postgres-protocol: raise SCRAM iteration limit to two million

.github/workflows/ci.yml

@@ -87,7 +87,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - run: docker compose up -d
-      - uses: dtolnay/rust-toolchain@1.81.0
+      - uses: dtolnay/rust-toolchain@stable
       - run: echo "version=$(rustc --version)" >> $GITHUB_OUTPUT
         id: rust-version
       - uses: actions/cache@v4

codegen/src/sqlstate.rs

@@ -135,7 +135,7 @@ enum Inner {{"#,
 fn make_map(codes: &LinkedHashMap<String, Vec<String>>, file: &mut BufWriter<File>) {
     let mut builder = phf_codegen::Map::new();
     for (code, names) in codes {
-        builder.entry(&**code, format!("SqlState::{}", &names[0]));
+        builder.entry(&**code, format!("SqlState::{}", names[0]));
     }
     write!(
         file,

docker/sql_setup.sh

@@ -2,60 +2,59 @@
 set -e
 
 cat > "$PGDATA/server.key" <<-EOKEY
------BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEAllItXwrj62MkxKVlz2FimJk42WWc3K82Rn2vAl6z38zQxSCj
-t9uWwXWTx5YOdGiUcA+JUAruZxqN7vdfphJoYtTrcrpT4rC/FsCMImBxkj1cxdYT
-q94SFn9bQBRZk7RUx4Kolt+/h0d3PpNIb4DbyQ8A0MVvNVxLpRRVwc6yQP+NkRMy
-gHR+m3P8fxHEtkHCVy7HORbASvN8fRlREMHDL2hkadX0BNM72DDo+DWhPA8GF6WX
-tIl1gU6GP6pSbEeMHD3f+uj7f9iSjvkrHrOt2nLUQ9Qnev2nhmU0/dOIweQ17/Fr
-lL9jYDUUFNORyjRnlXXUoP5BO/LdEAAqT2A0pwIDAQABAoIBAQCIXu74XUneHuiZ
-Wa+eTqwC4mZXmz6OWonzs0vU65NlgksXuv+r6ZO/2GoD1Bcy9jlL3Fxm+DPF56pB
-07u7TtHSb3VWdMFrU4tYGcBH45TE5dRHSmo4LlPcgxeGb6/ANwX+pYNKtJvuHyCH
-7Vf2iEFcCrdjrumv0BZ0IZmXJGxEV+7mK2Og0bZ/zbmJNaH25muuWj6BKlvLhL0N
-S2LlBjKx3HqtppUgUqNFqjLs6IA1u79S5dAomOsxZtnuByaX5WFzpktU2pveZmyF
-cl0dwHYZIaxR3ewYeQXGF8ANUmIx3nnxD2JOysPkitaGzeqt6dQZV14tPlDZDKat
-Vf0b6BHhAoGBAMWV7rG+7nVXoQ30CIcPGklkST3mVOlrzeBbKP1SeAwoGRbfsdhp
-rFMkh5UxTexnOzD4O8HPuJ6NGeWRQfqZT1nnjwHPeJWtiMHT6cnWxlzvxAZ61mio
-0jRfb8flhgFKk+G9+Xa6WaYAAwGWdF062EMe2Ym92oKM9ilTPGFVRk1XAoGBAMLD
-ETSQd2UqTF/y7wxMPqF3l6d1KBjwpuNuin2IjkXTOfGkDnAU3mSQlr7K1IPX8NPO
-gdyMfJoysfRaBuRcNA/o/0l0wyxW4HWtTtPYI0+pRCFtRLsI1MB997QKeaGKb+me
-3nBXkOksPSr9oa0Cs27z2cSoBOkpq2N/zzBseHExAoGAOyq3rKBZNehEwTHnb9I0
-8+9FA3U6zh9LKjkCIEGW00Uapj/cOMsEIG2a8DEwfW84SWS8OEBkr43fSGBkGo/Y
-NDrkFw2ytVee0TQNGTTod6IQ2EPmera7I5XEml5/71kOyZWi40vQVqZAQDR2qgha
