Security bug: Rust crate `tiberius` is having problems; here are drop-in replacements.

[joelparkerhenderson]

Problem

Refinery depends on the Rust crate tiberius which has security problems and maintenance problems. Refinery publicly re-exports tiberius. So any user calling refinery::tiberius::… directly, or matching on tiberius::error::Error, has that type in their own code. Specifics below.

Solution

There are two recent forks of the crate that provide the security updates and PRs.

• mssql - maintained by Joel Henderson (me)
• tiberius-ng - maintained by Matt Jackson

Either fork is fine IMHO. You'll want to test them because they're both quite new. I prefer the name mssql because I work with Microsoft extensively and I'm working with their security teams; Matt prefers tiberius-ng name because it's more similar.

Refinery publicly re-exports tiberius which means any name change will be a breaking change for Refinery internals and also for the users that build with tiberius as above.

Pull request: #448

João, I'm inviting you be an admin for mssql if you wish, because I want more Rust leaders involved. I'll submit a PR too so you can see the code.

Security specifics

1. Three unpatched RUSTSEC advisories — RUSTSEC 2026-0098, 2026-0099, 2026-0104
2. Unnmerged fixes: prisma/tiberius#419
   fixes this yet has been open since 2026-05-12 with no maintainer response.
3. Reachable panics from untrusted server input: #424 and #425 document 11 sites in the TDS decoder where a malformed/malicious server response aborts the client process rather than returning Err. Tracked by the RustSec working group at advisory-db#3148.
4. Maintenance appears stalled: no commits since 2026-03-06, 140 open issues, and a maintainer-handover request (#427) went unanswered for 11 days.