diff --git a/osv-scanner.toml b/osv-scanner.toml
index 482254d4da6..9bb346a94f9 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -7,3 +7,13 @@ reason = "diskcache has no fixed release published; remove this entry once one e
 id = "GHSA-h7x2-h6g9-p789"
 ignoreUntil = 2026-10-14
 reason = "mlflow has no fixed release published (3.16.0, 2026-09-04, and master still store gateway secret api_base unvalidated); remove this entry once one exists"
+
+[[IgnoredVulns]]
+id = "GHSA-hj66-6f7g-4r5v"
+ignoreUntil = 2026-10-02
+reason = "oauthlib 4.0.0 (the only fixed release, 2026-09-28) is inside the 3-day uv exclude-newer cooldown; bump oauthlib and remove this entry once it clears"
+
+[[IgnoredVulns]]
+id = "GHSA-xpv3-w29h-x7cv"
+ignoreUntil = 2026-10-02
+reason = "oauthlib 4.0.0 (the only fixed release, 2026-09-28) is inside the 3-day uv exclude-newer cooldown; bump oauthlib and remove this entry once it clears"
diff --git a/ui/litellm-dashboard/package-lock.json b/ui/litellm-dashboard/package-lock.json
index 0b71b51dc3f..03e29c02021 100644
--- a/ui/litellm-dashboard/package-lock.json
+++ b/ui/litellm-dashboard/package-lock.json
@@ -24,7 +24,7 @@
         "dayjs": "1.11.19",
         "jwt-decode": "4.0.0",
         "lucide-react": "0.513.0",
-        "moment": "2.30.1",
+        "moment": "2.31.0",
         "next": "16.3.3",
         "next-themes": "^0.4.6",
         "nuqs": "^2.9.4",
@@ -4965,9 +4965,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9646,9 +9646,9 @@
       }
     },
     "node_modules/moment": {
-      "version": "2.30.1",
-      "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
-      "integrity": "sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==",
+      "version": "2.31.0",
+      "resolved": "https://registry.npmjs.org/moment/-/moment-2.31.0.tgz",
+      "integrity": "sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==",
       "license": "MIT",
       "engines": {
         "node": "*"
diff --git a/ui/litellm-dashboard/package.json b/ui/litellm-dashboard/package.json
index 233a0e63881..3bf32d37faf 100644
--- a/ui/litellm-dashboard/package.json
+++ b/ui/litellm-dashboard/package.json
@@ -40,7 +40,7 @@
     "dayjs": "1.11.19",
     "jwt-decode": "4.0.0",
     "lucide-react": "0.513.0",
-    "moment": "2.30.1",
+    "moment": "2.31.0",
     "next": "16.3.3",
     "next-themes": "^0.4.6",
     "nuqs": "^2.9.4",
@@ -98,7 +98,7 @@
   "overrides": {
     "prismjs": "1.30.0",
     "js-yaml": "4.3.2",
-    "brace-expansion": "5.0.9",
+    "brace-expansion": "5.0.12",
     "glob": "13.0.0",
     "minimatch": "10.2.4",
     "ws": "8.21.0",
diff --git a/uv.lock b/uv.lock
index 901c2442429..4b9dbaba39b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -7857,14 +7857,14 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.13.0"
+version = "2.14.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/af/c3/8a3b59c25070cc61dc517fbdfa5dc0904670c96f605cc69759dc09166b99/pyjwt-2.14.0.tar.gz", hash = "sha256:77283c83fb56ecf566a886c757a714bc83668e38156de2cce8263302f42e0b86", size = 113177, upload-time = "2026-09-11T13:11:54.638Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/97/672cb32ce0dfea44b740cb7b4f97038463b9cf7c0ead1aacf595572851d6/pyjwt-2.14.0-py3-none-any.whl", hash = "sha256:ad0cef71c756a56e74863c2919cf0985f72decbcfcb550ee2f422e7c62b5eedc", size = 32896, upload-time = "2026-09-11T13:11:53.409Z" },
 ]
 
 [package.optional-dependencies]