feat: modern SQL Server connectivity + TDS protocol + ergonomic APIs

.github/workflows/test.yml

@@ -38,7 +38,65 @@ jobs:
       - name: Rustfmt
         run: cargo fmt --check
 
-  cargo-test-linux:
+  msrv:
+    name: MSRV (1.88)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      # Keep this in sync with `rust-version` in Cargo.toml.
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: "1.88"
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - name: Install dependencies
+        run: sudo apt-get install -y openssl libkrb5-dev
+      - name: Check on MSRV
+        run: cargo check --features all
+
+  semver:
+    name: semver-checks (advisory)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    # Advisory during 0.x: reports API-breaking changes vs the target branch
+    # without blocking (breaking changes are allowed pre-1.0, but should be
+    # visible in review).
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - name: Install dependencies
+        run: sudo apt-get install -y openssl libkrb5-dev
+      - name: Install cargo-semver-checks
+        uses: taiki-e/install-action@cargo-semver-checks
+      - name: Fetch baseline branch
+        # `actions/checkout` leaves the PR base branch without a local ref, so
+        # `--baseline-rev origin/<base>` can't be resolved; fetch it explicitly
+        # and compare against FETCH_HEAD.
+        run: git fetch --no-tags --depth=100 origin "${{ github.base_ref }}"
+      - name: Check for semver-breaking changes
+        # Scope to one coherent, non-conflicting feature set. Checking all
+        # features at once enables the mutually-exclusive TLS backends
+        # (native-tls + rustls + vendored-openssl) together, whose duplicate
+        # `TlsStream` definitions make rustdoc fail to build (E0428). These are
+        # also the crate's original features, so they exist in every baseline
+        # slice this PR is compared against.
+        run: >-
+          cargo semver-checks --baseline-rev FETCH_HEAD
+          --only-explicit-features
+          --features rustls,chrono,time,tds73,rust_decimal,bigdecimal
+
+  smoke:
+    name: integration smoke (SQL 2022)
+    # Fast real-server signal on the dev lane; the full matrix runs on qa.
+    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/dev')
     runs-on: ubuntu-latest
 
     strategy:
@@ -109,7 +167,73 @@ jobs:
       - name: Run tests
         run: cargo test ${{matrix.features}}
 
-  cargo-test-windows:
+  integration-linux-next:
+    name: linux (SQL 2025, experimental)
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/qa')
+    runs-on: ubuntu-latest
+    # Newest server; kept non-blocking so a not-yet-published image or a
+    # server-side behaviour change on the bleeding edge cannot red-wall qa.
+    continue-on-error: true
+    env:
+      TIBERIUS_TEST_CONNECTION_STRING: "server=tcp:localhost,1433;user=SA;password=<YourStrong@Passw0rd>;TrustServerCertificate=true"
+      RUSTFLAGS: "-Dwarnings"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - name: Start SQL Server 2025
+        run: DOCKER_BUILDKIT=1 docker compose -f docker-compose.yml up -d mssql-2025
+      - name: Install dependencies
+        run: sudo apt-get install -y openssl libkrb5-dev
+      - name: Wait for SQL Server
+        # Authenticated readiness (not just an open port) — see the smoke job.
+        run: |
+          pw='<YourStrong@Passw0rd>'
+          for _ in $(seq 1 60); do
+            if docker run --rm --network host mcr.microsoft.com/mssql-tools \
+                 /opt/mssql-tools/bin/sqlcmd -S localhost,1433 -U SA -P "$pw" -Q "SELECT 1" >/dev/null 2>&1; then
+              echo "SQL Server ready (authenticated login succeeded)"; exit 0
+            fi
+            sleep 3
+          done
+          echo "SQL Server did not accept an authenticated login in time" >&2
+          docker compose -f docker-compose.yml logs mssql-2025 || true
+          exit 1
+      - name: Run tests
+        run: cargo test --features=all
+
+  integration-macos:
+    name: macos build + unit tests
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/qa')
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        features:
+          - "--no-default-features --features=rustls,chrono,time,tds73,sql-browser-tokio,sql-browser-smol,rust_decimal,bigdecimal"
+          - "--no-default-features --features=vendored-openssl"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      # No live SQL Server on hosted macOS runners; this verifies the crate
+      # builds and its unit tests pass on macOS/Apple targets.
+      - name: Build
+        run: cargo build ${{ matrix.features }}
+      - name: Run library unit tests
+        run: cargo test --lib ${{ matrix.features }}
+
+  integration-windows:
+    name: windows (SQL 2019, integrated auth)
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/qa')
     runs-on: windows-latest
 