-BFdzmwywJ1Hg0OUs+pSXlccCgYEAgyOVki80NYolovWQwFcWVOKR2s+oECL6PGlS
-FvS714hCm9I7ZnymwlAZMJ6iOaRNJFEIX9i4jZtU95Mm0NzEsXHRc0SLpm9Y8+Oe
-EEaYgCsZFOjePpHTr0kiYLgs7fipIkU2wa40hMyk4y2kjzoiV7MaDrCTnevQ205T
-0+c1sgECgYBAXKcwdkh9JVSrLXFamsxiOx3MZ0n6J1d28wpdA3y4Y4AAJm4TGgFt
-eG/6qHRy6CHdFtJ7a84EMe1jaVLQJYW/VrOC2bWLftkU7qaOnkXHvr4CAHsXQHcx
-JhLfvh4ab3KyoK/iimifvcoS5z9gp7IBFKMyh5IeJ9Y75TgcfJ5HMg==
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCgG5BsdsN/kNfD
+MC6C1y+zf9RFthZDlcxI45+Baf9JEjpd5pAqvL7s2ZGGFgHUpWsKghVGwikvvTxG
+keuxSFtnhcHqz1kebXw7PIWThnAYHHT6nEFm46ig3r69d6RitVy+ItdjHnlP9ErQ
+1E7M2zOHxops0aPFAouKDD+KlyPLypSTSuCd+toLcFoLmlblK7vvcv9TcY59A348
+sR8N/R+oiIF8mgFEZOHN2f3znvEyHaELwwzGS0R+biG4V1ZGCEmuoiX4Ay/7fMBh
+YW1Y4yVKBFcoAifRDrIEx9ZITbmxMyOcaGTTshky8UaVaoZZUHLEnVwbcEx3pEu1
+rTY1i/krAgMBAAECggEAAoiXy/CpcXF268xT69LrXx64lolILBxI3FkVOq47hL1L
+xQRb7+8PWZYBZJWHPAVnbY6bjGJMCVnj6o47girwBTZJcfJQKaT3wG6eE9bAxkdN
+AHPUz8f/Rg6NF762zATO9DrDDC44mo2xwFIXev93qY0JaZh77ic7W2F7CYcyvuEy
+SvOirpSorKKdsepyntkBzrg9W9lQZ/6luso9J5jAZUAoFaQFa1P9xIkbpNcOf1fP
+GDZ5XkU+QqhrHN5UzAeSiuuyavKRP44k9A5+93izkdxNtbFi4cPzAwqcf+eeKQD1
+A6Qad+wHOtzvdX4TDTwObUzZVvG/WV66Aiwv1jBQoQKBgQDYyWHSv9PVt2EFvC3b
+RDZ88Xo6P0wXGgP5W3xnyjgZTrxQMmcQqMMNwR225C+Fr12qLj1cGIB9BjuHdGBi
+F/jjoNQhIbgDkkWfO3td0NLq9/wGlKBQzjsdHyNTFGoJtY+6O58uCyxCBmDm7xHT
+P6/HMA9ARc1KUaLL3GXaLTjMlQKBgQC9EZSXGJJd3MJ2A45iCBGWWIE1jf1yUvj4
+tYE4W8lfDTyO6ZrqL5drpnR7cDEuB1kRY1sKBPXUl+xSyga8bzQFh20e6PFWaTvP
+LVdkW3Lw8xNp8+jn8L/W11o928jH/OjSSjHiYyA3SpsfZWRZJ2h40nqyTK3lZw6O
+CvZsXRJ+vwKBgDWFYnVZjr8Qyw9Tai7cJGesZnTC89IwRhLmF0y4jCkTW0KhbviZ
+8a4Po3pn06O5q/I8AEIgenhjdYb3oGQXbwcjybt0S632CuJJGSgMSkZgewRU5U+N
+2uJRsbLtM1C6VoWv+pivgXm7gWkCVPBGpOsUXm+LzCcxCHQ0MaEv0PoRAoGBAKyf
+LId3y8sfD/0n6gvfSg925yG6bji/QMnzDfQi+YxrTWs+Jk7C/QEwjRFWsdBQrSWP
+DUPsm3Zq7z33bocFEP4rU5nxHMfEdPMHds8OH7eWd5c5NuDtknnZTW9FB+BwLTIy
+w7DqyDMzTsYvkJtFu8D0i0nXcL4Ohd9yauMtZwGJAoGASUPgYv7j2fs8Y2KZG2FD
+m0+PZPnKG3ZuX40d0IxFczPp/owwAoYAiudIzAVmF/nqBhw9tQkchH0dzS1hk3Op
+KXTzOw5Q2IPlHRKY4jhldW0NneYMOk+ZaLfswjtPaORs7Zb8Y6xqgFwYs+Q1CqQO
+q06h0QZ4bRUDrwWsG6NU5MU=
+-----END PRIVATE KEY-----
 EOKEY
 chmod 0600 "$PGDATA/server.key"
 
