Replace tiberius with mssql (maintained fork with security fixes)

[joelparkerhenderson]

Problem

This project depends on the Rust crate tiberius which has security problems and maintenance problems. Specifics below.

Solution

There are two recent forks of the crate that provide the security updates and PRs.

• mssql (mssql-rust/mssql-rust) — maintained by Joel Henderson (me)
• tiberius-ng (MattJackson/tiberius-ng) — maintained by Matt Jackson

Either fork is fine IMHO. You'll want to test them because they're both quite new. I prefer the name mssql because I work with Microsoft extensively and I'm working with their security teams; Matt prefers tiberius-ng because it's more similar to the original — happy to redo this PR against that fork if you'd rather go that direction.

I'm opening this here (rather than only in a downstream consumer) because PRQL/prql depends on connector_arrow::tiberius::TiberiusConnection<S>, which hardcodes client: tiberius::Client<S> — a concrete type, not a generic. That means a downstream project can't switch off tiberius on its own; the change has to land here first. I've filed PRQL/prql with that context and a link back to this PR.

Code change

This renames src_tiberius/tiberius to src_mssql/mssql throughout — mssql's API
(Client, ColumnData, ToSql, QueryStream, BulkLoadRequest, TokenRow, numeric::Numeric,
error::Error, etc.) matches tiberius's, so this is a mechanical port, not a rewrite:

• connector_arrow/Cargo.toml — dependency + feature rename
• connector_arrow/src/lib.rs — module declaration
• connector_arrow/src/errors.rs — error conversion variant
• connector_arrow/src/tiberius/* → connector_arrow/src/mssql/* (all 5 files, types renamed Tiberius* → Mssql*)
• connector_arrow/tests/it/* — renamed to match, TIBERIUS_URL → MSSQL_URL
• Justfile, README.md — env var and support-matrix updates

Two comments are left explicitly noting behavior inherited from tiberius (a decimal-precision
restriction in mod.rs, and a lifetime-transmute workaround in append.rs) rather than silently
relabeling them, since I haven't independently verified whether the mssql fork has fixed either
one yet.

This is a breaking change: src_tiberius becomes src_mssql, and connector_arrow::tiberius
becomes connector_arrow::mssql. The crate is pre-1.0 (0.12.1), so this can ship as a minor
version bump under Cargo's semver rules.

Verified against the published mssql 1.0.1 crate:

cargo check --features all
cargo check --features all --tests

Both pass.

Security specifics

1. Three unpatched RUSTSEC advisories — RUSTSEC 2026-0098, 2026-0099, 2026-0104
2. Unmerged fixes: prisma/tiberius#419 fixes this yet has been open since 2026-05-12 with no maintainer response.
3. Reachable panics from untrusted server input: #424 and #425 document 11 sites in the TDS decoder where a malformed/malicious server response aborts the client process rather than returning Err. Tracked by the RustSec working group at advisory-db#3148.
4. Maintenance appears stalled: no commits since 2026-03-06, 140 open issues, and a maintainer-handover request (#427) went unanswered for 11 days.

---

Drafted with Claude Code; I reviewed and take responsibility for the change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HmakCYmBF3qUgiW7ctoFJm