diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bf09dba..db67b1e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,25 @@ env:
    CARGO_TERM_COLOR: always
 
 jobs:
+   cargo-deny:
+      name: Cargo Deny
+      runs-on: ubuntu-latest
+      permissions:
+         contents: read
+
+      steps:
+         - name: Checkout repository
+           uses: actions/checkout@v4
+
+         - name: Install Rust toolchain
+           run: rustup toolchain install
+
+         - name: Install cargo-deny
+           run: cargo install cargo-deny@0.20.2 --locked
+
+         - name: Check Rust dependencies
+           run: cargo deny --workspace --all-features --locked check
+
    ci:
       name: Continuous Integration
       runs-on: ubuntu-latest
diff --git a/Cargo.lock b/Cargo.lock
index 2be3294..61e1978 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -49,9 +49,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.101"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "atk"
@@ -402,15 +402,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -874,11 +865,10 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
 dependencies = [
- "concurrent-queue",
  "parking",
  "pin-project-lite",
 ]
@@ -1891,9 +1881,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.181"
+version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "459427e2af2b9c839b132acb702a1c654d95e10f8c326bfc2ad11310e458b1c5"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
 
 [[package]]
 name = "libdbus-sys"
@@ -2033,9 +2023,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "1.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
 dependencies = [
  "libc",
  "wasi",
@@ -2496,9 +2486,9 @@ checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
 [[package]]
 name = "plist"
-version = "1.8.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "740ebea15c5d1428f910cd1a5f52cebf8d25006245ed8ade92702f4943d91e07"
+checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85"
 dependencies = [
  "base64 0.22.1",
  "indexmap 2.13.0",
@@ -2628,9 +2618,9 @@ dependencies = [
 
 [[package]]
 name = "quick-xml"
-version = "0.38.4"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
 dependencies = [
  "memchr",
 ]
@@ -3181,12 +3171,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.2"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3239,9 +3229,9 @@ dependencies = [
 
 [[package]]
 name = "spin"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
 dependencies = [
  "lock_api",
 ]
@@ -3554,6 +3544,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
@@ -4026,9 +4027,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.49.0"
+version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",
@@ -4043,13 +4044,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.6.0"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 3.0.9",
 ]
 
 [[package]]
@@ -4897,15 +4898,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -4939,30 +4931,13 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
+ "windows_i686_gnullvm",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
 [[package]]
 name = "windows-threading"
 version = "0.2.1"
@@ -4993,12 +4968,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
@@ -5011,12 +4980,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
@@ -5029,24 +4992,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
@@ -5059,12 +5010,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
@@ -5077,12 +5022,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
@@ -5095,12 +5034,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
@@ -5113,12 +5046,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winnow"
 version = "0.5.40"
diff --git a/Cargo.toml b/Cargo.toml
index e096a08..8b9a7ab 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -21,8 +21,8 @@ tauri = "2.12.0"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.145"
 thiserror = "2.0.17"
-time = "0.3.44"
-tokio = { version = "1.48.0", features = ["rt", "sync", "time"] }
+time = "0.3.47"
+tokio = { version = "1.54.1", features = ["rt", "sync", "time"] }
 indexmap = { version = "2.12.1", features = ["serde"] }
 base64 = "0.22.1"
 tracing = { version = "0.1.41", default-features = false, features = ["std", "release_max_level_off"] }
@@ -32,13 +32,13 @@ uuid = { version = "1.11.0", features = ["v4"] }
 sqlx = { version = "0.9.0", features = ["sqlite", "json", "time", "runtime-tokio"] }
 
 # Connection manager
-sqlx-sqlite-conn-mgr = { path = "crates/sqlx-sqlite-conn-mgr" }
+sqlx-sqlite-conn-mgr = { path = "crates/sqlx-sqlite-conn-mgr", version = "0.9.0" }
 
