diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d4db65..e90c224 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.1.7
+
+- Security: dela-mcp now pins zod 4.6.7 (memory exhaustion on oversized constrained collections, GHSA for zod < 4.6.6) and the MCP SDK 1.32.2; fast-uri 3.1.9 and serialize-javascript 7.1.4 in the lockfile (Dependabot #34–#36).
+
 ## 1.1.6
 
 - Android: quick add opened from the widget or the quick settings tile now shows the keyboard right away; before, the field had the cursor but you had to tap it.
diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock
index 8449e02..5232a3b 100644
--- a/apps/desktop/src-tauri/Cargo.lock
+++ b/apps/desktop/src-tauri/Cargo.lock
@@ -940,7 +940,7 @@ dependencies = [
 
 [[package]]
 name = "dela-desktop"
-version = "1.1.6"
+version = "1.1.7"
 dependencies = [
  "cpal",
  "libloading 0.9.0",
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
index f5ce8f1..58f4e7f 100644
--- a/apps/desktop/src-tauri/Cargo.toml
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dela-desktop"
-version = "1.1.6"
+version = "1.1.7"
 description = "Dela, a task manager with end-to-end encryption"
 edition = "2021"
 license = "AGPL-3.0-only"
diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
index b99722e..5520774 100644
--- a/apps/desktop/src-tauri/tauri.conf.json
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Dela",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "identifier": "io.github.olerast67.dela",
   "build": {
     "frontendDist": "../../web/dist",
diff --git a/apps/mobile/android/app/build.gradle b/apps/mobile/android/app/build.gradle
index 13daf26..dd7c1bd 100644
--- a/apps/mobile/android/app/build.gradle
+++ b/apps/mobile/android/app/build.gradle
@@ -13,8 +13,8 @@ android {
         applicationId "io.github.olerast67.dela"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 24
-        versionName "1.1.6"
+        versionCode 25
+        versionName "1.1.7"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         // Встроенное обновление из выпусков GitHub. Сборка для F-Droid (-PdelaFdroid) его выключает: там обновляет F-Droid.
         buildConfigField "boolean", "SELF_UPDATE", project.hasProperty('delaFdroid') ? 'false' : 'true'
diff --git a/apps/mobile/package.json b/apps/mobile/package.json
index 1a002b6..3a9ceea 100644
--- a/apps/mobile/package.json
+++ b/apps/mobile/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dela-mobile",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "private": true,
   "license": "AGPL-3.0-only",
   "dependencies": {
diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
index 2f2e478..4a5afb2 100644
--- a/apps/server/src/app.ts
+++ b/apps/server/src/app.ts
@@ -27,7 +27,7 @@ import { generateVapid, isAllowedEndpoint, loadVapid, sendPush } from './webpush
 import { newTotpSecret, otpauthUri, verifyTotp } from './totp.ts';
 import { EMAIL_RE, UUID_RE, b64, bad, int, obj, optStr, str } from './validate.ts';
 
-export const VERSION = '1.1.6';
+export const VERSION = '1.1.7';
 
 interface Auth {
   readonly userId: string;
diff --git a/apps/wear/app/build.gradle b/apps/wear/app/build.gradle
index 026229c..65e8738 100644
--- a/apps/wear/app/build.gradle
+++ b/apps/wear/app/build.gradle
@@ -39,8 +39,8 @@ android {
         // Wear OS 3 и новее.
         minSdk 30
         targetSdk 36
-        versionCode 12
-        versionName '1.1.6'
+        versionCode 13
+        versionName '1.1.7'
         // Часы — ARM; x86_64 только для эмулятора в отладочной сборке.
         ndk { abiFilters 'arm64-v8a', 'armeabi-v7a' }
         buildConfigField 'String', 'GIT_BUILD', "\"${buildId}\""
diff --git a/e2e/calendar-views.spec.ts b/e2e/calendar-views.spec.ts
index d05db86..645fe1c 100644
--- a/e2e/calendar-views.spec.ts
+++ b/e2e/calendar-views.spec.ts
@@ -54,7 +54,8 @@ test('календарь: три дня и задачи без даты из б
 
