Security problems with Rust crate `tiberius` (via connector_arrow) plus options for drop-in replacement

Problem

This project depends on the Rust crate tiberius which has security problems and maintenance problems. Specifics below.

Solution

There are two recent forks of the crate that provide the security updates and PRs.

• mssql — maintained by Joel Henderson (me)
• tiberius-ng — maintained by Matt Jackson

Either fork is fine IMHO. You'll want to test them because they're both quite new. I prefer the name mssql because I work with Microsoft extensively and I'm working with their security teams; Matt prefers tiberius-ng name because it's similar.

Dependency chain note

Unlike a plain tiberius-using project, this isn't a same-repo drop-in rename. prqlc's SQL Server support goes through connector_arrow (prqlc/prqlc/Cargo.toml:114), and connector_arrow::tiberius::TiberiusConnection<S> hardcodes client: tiberius::Client<S> — the concrete tiberius crate type, not a generic. prqlc also depends on tiberius directly (prqlc/prqlc/Cargo.toml:126), but only to construct the tiberius::Client it hands to that connector in the integration test runner (prqlc/prqlc/tests/integration/dbs/runner.rs).

So switching prqlc alone from tiberius to mssql won't compile — mssql::Client<S> and tiberius::Client<S> are different Rust types even though their APIs match. The fix needs to land in connector_arrow first: a new mssql module mirroring its existing tiberius one (the two crates' APIs are compatible, so this is a mechanical port, not a rewrite).

I've opened that as a PR: aljazerzen/connector_arrow#81. Once it's merged and published, prqlc's change becomes the same small rename this project already does for its other drivers (feature name + Cargo.toml version bump + tiberius:: → mssql:: in the test runner).

Security specifics

1. Three unpatched RUSTSEC advisories — RUSTSEC 2026-0098, 2026-0099, 2026-0104
2. Unmerged fixes: prisma/tiberius#419 fixes this yet has been open since 2026-05-12 with no maintainer response.
3. Reachable panics from untrusted server input: #424 and #425 document 11 sites in the TDS decoder where a malformed/malicious server response aborts the client process rather than returning Err. Tracked by the RustSec working group at advisory-db#3148.
4. Maintenance appears stalled: no commits since 2026-03-06, 140 open issues, and a maintainer-handover request (#427) went unanswered for 11 days.

---

Drafted with Claude Code; I reviewed and take responsibility for the content.

Generated with Claude Code

https://claude.ai/code/session_01HmakCYmBF3qUgiW7ctoFJm