JWE between Android/iPhone and backend
node-jose only supports RSA OAEP with SHA-1 and no MGF1 or RSA OAEP with SHA-256 and no MGF1


That's extremely unlikely since OAEP does need to use a Mask Generation Function, and there is only one defined: MGF1. So maybe it doesn't specify it explicitly, but it really must support it to be called OAEP.


  But I'm wondering about RSA OAEP SHA-1. Nimbus JOSE deprecated it, is it discouraged to use it? Has it been proven vulnerable?


No. Best to compare MGF1 with an expanding key derivation function probably. For this kind of use SHA-1 is still secure, even though the relatively small output size doesn't help. It certainly doesn't depend on the collision resistance. 

However, I've had plenty of entities asking to deprecate SHA-1 in its entirety. The problem is that it is a huge red flag for auditors, who then have to look if the use of the hash is secure. And, to be honest, many auditors wouldn't know how to qualify if it is secure or not, so they see it as an avoidable risk. Which, to be honest, it probably is.


  But perhaps I'm going around this all wrong?


I don't know, it seems that Apple supports RSA for encryption if I look at the description here.