 cat > "$PGDATA/server.crt" <<-EOCERT
 -----BEGIN CERTIFICATE-----
-MIID9DCCAtygAwIBAgIJAIYfg4EQ2pVAMA0GCSqGSIb3DQEBBQUAMFkxCzAJBgNV
-BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
-aWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMTCWxvY2FsaG9zdDAeFw0xNjA2MjgyMjQw
-NDFaFw0yNjA2MjYyMjQwNDFaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21l
-LVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNV
-BAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJZS
-LV8K4+tjJMSlZc9hYpiZONllnNyvNkZ9rwJes9/M0MUgo7fblsF1k8eWDnRolHAP
-iVAK7mcaje73X6YSaGLU63K6U+KwvxbAjCJgcZI9XMXWE6veEhZ/W0AUWZO0VMeC
-qJbfv4dHdz6TSG+A28kPANDFbzVcS6UUVcHOskD/jZETMoB0fptz/H8RxLZBwlcu
-xzkWwErzfH0ZURDBwy9oZGnV9ATTO9gw6Pg1oTwPBhell7SJdYFOhj+qUmxHjBw9
-3/ro+3/Yko75Kx6zrdpy1EPUJ3r9p4ZlNP3TiMHkNe/xa5S/Y2A1FBTTkco0Z5V1
-1KD+QTvy3RAAKk9gNKcCAwEAAaOBvjCBuzAdBgNVHQ4EFgQUEcuoFxzUZ4VV9VPv
-5frDyIuFA5cwgYsGA1UdIwSBgzCBgIAUEcuoFxzUZ4VV9VPv5frDyIuFA5ehXaRb
-MFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJ
-bnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMTCWxvY2FsaG9zdIIJAIYf
-g4EQ2pVAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAHwMzmXdtz3R
-83HIdRQic40bJQf9ucSwY5ArkttPhC8ewQGyiGexm1Tvx9YA/qT2rscKPHXCPYcP
-IUE+nJTc8lQb8wPnFwGdHUsJfCvurxE4Yv4Oi74+q1enhHBGsvhFdFY5jTYD9unM
-zBEn+ZHX3PlKhe3wMub4khBTbPLK+n/laQWuZNsa+kj7BynkAg8W/6RK0Z0cJzzw
-aiVP0bSvatAAcSwkEfKEv5xExjWqoewjSlQLEZYIjJhXdtx/8AMnrcyxrFvKALUQ
-9M15FXvlPOB7ez14xIXQBKvvLwXvteHF6kYbzg/Bl1Q2GE9usclPa4UvTpnLv6gq
-NmFaAhoxnXA=
+MIIDkzCCAnugAwIBAgIUTF4DePeZT01AB1mAluKLZDeRGtUwDQYJKoZIhvcNAQEL
+BQAwWTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MB4X
+DTI2MDYwOTA4NDY1MVoXDTM2MDYwNjA4NDY1MVowWTELMAkGA1UEBhMCQVUxEzAR
+BgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5
+IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAoBuQbHbDf5DXwzAugtcvs3/URbYWQ5XMSOOfgWn/SRI6XeaQKry+
+7NmRhhYB1KVrCoIVRsIpL708RpHrsUhbZ4XB6s9ZHm18OzyFk4ZwGBx0+pxBZuOo
+oN6+vXekYrVcviLXYx55T/RK0NROzNszh8aKbNGjxQKLigw/ipcjy8qUk0rgnfra
+C3BaC5pW5Su773L/U3GOfQN+PLEfDf0fqIiBfJoBRGThzdn9857xMh2hC8MMxktE
+fm4huFdWRghJrqIl+AMv+3zAYWFtWOMlSgRXKAIn0Q6yBMfWSE25sTMjnGhk07IZ
+MvFGlWqGWVByxJ1cG3BMd6RLta02NYv5KwIDAQABo1MwUTAdBgNVHQ4EFgQUpiCS
+JHcnxUjr4GKKg0Icbmk4W14wHwYDVR0jBBgwFoAUpiCSJHcnxUjr4GKKg0Icbmk4
+W14wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAgZK5UPdkhgI8
+BEeV7gm/ZmDiX3Dhp8l+PjagpDSpXkV0LmCEeA4jxskL5FdIr349lT4CZ7QWPkyv
+OEmwG4N6qWU5H0fNmSHwBPVhQy6EknmCAhs0LsVXoy235ONHFbdgi3SVfJ5pMYgK
+BVX/ADXErM4ifJzQoZFuQ6S8P3IstDDybeT+aPWOi5Fh2o7wYp9GqBFL/G+Nh9SI
+xPs3x8oYzw/qDTXHduL1Onb8+ZTOSkMC9ONDUgmQUlIlpd/SCC1M8wzleyH5atMc
+h/kmDuWEegS1ohJrZ1ATA5u66hyWU2eDFHi1NCIYwIuEfoULKihSqABDSuwe3wXS
+RkTYLofsiw==
 -----END CERTIFICATE-----
 EOCERT
 

