mssql_server: replace tiberius with mssql (maintained fork with security fixes)

[joelparkerhenderson]

Update: please skip this PR because there's finally progress in the main repo, and it could/should work fine for you.

---

Follow-up PR for #500, implementing the code change described there.

Problem

mssql_server depends on the Rust crate tiberius, which is experiencing multiple security
problems and slow maintenance. Specifics below.

Solution

Replace tiberius with mssql
(mssql-rust/mssql-rust), a maintained fork I
publish, which carries the security fixes described below. An equally-maintained alternative,
tiberius-ng
(MattJackson/tiberius-ng), also fixes these
issues and keeps the tiberius name/API if maintainers prefer that direction instead — happy
to redo this PR against that fork if so.

Code change

mssql's Config/AuthMethod/Client::connect API is unchanged from tiberius's, and it
keeps the same tds73/rustls feature names this crate already used, so this is a rename, not
a rewrite: Cargo.toml, examples/mssql_server.rs, and src/mssql_server/mod.rs:124.

Verified against the published mssql 1.0.1 crate:

cargo check --no-default-features --features mssql_server
cargo check --no-default-features --features mssql_server --example mssql_server
cargo check --no-default-features --features mssql_server --tests

All pass.

Security specifics

1. Three unpatched RUSTSEC advisories — RUSTSEC-2026-0098,
   -0099,
   -0104
2. Unmerged fixes: prisma/tiberius#419
   implements exactly this upgrade. It's been open since 2026-05-12 with no maintainer response.
3. Reachable panics from untrusted server input: #424
   and #425 document 11 sites in the TDS decoder
   where a malformed/malicious server response aborts the client process rather than returning
   Err. Tracked by the RustSec working group at advisory-db#3148.
4. Maintenance appears stalled: no commits since 2026-03-06, 140 open issues, and a maintainer-handover
   request (#427) went unanswered for 11 days.

Closes #500

---

Drafted with Claude Code; I reviewed and take responsibility for the change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HmakCYmBF3qUgiW7ctoFJm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 0e238352-8f57-4f49-a0c0-73362d9f3213

📥 Commits

Reviewing files that changed from the base of the PR and between d69e3a0 and ff21f1b.

📒 Files selected for processing (3)

• Cargo.toml
• examples/mssql_server.rs
• src/mssql_server/mod.rs

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Summary by CodeRabbit

• Chores
  • Replaced the SQL Server development and testing dependency with the mssql crate.
  • Updated the SQL Server example and test configuration to use the new crate while preserving existing connection, authentication, and query behavior.
  • Updated the related setup documentation reference.

Walkthrough

The development dependency changes from tiberius to mssql 1.0.1. The MSSQL example and test imports now use mssql types. Rustls and TDS 7.3 features remain enabled.

Changes

MSSQL crate migration

Layer / File(s)	Summary
Update MSSQL development dependency Cargo.toml	Replaces tiberius 0.12.3 with mssql 1.0.1 and retains the tds73 and rustls features.
Migrate MSSQL call sites examples/mssql_server.rs, src/mssql_server/mod.rs	Switches configuration, authentication, client, and test imports from tiberius to mssql.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to ff21f

This localized dependency replacement preserves the existing connection configuration and authentication behavior, with no actionable merge-blocking risk remaining beyond normal checks and review.

Poem

A rabbit swaps crates in the burrow tonight
mssql hops in with rustls bright
TDS seven-three keeps its pace
Config and clients now share one place
Tests follow softly, ears held high

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy the linked objectives in [#419] and [#500] by replacing tiberius with mssql 1.0.1, preserving the existing API usage and features, updating all affected references, and addressing …
Out of Scope Changes check	✅ Passed	The changes are limited to the dependency declaration, the MSSQL example, and the test module import. All changes support the linked issue objectives.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 …
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing the tiberius dependency with the maintained mssql fork.
Description check	✅ Passed	The description directly explains the dependency replacement, affected files, security motivation, compatibility, and verification steps. The request to skip the PR does not make the description unrel…

Full details: Linked Issues check

Explanation

The changes satisfy the linked objectives in [#419] and [#500] by replacing tiberius with mssql 1.0.1, preserving the existing API usage and features, updating all affected references, and addressing the stated security concerns.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

Full details: Description check

Explanation

The description directly explains the dependency replacement, affected files, security motivation, compatibility, and verification steps. The request to skip the PR does not make the description unrelated.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mervyn-mccreight]

Thanks :)
I'll have a look into it the next days.

[joelparkerhenderson]

Update: please skip this PR because there's finally progress in the main repo, and it could/should work fine for you.

[mervyn-mccreight]

Did I understand the discussion in tiberius-rs/tiberius#427 correctly that all effort will go into maintaining the original project going forward from now on?