[gabref]

CI currently does not check Rust dependencies for advisories or enforce license and source policies. Add a dedicated cargo-deny job on pushes and pull requests.

The policy checks all platforms and development dependencies, rejects wildcard dependencies and unapproved sources, and reports duplicate versions as warnings. Update affected dependencies, raise the Tokio minimum version, and document two upstream exceptions: proc-macro-error and glib in Tauri's GTK stack.

Closes #23

[velocitysystems]

Please squash the review follow-up commits into the commits they amend before merge:

• chore: sync example Tokio lockfile into fix: update vulnerable Rust dependencies
• ci: run pinned cargo-deny directly into ci: check Rust dependencies with cargo-deny

[velocitysystems]

Can we tighten this section? deny.toml is the source of truth for what's checked, and listing its settings here will drift.

Suggested change

	Rust dependency policy is checked on pushes, pull requests, and weekly against the
	committed lockfile. Install cargo-deny and run the same check locally:
	```bash
	cargo install cargo-deny --version 0.20.2 --locked
	cargo deny --workspace --all-features --locked check
	```
	`deny.toml` checks advisories, licenses, duplicate versions, and dependency sources
	across all platforms, including development dependencies. Duplicate versions produce
	warnings; wildcard dependencies and unapproved sources fail the check. The example
	app has a separate lockfile and is not included in this audit.
	Update affected dependencies before adding advisory exceptions. Each exception must
	identify the upstream constraint and explain why an update cannot resolve it. Remove
	exceptions when upstream dependencies no longer require them. Review license additions
	and allow only the registries and Git repositories the package needs.
	Rust dependencies are checked with cargo-deny on every push and pull request. The example
	app has its own lockfile and is not checked. Run the same check locally:
	```bash
	cargo install cargo-deny@0.20.2 --locked
	cargo deny --workspace --all-features --locked check
	```
	Fix advisories by updating the dependency where possible. Any exception in `deny.toml`
	must say why an update cannot resolve it.

[gabref]

Simplified the section as suggested, keeping the local commands and exception guidance.

[velocitysystems]

Let's standardise on cargo-deny 0.20.2, the latest release, across the plugins.

Suggested change

	run: cargo install cargo-deny@0.19.8 --locked
	run: cargo install cargo-deny@0.20.2 --locked

[gabref]

Updated CI to cargo-deny 0.20.2 to match the README and the other plugins.

[gabref]

Squashed both follow-up commits into their original commits. The PR now contains two commits.