   // Месяц: бросок на день даёт дату без времени.
   await page.getByRole('tab', { name: 'Месяц' }).click();
-  const cell = page.locator('.cal-cell:not(.other)').nth(27);
+  // Последний день месяца не раньше сегодня: на прошедший день задача стала бы просроченной и осталась в панели.
+  const cell = page.locator('.cal-cell:not(.other)').last();
   await side.locator('.cal-chip', { hasText: 'Починить кран' }).dragTo(cell);
   await expect(cell.locator('.cal-chip', { hasText: 'Починить кран' })).toBeVisible();
   await expect(side.locator('.cal-chip', { hasText: 'Починить кран' })).toHaveCount(0);
diff --git a/e2e/calendar.spec.ts b/e2e/calendar.spec.ts
index 7bb0c29..760b1bc 100644
--- a/e2e/calendar.spec.ts
+++ b/e2e/calendar.spec.ts
@@ -66,8 +66,13 @@ test('календарь: планирование дня перетаскива
   await page.getByRole('tab', { name: 'Месяц' }).click();
   const ролик = page.locator('.cal-month .cal-chip', { hasText: 'Записать ролик' });
   await expect(ролик).toContainText('15:00');
+  // День в прошлом сделал бы задачу просроченной, и календарь показал бы её на сегодня: цель — последний день
+  // месяца, а если «завтра» и есть последний день, то сегодня.
   const cells = page.locator('.cal-cell:not(.other)');
-  const target = cells.nth(27);
+  const moscow = (d: Date) => new Intl.DateTimeFormat('en-CA', { timeZone: 'Europe/Moscow' }).format(d);
+  const tomorrow = moscow(new Date(Date.now() + 24 * 3600_000));
+  const lastIsTomorrow = (await cells.last().getByRole('button', { name: /^Открыть день / }).getAttribute('aria-label'))?.endsWith(tomorrow);
+  const target = lastIsTomorrow ? page.locator('.cal-cell', { has: page.getByRole('button', { name: `Открыть день ${moscow(new Date())}` }) }) : cells.last();
   await ролик.dragTo(target);
   await expect(target.locator('.cal-chip', { hasText: 'Записать ролик' })).toContainText('15:00');
   if (process.env.SHOTS) await page.screenshot({ path: `${process.env.SHOTS_DIR ?? 'test-results/shots'}/cal-month.png` });
diff --git a/fastlane/metadata/android/en-US/changelogs/25.txt b/fastlane/metadata/android/en-US/changelogs/25.txt
new file mode 100644
index 0000000..d05545e
--- /dev/null
+++ b/fastlane/metadata/android/en-US/changelogs/25.txt
@@ -0,0 +1 @@
+Dependency security updates.
diff --git a/fastlane/metadata/android/ru-RU/changelogs/25.txt b/fastlane/metadata/android/ru-RU/changelogs/25.txt
new file mode 100644
index 0000000..f666cda
--- /dev/null
+++ b/fastlane/metadata/android/ru-RU/changelogs/25.txt
@@ -0,0 +1 @@
+Обновления безопасности зависимостей.
diff --git a/package-lock.json b/package-lock.json
index 94f5317..5f2112e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5297,9 +5297,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
-      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "version": "3.1.9",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz",
+      "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
       "dev": true,
       "funding": [
         {
@@ -7912,9 +7912,9 @@
       }
     },
     "node_modules/serialize-javascript": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.2.tgz",
-      "integrity": "sha512-GL2BWwVa6JydKO6l/ljVgjAZF4QJ3S7dWDWi53s5GZT8PJzD2fNxi67HANQGKAqPrwEpL5ba7gUBGi0Ls/sEoQ==",
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.4.tgz",
+      "integrity": "sha512-FqlEuoTq/zRmA4Lg6aOqyH3lCHbUtCB0bmHCeFniX2GBdDqMJM3FwdvEhlE5Pim1dlt2FfBdVPmUNNiGhhKqpw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index a8dcdd6..f44a978 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -34,8 +34,8 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.32.1",
+    "@modelcontextprotocol/sdk": "1.32.2",
     "libsodium-wrappers-sumo": "0.8.4",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   }
 }