[gabref]

CI currently does not check Rust dependencies for advisories or enforce license and source policies. Add a dedicated cargo-deny job on pushes and pull requests, installing pinned cargo-deny 0.20.2 and using the Rust toolchain declared in rust-toolchain.toml.

The policy checks all platforms and development dependencies, rejects wildcard dependencies and unapproved sources, and reports duplicate versions as warnings. Update affected dependencies, raise the Tokio and time minimum versions, replace the yanked spin version, and document two upstream exceptions: proc-macro-error and glib in Tauri's GTK stack.

Closes #74

[velocitysystems]

Please squash the review follow-up commits into the commits they amend before merge:

• fix: refresh example Tokio lockfiles into fix: update vulnerable Rust dependencies
• ci: run pinned cargo-deny directly on push and PR into ci: check Rust dependencies with cargo-deny

[velocitysystems]

Can we tighten this section? deny.toml is the source of truth for what's checked, and listing its settings here will drift.

Suggested change

	Rust dependency policy is checked on pushes, pull requests, and weekly against the
	committed workspace lockfile. Install cargo-deny and run the same check locally:
	```bash
	cargo install cargo-deny --version 0.20.2 --locked
	cargo deny --workspace --all-features --locked check
	```
	`deny.toml` checks advisories, licenses, duplicate versions, and dependency sources
	across all platforms, including development dependencies and optional features.
	Duplicate versions produce warnings; wildcard dependencies and unapproved sources fail
	the check. The example apps have separate lockfiles and are not included in this
	workspace audit.
	Update affected dependencies before adding advisory exceptions. Each exception must
	identify the upstream constraint and explain why an update cannot resolve it. Remove
	exceptions when upstream dependencies no longer require them. Review license additions
	and allow only the registries and Git repositories the workspace needs.
	Rust dependencies are checked with cargo-deny on every push and pull request. The example
	apps have their own lockfiles and are not checked. Run the same check locally:
	```bash
	cargo install cargo-deny@0.20.2 --locked
	cargo deny --workspace --all-features --locked check
	```
	Fix advisories by updating the dependency where possible. Any exception in `deny.toml`
	must say why an update cannot resolve it.

[gabref]

Shortened the section as suggested, leaving policy details in deny.toml and removing the stale weekly-check wording.

[velocitysystems]

Let's standardise on cargo-deny 0.20.2, the latest release, across the plugins.

Suggested change

	run: cargo install cargo-deny@0.19.8 --locked
	run: cargo install cargo-deny@0.20.2 --locked

[gabref]

Updated CI to install cargo-deny 0.20.2, matching the README.