From c873cf930ec0ad224dbc0b0e39e26d0a40f95478 Mon Sep 17 00:00:00 2001
From: Jon Currey <jon.currey@materialize.com>
Date: Wed, 23 Sep 2026 16:19:42 -0400
Subject: [PATCH 1/2] deps: update postgres-protocol to fix SCRAM CPU
 exhaustion

---
 Cargo.lock | 22 +++++++++++-----------
 Cargo.toml |  2 +-
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 9d797e9eefb09..cda65d3cd8b82 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -10855,7 +10855,7 @@ dependencies = [
 [[package]]
 name = "postgres"
 version = "0.19.12"
-source = "git+https://github.com/MaterializeInc/rust-postgres#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
 dependencies = [
  "bytes",
  "fallible-iterator 0.2.0",
@@ -10868,7 +10868,7 @@ dependencies = [
 [[package]]
 name = "postgres-openssl"
 version = "0.5.2"
-source = "git+https://github.com/MaterializeInc/rust-postgres#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
 dependencies = [
  "openssl",
  "tokio",
@@ -10878,25 +10878,25 @@ dependencies = [
 
 [[package]]
 name = "postgres-protocol"
-version = "0.6.9"
-source = "git+https://github.com/MaterializeInc/rust-postgres#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+version = "0.6.12"
+source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
 dependencies = [
  "base64 0.22.1",
  "byteorder",
  "bytes",
  "fallible-iterator 0.2.0",
- "hmac 0.12.1",
- "md-5 0.10.6",
+ "hmac 0.13.0",
+ "md-5 0.11.0",
  "memchr",
- "rand 0.9.4",
- "sha2 0.10.9",
+ "rand 0.10.2",
+ "sha2 0.11.0",
  "stringprep",
 ]
 
 [[package]]
 name = "postgres-replication"
 version = "0.6.7"
-source = "git+https://github.com/MaterializeInc/rust-postgres#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
 dependencies = [
  "byteorder",
  "bytes",
@@ -10911,7 +10911,7 @@ dependencies = [
 [[package]]
 name = "postgres-types"
 version = "0.2.11"
-source = "git+https://github.com/MaterializeInc/rust-postgres#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
 dependencies = [
  "bytes",
  "chrono",
@@ -13891,7 +13891,7 @@ dependencies = [
 [[package]]
 name = "tokio-postgres"
 version = "0.7.15"
-source = "git+https://github.com/MaterializeInc/rust-postgres#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
 dependencies = [
  "async-trait",
  "byteorder",
diff --git a/Cargo.toml b/Cargo.toml
index b9cae0ec8fb1b..343f830dcef72 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -439,7 +439,7 @@ phf_codegen = "0.13.1"
 pin-project = "1.1.13"
 postgres = "0.19.12"
 postgres-openssl = "0.5.2"
-postgres-protocol = "0.6.9"
+postgres-protocol = "0.6.12"
 postgres-replication = "0.6.7"
 postgres-types = { version = "0.2.11", features = ["with-chrono-0_4", "with-uuid-1"] }
 postgres_array = "0.11.0"

From 8d4c5e57057df6a968a39842682f65e50e7c95ee Mon Sep 17 00:00:00 2001
From: Jon Currey <jon.currey@materialize.com>
Date: Wed, 23 Sep 2026 20:38:54 -0400
Subject: [PATCH 2/2] Update rust-postgres to merged SCRAM iteration limit fix

---
 Cargo.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index cda65d3cd8b82..e08b12f085336 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -10855,7 +10855,7 @@ dependencies = [
 [[package]]
 name = "postgres"
 version = "0.19.12"
-source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
+source = "git+https://github.com/MaterializeInc/rust-postgres#fcca71c8a6ee351eda7b6dfcd607055fa9a6d302"
 dependencies = [
  "bytes",
  "fallible-iterator 0.2.0",
@@ -10868,7 +10868,7 @@ dependencies = [
 [[package]]
 name = "postgres-openssl"
 version = "0.5.2"
-source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
+source = "git+https://github.com/MaterializeInc/rust-postgres#fcca71c8a6ee351eda7b6dfcd607055fa9a6d302"
 dependencies = [
  "openssl",
  "tokio",
@@ -10879,7 +10879,7 @@ dependencies = [
 [[package]]
 name = "postgres-protocol"
 version = "0.6.12"
-source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
+source = "git+https://github.com/MaterializeInc/rust-postgres#fcca71c8a6ee351eda7b6dfcd607055fa9a6d302"
 dependencies = [
  "base64 0.22.1",
  "byteorder",
@@ -10896,7 +10896,7 @@ dependencies = [
 [[package]]
 name = "postgres-replication"
 version = "0.6.7"
-source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
+source = "git+https://github.com/MaterializeInc/rust-postgres#fcca71c8a6ee351eda7b6dfcd607055fa9a6d302"
 dependencies = [
  "byteorder",
  "bytes",
@@ -10911,7 +10911,7 @@ dependencies = [
 [[package]]
 name = "postgres-types"
 version = "0.2.11"
-source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
+source = "git+https://github.com/MaterializeInc/rust-postgres#fcca71c8a6ee351eda7b6dfcd607055fa9a6d302"
 dependencies = [
  "bytes",
  "chrono",
@@ -13891,7 +13891,7 @@ dependencies = [
 [[package]]
 name = "tokio-postgres"
 version = "0.7.15"
-source = "git+https://github.com/MaterializeInc/rust-postgres#a18ab2bc0783f624b6303882794c53e14b05d192"
+source = "git+https://github.com/MaterializeInc/rust-postgres#fcca71c8a6ee351eda7b6dfcd607055fa9a6d302"
 dependencies = [
  "async-trait",
  "byteorder",