diff --git a/CLAUDE.md b/CLAUDE.md
index a4c7c9a..0052207 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -178,6 +178,8 @@ Patching that file by guessing an anchor string has failed repeatedly. Read the
 ```sh
 cargo fmt --all --check   # rustfmt, as rustfmt.toml says; the pre-commit hook refuses a commit without it
 cargo clippy --workspace --all-targets -- -D warnings  # no warnings, ever
+cargo deny check          # known vulnerabilities, licences, sources (deny.toml); reads Cargo.lock, builds nothing
+cargo machete             # dependencies a crate lists and does not use; now and then, it can be wrong
 cargo test                # ~80 tests: parsing, filters, retention, schedules, SQL, per-user state
 npx tsc -p .              # type-checks web/src
 node tests/page-smoke.js
diff --git a/Cargo.lock b/Cargo.lock
index 5caf181..9cc4f87 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -40,9 +40,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "ammonia"
-version = "4.1.4"
+version = "4.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc6d763210e2eb7670d1a5183a08bebefa3f97db2a738a684f2ce00bd49f681d"
+checksum = "1f45dfa685e1ec33b1bf1a3b93b8047cbdbef41b6040deebbe6bea7720a45574"
 dependencies = [
  "cssparser",
  "html5ever",
@@ -789,9 +789,9 @@ dependencies = [
 
 [[package]]
 name = "cssparser"
-version = "0.37.0"
+version = "0.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98"
+checksum = "11119743ad110e8c1bdccd930d7f5c30c99e5fc76a7b63ec9807e84eef0c5f59"
 dependencies = [
  "dtoa-short",
  "itoa",
@@ -1437,9 +1437,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.15"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1555,12 +1555,13 @@ dependencies = [
 
 [[package]]
 name = "html5ever"
-version = "0.39.0"
+version = "0.40.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
+checksum = "456a1a377e608e555d22ddab27ac0114bc7a7b4199078108e34c2aeae6c9b130"
 dependencies = [
  "log",
  "markup5ever",
+ "memchr",
 ]
 
 [[package]]
@@ -1864,7 +1865,6 @@ dependencies = [
  "ammonia",
  "anyhow",
  "argon2",
- "atom_syndication",
  "axum",
  "chrono",
  "clap",
@@ -1877,9 +1877,7 @@ dependencies = [
  "opentelemetry",
  "opml",
  "percent-encoding",
- "quick-xml 0.42.0",
  "reqwest",
- "rss",
  "sea-orm",
  "serde",
  "serde_json",
@@ -2526,9 +2524,9 @@ checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
 
 [[package]]
 name = "markup5ever"
-version = "0.39.0"
+version = "0.40.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
+checksum = "0ab3dc68ac4a0f5719e560136778c1ee716e296030d75dbd4484e37e39e3a842"
 dependencies = [
  "log",
  "tendril",
@@ -2985,9 +2983,9 @@ dependencies = [
 
 [[package]]
 name = "phf"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"
 dependencies = [
  "phf_shared",
  "serde",
@@ -2995,9 +2993,9 @@ dependencies = [
 
 [[package]]
 name = "phf_codegen"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+checksum = "41b585a510fb76fdebead6897982ef2a03a21d8e6cbcca904999742a4afc6ffe"
 dependencies = [
  "phf_generator",
  "phf_shared",
@@ -3005,9 +3003,9 @@ dependencies = [
 
 [[package]]
 name = "phf_generator"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100"
 dependencies = [
  "fastrand",
  "phf_shared",
@@ -3015,9 +3013,9 @@ dependencies = [
 
 [[package]]
 name = "phf_shared"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+checksum = "c6fd9027e2d9319be6349febd1db4e8d02aa544921200c9b777720ac34a3aa89"
 dependencies = [
  "siphasher",
 ]
@@ -3544,9 +3542,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.44"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6725596c3f2c3a0aef021139e145d4eafe314a6623e4680ca83852b2c67ab2ba"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
  "once_cell",
@@ -4279,9 +4277,9 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "string_cache"
-version = "0.9.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+checksum = "ffa8a5dbe8b3f0bbe29d4c3225daafaeead63afdc1b65fc4c01a1384166038e6"
 dependencies = [
  "new_debug_unreachable",
  "parking_lot",
@@ -4291,9 +4289,9 @@ dependencies = [
 
 [[package]]
 name = "string_cache_codegen"
-version = "0.6.1"
+version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
+checksum = "928dcdf75e47626b3617a976ec205d9f057584c371c1f23b782129268d0e6edc"
 dependencies = [
  "phf_generator",
  "phf_shared",
@@ -5070,9 +5068,9 @@ dependencies = [
 
 [[package]]
 name = "web_atoms"
-version = "0.2.6"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba8b815c1b593dc0baf78dd0f4fc8fdb2de53198fb1163738093e9a311c33fb3"
+checksum = "7572660c8890448ba236b7376f27e389c6a7e1c70195622faced601f855c0ada"
 dependencies = [
  "phf",
  "phf_codegen",
diff --git a/crates/directory/CHANGELOG.md b/crates/directory/CHANGELOG.md
index f555ed8..2e95d14 100644
--- a/crates/directory/CHANGELOG.md
+++ b/crates/directory/CHANGELOG.md
@@ -10,6 +10,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- ammonia, which cleans publishers' HTML, updated to 4.2.4 for three advisories, among them XSS through SVG animation tags; rustls to 0.23.46 for five and h2 to 0.4.20 for one (#281).
