The core RFCs appeared together in May 2015: JWS (7515), JWE (7516), JWK (7517), JWA (7518), JWT (7519) and worked examples (7520). Later additions include unencoded payloads (7797), JWK thumbprints (7638), OKP keys for Ed25519 and X25519 (8037), ES256K (8812), JWT best practices (8725) and fully specified algorithms (9864). The JOSE working group now also develops JSON Web Proofs for selective disclosure and zero-knowledge credentials.
Its CBOR sibling is COSE, used where compact binary encoding matters (WebAuthn, mdoc, CWT). Mature JOSE libraries include jose (JavaScript), Nimbus JOSE + JWT (Java), golang-jwt and go-jose (Go), PyJWT and Authlib or joserfc (Python) and Microsoft.IdentityModel (.NET).