 # Toolkit (high-level API — builders, transactions, decoding)
-sqlx-sqlite-toolkit = { path = "crates/sqlx-sqlite-toolkit", features = ["observer"] }
+sqlx-sqlite-toolkit = { path = "crates/sqlx-sqlite-toolkit", version = "0.9.1", features = ["observer"] }
 
 # Observer types (for payload conversion)
-sqlx-sqlite-observer = { path = "crates/sqlx-sqlite-observer", features = ["conn-mgr"] }
+sqlx-sqlite-observer = { path = "crates/sqlx-sqlite-observer", version = "0.9.1", features = ["conn-mgr"] }
 
 # Async stream support for observer subscriptions
 futures = "0.3.31"
@@ -49,5 +49,5 @@ tauri-plugin = { version = "2.7.1", features = ["build"] }
 [dev-dependencies]
 tauri = { version = "2.12.0", features = ["test"] }
 tempfile = "3.23.0"
-tokio = { version = "1.48.0", features = ["rt-multi-thread", "macros"] }
+tokio = { version = "1.54.1", features = ["rt-multi-thread", "macros"] }
 rstest = { version = "0.28.0", default-features = false }
diff --git a/README.md b/README.md
index d8a6695..2fa74b7 100644
--- a/README.md
+++ b/README.md
@@ -1383,6 +1383,17 @@ cargo test               # Run tests
 npm run standards        # Lint and standards checks
 ```
 
+Rust dependencies are checked with cargo-deny on every push and pull request. The example
+apps have their own lockfiles and are not checked. Run the same check locally:
+
+```bash
+cargo install cargo-deny@0.20.2 --locked
+cargo deny --workspace --all-features --locked check
+```
+
+Fix advisories by updating the dependency where possible. Any exception in `deny.toml`
+must say why an update cannot resolve it.
+
 ## License
 
 MIT
diff --git a/crates/sqlx-sqlite-conn-mgr/Cargo.toml b/crates/sqlx-sqlite-conn-mgr/Cargo.toml
index 948c653..36a5fc5 100644
--- a/crates/sqlx-sqlite-conn-mgr/Cargo.toml
+++ b/crates/sqlx-sqlite-conn-mgr/Cargo.toml
@@ -15,7 +15,7 @@ categories = ["database", "asynchronous"]
 [dependencies]
 sqlx = { version = "0.9.0", features = ["runtime-tokio", "sqlite", "migrate"] }
 thiserror = "2.0.17"
-tokio = { version = "1.49.0", features = ["full"] }
+tokio = { version = "1.54.1", features = ["full"] }
 tracing = { version = "0.1.44", default-features = false, features = ["std", "release_max_level_off"] }
 serde = { version = "1.0.228", features = ["derive"] }
 parking_lot = "0.12.3"
diff --git a/crates/sqlx-sqlite-observer/Cargo.toml b/crates/sqlx-sqlite-observer/Cargo.toml
index 1d6f889..192a021 100644
--- a/crates/sqlx-sqlite-observer/Cargo.toml
+++ b/crates/sqlx-sqlite-observer/Cargo.toml
@@ -20,7 +20,7 @@ bundled = ["libsqlite3-sys/bundled"]
 conn-mgr = ["dep:sqlx-sqlite-conn-mgr"]
 
 [dependencies]
-tokio = { version = "1.49.0", features = ["sync"] }
+tokio = { version = "1.54.1", features = ["sync"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
 thiserror = "2.0.17"
 tracing = { version = "0.1.44", default-features = false, features = ["std", "release_max_level_off"] }
@@ -32,7 +32,7 @@ libsqlite3-sys = { version = "0.35.0", features = ["preupdate_hook"] }
 sqlx-sqlite-conn-mgr = { path = "../sqlx-sqlite-conn-mgr", version = "0.9.0", optional = true }
 
 [dev-dependencies]
-tokio = { version = "1.49.0", features = ["full", "macros"] }
+tokio = { version = "1.54.1", features = ["full", "macros"] }
 futures = "0.3.31"