+
 ## [1.2.0] - 2026-10-16
 
 ### Added
diff --git a/crates/directory/Cargo.toml b/crates/directory/Cargo.toml
index 12548ec..f492e5a 100644
--- a/crates/directory/Cargo.toml
+++ b/crates/directory/Cargo.toml
@@ -2,6 +2,7 @@
 name = "ipx-directory"
 version = "1.2.1-dev"
 edition.workspace = true
+publish = false
 
 [[bin]]
 name = "ipx-directory"
diff --git a/crates/ipx/CHANGELOG.md b/crates/ipx/CHANGELOG.md
index b8e6c11..da5fa73 100644
--- a/crates/ipx/CHANGELOG.md
+++ b/crates/ipx/CHANGELOG.md
@@ -33,6 +33,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - A 429 from TypeSafe holds every call back as it asks, instead of the pass going on asking (#277).
 - Looking for items to read for Signals read every item on the server on each scan; it now reads only recent ones (#274).
 
+### Security
+
+- ammonia, which cleans publishers' HTML, updated to 4.2.4 for three advisories, among them XSS through SVG animation tags; rustls to 0.23.46 for five and h2 to 0.4.20 for one, in every connection ipx makes (#281).
+
 ## [1.3.0] - 2026-10-16
 
 ### Added
diff --git a/crates/ipx/Cargo.toml b/crates/ipx/Cargo.toml
index 844e215..ffdacde 100644
--- a/crates/ipx/Cargo.toml
+++ b/crates/ipx/Cargo.toml
@@ -2,6 +2,7 @@
 name = "ipx"
 version = "1.3.1-dev"
 edition.workspace = true
+publish = false
 
 [dependencies]
 ipx-feed.workspace = true
@@ -10,7 +11,6 @@ ammonia.workspace = true
 anyhow.workspace = true
 argon2.workspace = true
 flate2.workspace = true
-atom_syndication.workspace = true
 axum.workspace = true
 chrono.workspace = true
 clap.workspace = true
@@ -20,9 +20,7 @@ librqbit.workspace = true
 opentelemetry.workspace = true
 opml.workspace = true
 percent-encoding.workspace = true
-quick-xml.workspace = true
 reqwest.workspace = true
-rss.workspace = true
 sea-orm.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..19b9030
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,34 @@
+# cargo deny check: known vulnerabilities, licences and where crates come from. Run before a push
+# (CLAUDE.md, Tests). It reads Cargo.lock and the RustSec database, and builds nothing.
+
+[graph]
+# Production runs on Linux; Windows and macOS-only crates are not ipx's concern.
+targets = ["x86_64-unknown-linux-gnu"]
+
+[advisories]
+ignore = [
+    # ringbuf 0.4's double free needs an element whose Drop panics; librqbit-utp's buffer holds
+    # only u8, which has no Drop. Its fix is ringbuf 0.5, which librqbit 9.0.1 cannot take (#281).
+    { id = "RUSTSEC-2026-0293", reason = "librqbit-utp's ring buffer holds u8: no Drop to panic" },
+]
+
+[licenses]
+# Permissive licences only; anything else is a question for the owner before it comes in.
+allow = [
+    "MIT", "MIT-0", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause",
+    "ISC", "Zlib", "Unlicense", "0BSD", "CC0-1.0", "BSL-1.0", "Unicode-3.0", "MPL-2.0",
+    "CDLA-Permissive-2.0",
+]
+# ipx's own crates have no licence field and are not published.
+private = { ignore = true }
+
+[bans]
+# Two versions of one crate (syn 1 and 2, and 25 more) only cost build time, and a warning for
+# each on every run would be read by nobody.
+multiple-versions = "allow"
+wildcards = "deny"
+allow-wildcard-paths = true
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"