Replace tiberius with mssql-tiberius-bridge (Microsoft mssql-tds)

.github/workflows/ci.yml

@@ -5,6 +5,10 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  schedule:
+    # Weekly cargo-audit sweep for advisories disclosed after dependencies land.
+    # Use an off-peak minute rather than :00 or :30.
+    - cron: "23 5 * * 2"
 
 jobs:
   test:
@@ -20,10 +24,72 @@ jobs:
         run: cargo build
 
       - name: Run tests
-        run: cargo test
+        # This crate has no library target, so --lib would fail. --bins keeps
+        # the live SQL Server test in its dedicated job below.
+        run: cargo test --bins
 
       - name: Clippy
         run: cargo clippy --all-targets -- -D warnings
 
       - name: Check formatting
         run: cargo fmt --all -- --check
+
+  live-db-integration:
+    name: Live SQL Server integration
+    runs-on: ubuntu-latest
+    # SQL Server needs more startup time and memory than PostgreSQL. GitHub's
+    # hosted runner has sufficient memory; generous health retries wait for
+    # readiness without a fixed sleep.
+    services:
+      sqlserver:
+        image: mcr.microsoft.com/mssql/server:2022-latest
+        ports:
+          - 1433:1433
+        env:
+          ACCEPT_EULA: Y
+          MSSQL_SA_PASSWORD: "Str0ng!Passw0rd"
+        options: >-
+          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'Str0ng!Passw0rd' -C -Q 'SELECT 1' -b"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-start-period 20s
+          --health-retries 30
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Build
+        run: cargo build
+
+      - name: Run live-database integration test
+        env:
+          SQLSERVER_PLUGIN_BIN: ${{ github.workspace }}/target/debug/sqlserver-plugin
+          SQLSERVER_TEST_HOST: 127.0.0.1
+          SQLSERVER_TEST_PORT: 1433
+          SQLSERVER_TEST_USER: sa
+          SQLSERVER_TEST_PASSWORD: "Str0ng!Passw0rd"
+          SQLSERVER_TEST_DATABASE: tabularis_test
+        run: cargo test --test live_db -- --test-threads=1
+
+  audit:
+    name: Security audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
+      # Scheduled audit-check runs can file or update tracking issues.
+      issues: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: rustsec/audit-check@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # RUSTSEC-2026-0235 affects rkyv 0.7.46, present only because
+          # rust_decimal declares an optional rkyv feature. This plugin does
+          # not enable it (`cargo tree -i rkyv` has no path), so no rkyv code
+          # is compiled into the shipped binary. Re-check whenever
+          # rust_decimal is upgraded or its enabled features change.
+          ignore: RUSTSEC-2026-0235

CHANGELOG.md

@@ -7,9 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Replaced the `tiberius` TDS client with Microsoft's `mssql-tds` implementation through `mssql-tiberius-bridge`, preserving the plugin's user-facing connection and query behaviour
+
 ### Added
 
-- Initial SQL Server driver: `tiberius` + `deadpool` pooling, TLS modes, session reset, startup scripts
+- Automated live SQL Server 2022 JSON-RPC integration tests for TLS, DDL, CRUD, result-set metadata, affected rows, identity recovery, pagination, error recovery, execution plans, and startup scripts
+- Initial SQL Server driver with `deadpool` pooling, TLS modes, session reset, and startup scripts
 - Schema, table, column, PK/FK, index, view, routine, and trigger introspection
 - Query execution with pagination, CTE/DML classification, multiple result sets, and accurate affected rows (incl. DML `OUTPUT`)
 - INSERT/UPDATE/DELETE with composite primary keys and safe `IDENTITY_INSERT` recovery

CLAUDE.md

@@ -39,9 +39,9 @@ src/
   handlers/         # thin JSON adapters, one module per RPC area
   driver/           # SQL Server logic
     ops.rs          # one free function per host RPC method
-    pool.rs         # tiberius Config + deadpool Manager (TLS modes, startup scripts)
+    pool.rs         # Microsoft mssql-tds client via bridge + deadpool Manager (TLS modes, startup scripts)
     introspection.rs, helpers.rs, ddl/, routines/, triggers/, types.rs, version.rs
-    extract/        # tiberius row → JSON value extraction (incl. temporal types)
+    extract/        # row → JSON value extraction (incl. temporal types)
     explain.rs      # SHOWPLAN_XML / STATISTICS XML capture
     showplan.rs     # SHOWPLAN XML → visual-plan JSON (plugins return parsed plans)
 ```