     strategy:
@@ -216,42 +340,3 @@ jobs:
       - name: Run normal tests
         shell: powershell
         run: cargo test ${{matrix.features}}
-
-  cargo-test-macos:
-    runs-on: macos-26-intel
-
-    strategy:
-      fail-fast: false
-      matrix:
-        features:
-          - "--no-default-features --features=rustls,chrono,time,tds73,sql-browser-async-std,sql-browser-tokio,sql-browser-smol,integrated-auth-gssapi,rust_decimal,bigdecimal"
-          - "--no-default-features --features=vendored-openssl"
-
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-        with:
-          persist-credentials: false
-
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
-        with:
-          toolchain: stable
-
-      - name: Compute cache key
-        shell: bash
-        run: |
-          key="${{ matrix.features }}"
-          key="${key//,/+}"
-          echo "RUST_CACHE_KEY=$key" >> "$GITHUB_ENV"
-
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
-        with:
-          shared-key: ${{ env.RUST_CACHE_KEY }}
-
-      # macOS runners can't host the Linux SQL Server container, so this lane is
-      # compile + library unit tests only (no server-dependent integration tests,
-      # which run on the Linux and Windows lanes).
-      - name: Build
-        run: cargo build ${{matrix.features}}
-
-      - name: Run library unit tests
-        run: cargo test --lib ${{matrix.features}}

Cargo.toml

@@ -13,20 +13,15 @@ license = "MIT/Apache-2.0"
 name = "tiberius"
 readme = "README.md"
 repository = "https://github.com/prisma/tiberius"
-version = "0.12.3"
+version = "0.13.0"
 
 [workspace]
-members = ["runtimes-macro"]
+members = ["runtimes-macro", "tiberius-macros"]
 
 [[test]]
 path = "tests/query.rs"
 name = "query"
 
-[[test]]
-path = "tests/named-instance-async.rs"
-name = "named-instance-async"
-required-features = ["sql-browser-async-std"]
-
 [[test]]
 path = "tests/named-instance-tokio.rs"
 name = "named-instance-tokio"
@@ -37,31 +32,36 @@ path = "tests/named-instance-smol.rs"
 name = "named-instance-smol"
 required-features = ["sql-browser-smol"]
 
+[[example]]
+name = "named-pipes"
+path = "examples/named-pipes.rs"
+
 [dependencies]
 enumflags2 = "0.7"
 byteorder = "1.0"
 encoding_rs = "0.8"
 once_cell = "1.3"
-thiserror = "1.0"
+thiserror = "2"
 bytes = "1.0"
-pretty-hex = "0.3"
+pretty-hex = "0.4"
 pin-project-lite = "0.2"
-asynchronous-codec = "0.6"
+asynchronous-codec = "0.7"
 async-trait = "0.1"
 connection-string = "0.2"
 num-traits = "0.2"
 uuid = "1.0"
 zeroize = "1.8.2"
 
 [target.'cfg(windows)'.dependencies]
-winauth = { version = "0.0.4", optional = true }
+winauth = { version = "0.0.5", optional = true }
 
 [target.'cfg(unix)'.dependencies]
-libgssapi = { version = "0.8.1", optional = true, default-features = false }
+libgssapi = { version = "0.11", optional = true, default-features = false }
+sspi = { version = "0.18", optional = true }
+libc = "0.2"
 
 [dependencies.async-native-tls]
-version = "0.4"
-features = ["runtime-async-std"]
+version = "0.6"
 optional = true
 
 [dependencies.tokio]
@@ -74,11 +74,6 @@ version = "0.7"
 features = ["compat"]
 optional = true
 
-[dependencies.async-std]
-version = "1"
-optional = true
-features = ["attributes"]
-
 [dependencies.chrono]
 version = "0.4"
 optional = true
@@ -102,20 +97,25 @@ version = "1.6"
 optional = true
 
 [dependencies.bigdecimal_]
-version = "0.3"
+version = "0.4"
 optional = true
 package = "bigdecimal"
 
+[dependencies.serde]
+version = "1.0"
+optional = true
+features = ["derive", "rc"]
+
 [dependencies.async-io]
-version = "1.8"
+version = "2"
 optional = true
 
 [dependencies.async-net]
-version = "1.7"
+version = "2"
 optional = true
 
 [dependencies.futures-lite]
-version = "1.12.0"
+version = "2"
 optional = true
 
 [dependencies.tokio-rustls]
@@ -157,49 +157,70 @@ features = [
 ]
 version = "1.0"
 
