build(deps): bump tiberius from 0.12.3 to 0.13.0

[dependabot]

Bumps tiberius from 0.12.3 to 0.13.0.

Release notes

Sourced from tiberius's releases.

v0.13.0

• feat: TLS trust configuration is revamped around two orthogonal axes plus a bypass, unifying community PRs #330 and #290:
  • Config::trust_cert_ca_bundle(bytes) (and the ConfigBuilder mirror) trusts additional CA certificates supplied as in-memory bytes, without writing them to a temporary file. The bytes are auto-detected: a -----BEGIN marker is parsed as a multi-certificate PEM bundle (e.g. the AWS RDS root bundle), otherwise they are treated as a single DER certificate.
  • Config::trust_webpki_roots() (and the ConfigBuilder mirror) bases trust on a compiled-in snapshot of Mozilla's root CA store instead of the OS trust store. rustls-only, behind the new rustls-webpki-roots feature. Note: the bundled roots are a pinned snapshot that goes stale (missing newly added or newly distrusted CAs) unless the dependency is updated and the app rebuilt.
  • Config::trust_cert_ca(path) now accepts multi-certificate files (the previous "exactly one certificate" restriction is lifted); every certificate in the file is trusted, on all three TLS backends.
• BREAKING: repeated trust_cert_ca calls now accumulate rather than replace-last-wins. trust_cert_ca(a); trust_cert_ca(b) (and any mix with trust_cert_ca_bundle) trusts every supplied CA, layered on top of the base trust anchors. Code that relied on a later call overriding an earlier one must now set the CA only once.
• fix: a CA source (file or in-memory bundle) that yields zero usable certificates is now a hard error naming the source, on every backend, instead of silently degrading to base-roots-only trust. The native-tls and vendored-openssl backends also now load all certificates from a multi-certificate CA file/bundle (previously only the first was used) and preserve the path plus underlying I/O error in load failures, matching rustls.
• BREAKING: the connection-string encrypt default is now Required (was Off) when a TLS backend is enabled, matching modern ADO.NET; without a TLS backend it remains NotSupported.
• BREAKING: removed the sql-browser-async-std feature and the async-std SQL Browser integration.
• feat: Command/RPC API for parameterized stored-procedure calls, plus a #[derive(TableValueRow)] macro (in tiberius-macros) for table-valued parameters.
• feat: sspi-rs feature for Windows-style SSPI/NTLM authentication on Unix via the pure-Rust sspi crate (no Kerberos required).
• feat: serde feature adding Serialize/Deserialize impls for query result types (Row, Column, ColumnData, Numeric, and the time/xml types).
• feat: client-certificate authentication, including PEM/DER key files (Config::client_certificate) and PKCS#12 bundles (Config::client_certificate_pkcs12).
• BREAKING: credentials (SQL Server / Windows passwords, the AAD bearer token and the PKCS#12 password) are now stored as secrecy::SecretString instead of zeroize::Zeroizing<String>. They are still zeroized on drop, and their Debug now renders as SecretBox<str>([REDACTED]) (was <HIDDEN>). The AuthMethod::AADToken tuple variant consequently holds a SecretString: code that pattern-matched it and read the token via Deref/Display must now call secrecy::ExposeSecret::expose_secret. Constructing auth via

... (truncated)

Changelog

Sourced from tiberius's changelog.

Version 0.13.0

• feat: TLS trust configuration is revamped around two orthogonal axes plus a bypass, unifying community PRs #330 and #290:
  • Config::trust_cert_ca_bundle(bytes) (and the ConfigBuilder mirror) trusts additional CA certificates supplied as in-memory bytes, without writing them to a temporary file. The bytes are auto-detected: a -----BEGIN marker is parsed as a multi-certificate PEM bundle (e.g. the AWS RDS root bundle), otherwise they are treated as a single DER certificate.
  • Config::trust_webpki_roots() (and the ConfigBuilder mirror) bases trust on a compiled-in snapshot of Mozilla's root CA store instead of the OS trust store. rustls-only, behind the new rustls-webpki-roots feature. Note: the bundled roots are a pinned snapshot that goes stale (missing newly added or newly distrusted CAs) unless the dependency is updated and the app rebuilt.
  • Config::trust_cert_ca(path) now accepts multi-certificate files (the previous "exactly one certificate" restriction is lifted); every certificate in the file is trusted, on all three TLS backends.
• BREAKING: repeated trust_cert_ca calls now accumulate rather than replace-last-wins. trust_cert_ca(a); trust_cert_ca(b) (and any mix with trust_cert_ca_bundle) trusts every supplied CA, layered on top of the base trust anchors. Code that relied on a later call overriding an earlier one must now set the CA only once.
• fix: a CA source (file or in-memory bundle) that yields zero usable certificates is now a hard error naming the source, on every backend, instead of silently degrading to base-roots-only trust. The native-tls and vendored-openssl backends also now load all certificates from a multi-certificate CA file/bundle (previously only the first was used) and preserve the path plus underlying I/O error in load failures, matching rustls.
• BREAKING: the connection-string encrypt default is now Required (was Off) when a TLS backend is enabled, matching modern ADO.NET; without a TLS backend it remains NotSupported.
• BREAKING: removed the sql-browser-async-std feature and the async-std SQL Browser integration.
• feat: Command/RPC API for parameterized stored-procedure calls, plus a #[derive(TableValueRow)] macro (in tiberius-macros) for table-valued parameters.
• feat: sspi-rs feature for Windows-style SSPI/NTLM authentication on Unix via the pure-Rust sspi crate (no Kerberos required).
• feat: serde feature adding Serialize/Deserialize impls for query result types (Row, Column, ColumnData, Numeric, and the time/xml types).
• feat: client-certificate authentication, including PEM/DER key files (Config::client_certificate) and PKCS#12 bundles (Config::client_certificate_pkcs12).
• BREAKING: credentials (SQL Server / Windows passwords, the AAD bearer token and the PKCS#12 password) are now stored as secrecy::SecretString instead of zeroize::Zeroizing<String>. They are still zeroized on drop, and their Debug now renders as SecretBox<str>([REDACTED]) (was <HIDDEN>). The AuthMethod::AADToken tuple variant consequently holds a SecretString: code that pattern-matched it and read the token via Deref/Display must now call secrecy::ExposeSecret::expose_secret. Constructing auth via

... (truncated)

Commits

• 7fd75bb test(query): gate the encrypt=true integration test behind a TLS backend
• d0003ad feat(config): in-house ADO.NET-superset connection-string parser (#313)
• c358199 chore(s10): trim audit-flagged comments (no behavior change)
• bd3251a fix(config): reject encrypt requests in no-TLS builds (#305)
• 2f3c4a9 feat(tls): unify trust config with CA bundles and webpki roots (#290, #330)
• 7852122 feat(config): opt-in lossy UTF-16 decoding (#325)
• a39a614 feat(bulk): bulk-copy options and column order hints (#302)
• 2c63330 feat(config): add handshake_timeout and command_timeout (#375, #360)
• 0dec9cb fix(config): actionable errors + docs for special-character passwords (#333)
• 610154f feat(tls): clearer diagnostics for rustls cert-version handshake failures (#327)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.