 tempfile = "3.24.0"
 tracing-subscriber = "0.3.22"
diff --git a/crates/sqlx-sqlite-toolkit/Cargo.toml b/crates/sqlx-sqlite-toolkit/Cargo.toml
index efe220f..0301c11 100644
--- a/crates/sqlx-sqlite-toolkit/Cargo.toml
+++ b/crates/sqlx-sqlite-toolkit/Cargo.toml
@@ -17,20 +17,20 @@ default = []
 observer = ["dep:sqlx-sqlite-observer"]
 
 [dependencies]
-sqlx-sqlite-conn-mgr = { path = "../sqlx-sqlite-conn-mgr" }
-sqlx-sqlite-observer = { path = "../sqlx-sqlite-observer", features = ["conn-mgr"], optional = true }
+sqlx-sqlite-conn-mgr = { path = "../sqlx-sqlite-conn-mgr", version = "0.9.0" }
+sqlx-sqlite-observer = { path = "../sqlx-sqlite-observer", version = "0.9.1", features = ["conn-mgr"], optional = true }
 sqlx = { version = "0.9.0", features = ["sqlite", "json", "time", "runtime-tokio"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 thiserror = "2.0"
 indexmap = { version = "2.12", features = ["serde"] }
 base64 = "0.22"
-time = "0.3"
+time = "0.3.47"
 uuid = { version = "1.11", features = ["v4"] }
-tokio = { version = "1.48.0", features = ["sync", "rt"] }
+tokio = { version = "1.54.1", features = ["sync", "rt"] }
 tracing = { version = "0.1", default-features = false, features = ["std", "release_max_level_off"] }
 
 [dev-dependencies]
 tempfile = "3.23.0"
-tokio = { version = "1.48.0", features = ["rt-multi-thread", "macros"] }
+tokio = { version = "1.54.1", features = ["rt-multi-thread", "macros"] }
 rstest = { version = "0.28.0", default-features = false }
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..5b4e803
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,40 @@
+# Leave targets unrestricted so platform-specific dependencies are checked too.
+[graph]
+all-features = true
+
+[advisories]
+unmaintained = "all"
+unsound = "all"
+yanked = "deny"
+
+[[advisories.ignore]]
+id = "RUSTSEC-2024-0370"
+reason = "Tauri's GTK stack uses proc-macro-error through glib-macros and gtk3-macros; no maintained compatible replacement is available upstream."
+
+[[advisories.ignore]]
+id = "RUSTSEC-2024-0429"
+reason = "Tauri's GTK 3 stack requires glib 0.18; the fix requires glib 0.20 and cannot be selected compatibly. This plugin does not use VariantStrIter. Remove when Tauri migrates its GTK stack."
+
+[licenses]
+allow = [
+   "Apache-2.0",
+   "Apache-2.0 WITH LLVM-exception",
+   "BSD-3-Clause",
+   "CC0-1.0",
+   "ISC",
+   "MIT",
+   "MPL-2.0",
+   "Unicode-3.0",
+   "Zlib",
+]
+
+[bans]
+# Tauri's transitive dependencies require multiple incompatible crate versions.
+multiple-versions = "warn"
+wildcards = "deny"
+allow-wildcard-paths = true
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
diff --git a/examples/observer-demo/src-tauri/Cargo.lock b/examples/observer-demo/src-tauri/Cargo.lock
index 1fb6094..41fcc62 100644
--- a/examples/observer-demo/src-tauri/Cargo.lock
+++ b/examples/observer-demo/src-tauri/Cargo.lock
@@ -3963,9 +3963,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",
diff --git a/examples/pagination-demo/src-tauri/Cargo.lock b/examples/pagination-demo/src-tauri/Cargo.lock
index 7bd2ead..49858c7 100644
--- a/examples/pagination-demo/src-tauri/Cargo.lock
+++ b/examples/pagination-demo/src-tauri/Cargo.lock
@@ -3963,9 +3963,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",