-[dev-dependencies.async-std]
-features = ["attributes"]
-version = "1"
+[dev-dependencies.smol]
+version = "2"
 
 [dev-dependencies.runtimes-macro]
 path = "./runtimes-macro"
 
+[dependencies.tiberius-macros]
+path = "./tiberius-macros"
+version = "0.1.0"
+
 [dev-dependencies]
 names = "0.14"
 anyhow = "1"
 env_logger = "0.11"
-azure_identity = "0.20.0"
-url = "2.2.2"
-reqwest = "0.12"
+azure_identity = "1.0"
+azure_core = "1"
+url = "2.5"
+reqwest = "0.13"
 paste = "1.0"
 indicatif = "0.18"
 chrono = "0.4.38"
-indoc = "1.0.7"
+indoc = "2"
+serde_json = "1.0"
 
 [package.metadata.docs.rs]
-features = ["all", "docs"]
+features = ["all"]
+# docs.rs builds on nightly with this cfg set, enabling #[doc(cfg(...))]
+# annotations (feature(doc_cfg)) without requiring nightly for normal builds.
+rustdoc-args = ["--cfg", "docsrs"]
+
+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(docsrs)'] }
 
 [features]
 all = [
     "chrono",
     "time",
     "tds73",
-    "sql-browser-async-std",
+    "tds80",
     "sql-browser-tokio",
     "sql-browser-smol",
     "integrated-auth-gssapi",
     "rust_decimal",
     "bigdecimal",
     "native-tls",
+    "serde",
+    "sspi-rs",
 ]
-default = ["tds73", "winauth", "native-tls"]
+default = ["tds80", "winauth", "native-tls"]
 tds73 = []
-docs = []
-sql-browser-async-std = ["async-std"]
+# Enables TDS 8.0 support, including the `Strict` encryption level (TLS before
+# the TDS prelogin, TDS 8.0 "strict" mode). Requires a TLS backend.
+tds80 = ["tds73"]
 sql-browser-tokio = ["tokio", "tokio-util"]
 sql-browser-smol = ["async-io", "async-net", "futures-lite"]
 integrated-auth-gssapi = ["libgssapi"]
 bigdecimal = ["bigdecimal_"]
 rustls = ["tokio-rustls", "tokio-util", "rustls-native-certs", "rustls-webpki"]
 native-tls = ["async-native-tls"]
 vendored-openssl = ["opentls"]
+# Enables Windows-style SSPI/NTLM authentication (`AuthMethod::Windows`) on Unix
+# platforms without requiring Kerberos, via the pure-Rust `sspi` crate. On
+# Windows the same authentication is provided by the `winauth` feature.
+sspi-rs = ["sspi"]
+# Optional serde Serialize/Deserialize impls for query result types
+# (Row, Column, ColumnData, Numeric, ColumnType and time/xml types).
+serde = ["dep:serde", "uuid/serde"]

deny.toml

@@ -6,19 +6,11 @@
 [advisories]
 yanked = "deny"
 ignore = [
-    # async-std is discontinued upstream. In tiberius it is reachable ONLY through
-    # the opt-in `sql-browser-async-std` feature (and dev-deps); it is not part of
-    # the default build. Tracked for migration to smol/tokio.
-    { id = "RUSTSEC-2025-0052", reason = "async-std: opt-in `sql-browser-async-std` feature + dev-deps only; not in the default shipped graph" },
-
     # The following are ALL dev-dependency-only (test harness + the aad-auth
     # example) and are never compiled into the published library.
     { id = "RUSTSEC-2024-0375", reason = "atty: dev-dependency only (via `names` -> clap 3); not shipped" },
     { id = "RUSTSEC-2024-0370", reason = "proc-macro-error: dev-dependency only (via `names` -> clap 3); not shipped" },
-    { id = "RUSTSEC-2024-0384", reason = "instant: transitive dev-dependency only; not shipped" },
     { id = "RUSTSEC-2024-0436", reason = "paste: dev/test only (tests/bulk.rs + azure_identity example); not shipped" },
-    { id = "RUSTSEC-2026-0174", reason = "http-types: dev-only via azure_identity in the aad-auth example; not shipped" },
-    { id = "RUSTSEC-2026-0275", reason = "azure_core: dev-only via azure_identity in the aad-auth example; not shipped (the crate never handles AAD tokens itself)" },
 ]
 
 [bans]