diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e4141b7..7823e8d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -36,3 +36,24 @@ repos:
         entry: scripts/check_md_naming.sh
         language: system
         files: \.(md|markdown)$
+
+      # Every dependency on its ecosystem's newest STABLE release, exact-pinned
+      # so the question is mechanically answerable at all.
+      #
+      # `files:` is what keeps this cheap: a commit touching only source makes
+      # ZERO network requests, and manifest commits mostly hit a 6h disk cache.
+      #
+      # Runs WITHOUT --strict on purpose. Offline it degrades to the cached
+      # answer and passes with a loud banner; `--no-verify` is banned here, so
+      # a hook that hard-failed on a flaky connection would leave no way to
+      # commit at all. CI, always online, is the strict authority.
+      - id: dependency-freshness
+        name: dependencies on newest stable
+        entry: bash scripts/check_dependency_freshness.sh
+        language: system
+        pass_filenames: true
+        files: >-
+          (pubspec\.(yaml|lock)|pyproject\.toml|requirements.*\.txt|uv\.lock
+          |package\.json|package-lock\.json|pnpm-lock\.yaml
+          |Cargo\.(toml|lock)|go\.(mod|sum)
+          |\.fvmrc|\.nvmrc|\.python-version)$
diff --git a/crdt_sync_flutter/pubspec.yaml b/crdt_sync_flutter/pubspec.yaml
index c379c49..7aede49 100644
--- a/crdt_sync_flutter/pubspec.yaml
+++ b/crdt_sync_flutter/pubspec.yaml
@@ -4,7 +4,7 @@ description: >-
   persisted per-install device id, and a one-call bootstrap. Removes the
   ~150 lines of firebase_backend.dart every consuming app was copying.
 publish_to: 'none'
-version: 0.2.1
+version: 0.3.0
 
 environment:
   sdk: ^3.12.2
@@ -15,10 +15,10 @@ dependencies:
       url: https://github.com/kuhyx/utils
       ref: crdt_sync_dart-v0.11.0
       path: crdt_sync_dart
-  crypto: ^3.0.6
+  crypto: 3.0.7
   flutter:
     sdk: flutter
-  flutter_secure_storage: ^10.3.1
+  flutter_secure_storage: 11.0.0
   # A real dependency, not a dev one: lib/testing/ ships the keystore fake so
   # consuming apps can test their own sync wiring without rebuilding it.
   flutter_test:
@@ -26,12 +26,12 @@ dependencies:
   # The one-tap Google plugin. Android/iOS/web only -- there is no Linux
   # implementation -- so desktop reaches Google through the loopback flow in
   # google_desktop_sign_in.dart instead. See google_platform.dart.
-  google_sign_in: ^7.2.0
-  http: ^1.6.0
-  shared_preferences: ^2.5.3
+  google_sign_in: 7.2.0
+  http: 1.6.0
+  shared_preferences: 2.5.5
   # Opens the system browser for the desktop loopback sign-in.
-  url_launcher: ^6.3.1
-  uuid: ^4.5.1
+  url_launcher: 6.3.2
+  uuid: 4.6.0
 
 dev_dependencies:
   very_good_analysis: ^10.3.0