From ff21f1bd7029aabafc1c6d79a8b1b65be49a944f Mon Sep 17 00:00:00 2001 From: Joel Parker Henderson Date: Tue, 1 Sep 2026 19:12:52 +0100 Subject: [PATCH] mssql_server: replace tiberius with mssql (maintained fork with security fixes) tiberius currently has three unpatched RUSTSEC advisories (RUSTSEC-2026-0098, -0099, -0104), a fix PR (prisma/tiberius#419) open since 2026-05-12 with no maintainer response, 11 reachable panic sites from untrusted server input (prisma/tiberius#424, #425), and a maintainer handover request (prisma/tiberius#427) unanswered for 11+ days. Details in #500. Drop-in replacement: mssql (https://crates.io/crates/mssql, https://github.com/mssql-rust/mssql-rust) keeps the same Config/AuthMethod/ Client::connect API and the tds73/rustls feature names, so this is a rename, not a rewrite. Verified against the published mssql 1.0.1 crate: cargo check --no-default-features --features mssql_server cargo check --no-default-features --features mssql_server --example mssql_server cargo check --no-default-features --features mssql_server --tests An equally-maintained alternative, tiberius-ng (https://github.com/MattJackson/tiberius-ng), also fixes these issues and keeps the tiberius name/API if maintainers prefer that direction instead. Closes #500 Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01HmakCYmBF3qUgiW7ctoFJm --- Cargo.toml | 12 ++++++------ examples/mssql_server.rs | 8 ++++---- src/mssql_server/mod.rs | 2 +- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index b1be4950..7c312033 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -106,6 +106,12 @@ lapin = "3.0.0" ldap3 = "0.11.5" meilisearch-sdk = "0.29.1" mongodb = "3.0.1" +# To use mssql on macOS, rustls is needed instead of native-tls +# https://github.com/mssql-rust/mssql-rust/blob/main/mssql/README.md#feature-flags +mssql = { version = "1.0.1", default-features = false, features = [ + "tds73", + "rustls", +] } mysql = "26.0.0" neo4rs = "0.8.0" oracle = "0.6.0" @@ -128,12 +134,6 @@ serial_test = "3.1.1" surrealdb = { version = "2.2.1" } tar = "0.4.40" testcontainers = { version = "0.28.0", features = ["blocking"] } -# To use Tiberius on macOS, rustls is needed instead of native-tls -# https://github.com/prisma/tiberius/tree/v0.12.2#encryption-tlsssl -tiberius = { version = "0.12.3", default-features = false, features = [ - "tds73", - "rustls", -] } tokio = { version = "1", features = ["macros"] } tokio-util = { version = "0.7.10", features = ["compat"] } tokio-zookeeper = "0.4.0" diff --git a/examples/mssql_server.rs b/examples/mssql_server.rs index 5ee30057..b5ef3fbb 100644 --- a/examples/mssql_server.rs +++ b/examples/mssql_server.rs @@ -7,11 +7,11 @@ async fn main() -> Result<(), Box> { let image = MssqlServer::default(); let container = image.start().await?; - // Build Tiberius config - let mut config = tiberius::Config::new(); + // Build mssql config + let mut config = mssql::Config::new(); config.host(container.get_host().await?); config.port(container.get_host_port_ipv4(1433).await?); - config.authentication(tiberius::AuthMethod::sql_server( + config.authentication(mssql::AuthMethod::sql_server( "sa", MssqlServer::DEFAULT_SA_PASSWORD, )); @@ -20,7 +20,7 @@ async fn main() -> Result<(), Box> { // Connect to the database let tcp = TcpStream::connect(config.get_addr()).await?; tcp.set_nodelay(true)?; - let mut client = tiberius::Client::connect(config, tcp.compat_write()).await?; + let mut client = mssql::Client::connect(config, tcp.compat_write()).await?; // Run a test query let stream = client.query("SELECT 1 + 1", &[]).await?; diff --git a/src/mssql_server/mod.rs b/src/mssql_server/mod.rs index bb02ae44..e8455b19 100644 --- a/src/mssql_server/mod.rs +++ b/src/mssql_server/mod.rs @@ -121,7 +121,7 @@ mod tests { use std::error; use testcontainers::runners::AsyncRunner; - use tiberius::{AuthMethod, Client, Config}; + use mssql::{AuthMethod, Client, Config}; use tokio::net::TcpStream; use tokio_util::compat::{Compat, TokioAsyncWriteCompatExt};