     { name = "pyarrow", marker = "python_full_version >= '3.14'", specifier = ">=23.0.1,<26" },
-    { name = "pyasn1", specifier = ">=0.6.3" },
+    { name = "pyasn1", specifier = ">=0.6.5" },
     { name = "pydantic-settings", specifier = ">=2.12.0,<3" },
     { name = "pydicom", specifier = ">=3.0.2" },
     { name = "pygments", specifier = ">=2.20.0" },
@@ -3268,14 +3270,14 @@ wheels = [
 
 [[package]]
 name = "joserfc"
-version = "1.7.5"
+version = "1.7.7"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/19/94/80fea1514b7c6d7d37804d3fe9ca81455f633347fc98731bd71ffe1faa17/joserfc-1.7.5.tar.gz", hash = "sha256:d5ff536e658e17664f8c1b1ab60dc4aa62aa973fcef1edd33cc44bda45d6f5ea", size = 234990, upload-time = "2026-08-29T13:05:42.057Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/bd/15/48ff246732232d35ee234228def22b52455fcc55577f06146602399a29b0/joserfc-1.7.7.tar.gz", hash = "sha256:471d0fd12a5a0d1c0942de280f39efe6f597878315033270b504d4d006d25510", size = 237446, upload-time = "2026-10-19T00:30:29.974Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/67/c5/82addfd375e5ee6520644e0553e4aadde92d668c4fc99cc716d337fe7bb3/joserfc-1.7.5-py3-none-any.whl", hash = "sha256:add2c2c84e8373b084d526a8b53daba5d7a513a118cd2dcd9fc9f979d0922159", size = 71269, upload-time = "2026-08-29T13:05:40.718Z" },
+    { url = "https://files.pythonhosted.org/packages/df/9f/934db284aa22f37af59708e382903860d4b81329c137b1b0ed2745daeb65/joserfc-1.7.7-py3-none-any.whl", hash = "sha256:06979cfbab78bc802f14c0358f32969826cc26720e13cb38926ffdc86bc0cb2c", size = 71758, upload-time = "2026-10-19T00:30:28.498Z" },
 ]
 
 [[package]]
@@ -5768,11 +5770,11 @@ wheels = [
 
 [[package]]
 name = "pyasn1"
-version = "0.6.4"
+version = "0.6.5"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a4/9a/23310166d960def5897e91fe20e5b724601b02a22e84ba1f94232c0b7f67/pyasn1-0.6.4.tar.gz", hash = "sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81", size = 151262, upload-time = "2026-07-09T01:12:33.988Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/88/7e/3c0da41061a2021cac7cd524fd57092adbe5b515e8bf9005702e366802e2/pyasn1-0.6.5.tar.gz", hash = "sha256:6b11616a6bcf3a40e635f082bb232fa57b5e0dd7f517bd7ddd69ec3794508a47", size = 155152, upload-time = "2026-10-27T06:32:49.125Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9a/3b/6163796d69c3977d1e4287bea4a6979161cbbdd170ebb430511e8e1999ce/pyasn1-0.6.4-py3-none-any.whl", hash = "sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b", size = 84410, upload-time = "2026-07-09T01:12:32.92Z" },
+    { url = "https://files.pythonhosted.org/packages/19/1f/3eefd5c84c35cae44549ce1c7f7e58f7945b34f5a6bce07a135438522073/pyasn1-0.6.5-py3-none-any.whl", hash = "sha256:4017b0fce125096b8573b39c989fdb1a4b19cf761e683398184550fea0e66587", size = 84807, upload-time = "2026-10-27T06:32:48.045Z" },
 ]
 
 [[package]]