postgres-protocol/src/authentication/sasl.rs

@@ -20,10 +20,9 @@ const NONCE_LENGTH: usize = 24;
 /// The iteration count is sent by the server and drives a PBKDF2 loop, so an
 /// unbounded value lets a malicious or impersonating server force the client to
 /// perform an arbitrary number of HMAC operations before authentication even
-/// completes (a denial of service). 100_000 is ~24x the PostgreSQL default of
-/// 4096 and matches the default cap the PostgreSQL JDBC driver (pgjdbc) adopted
-/// for the same issue (CVE-2026-42198).
-const MAX_ITERATION_COUNT: u32 = 100_000;
+/// completes (a denial of service). Allow servers configured with up to
+/// 2_000_000 iterations while keeping authentication work bounded.
+const MAX_ITERATION_COUNT: u32 = 2_000_000;
 
 /// The identifier of the SCRAM-SHA-256 SASL authentication mechanism.
 pub const SCRAM_SHA_256: &str = "SCRAM-SHA-256";
@@ -502,16 +501,32 @@ mod test {
         scram.finish(server_final.as_bytes()).unwrap();
     }
 
+    #[test]
+    fn iteration_count_limit_is_accepted() {
+        let nonce = "9IZ2O01zb9IgiIZ1WJ/zgpJB";
+        let server_first =
+            "r=9IZ2O01zb9IgiIZ1WJ/zgpJBjx/oIRLs02gGSHcw1KEty3eY,s=fs3IXBy7U7+IvVjZ,i=2000000";
+
+        let mut scram =
+            ScramSha256::new_inner(b"foobar", ChannelBinding::unsupported(), nonce.to_string());
+        scram.update(server_first.as_bytes()).unwrap();
+    }
+
     #[test]
     fn excessive_iteration_count_is_rejected() {
         // a malicious server cannot force an unbounded PBKDF2 loop; the iteration
         // count is rejected before `hi()` runs.
         let nonce = "9IZ2O01zb9IgiIZ1WJ/zgpJB";
         let server_first =
-            "r=9IZ2O01zb9IgiIZ1WJ/zgpJBjx/oIRLs02gGSHcw1KEty3eY,s=fs3IXBy7U7+IvVjZ,i=1000000";
+            "r=9IZ2O01zb9IgiIZ1WJ/zgpJBjx/oIRLs02gGSHcw1KEty3eY,s=fs3IXBy7U7+IvVjZ,i=2000001";
 
         let mut scram =
             ScramSha256::new_inner(b"foobar", ChannelBinding::unsupported(), nonce.to_string());
-        assert!(scram.update(server_first.as_bytes()).is_err());
+        let err = scram.update(server_first.as_bytes()).unwrap_err();
+        assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
+        assert_eq!(
+            err.to_string(),
+            "SCRAM iteration count exceeds the maximum allowed"
+        );
     }
 }

test/server.crt

@@ -1,24 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIID9DCCAtygAwIBAgIJAIYfg4EQ2pVAMA0GCSqGSIb3DQEBBQUAMFkxCzAJBgNV
-BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
-aWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMTCWxvY2FsaG9zdDAeFw0xNjA2MjgyMjQw
-NDFaFw0yNjA2MjYyMjQwNDFaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21l
-LVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNV
-BAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJZS
-LV8K4+tjJMSlZc9hYpiZONllnNyvNkZ9rwJes9/M0MUgo7fblsF1k8eWDnRolHAP
-iVAK7mcaje73X6YSaGLU63K6U+KwvxbAjCJgcZI9XMXWE6veEhZ/W0AUWZO0VMeC
-qJbfv4dHdz6TSG+A28kPANDFbzVcS6UUVcHOskD/jZETMoB0fptz/H8RxLZBwlcu
-xzkWwErzfH0ZURDBwy9oZGnV9ATTO9gw6Pg1oTwPBhell7SJdYFOhj+qUmxHjBw9
-3/ro+3/Yko75Kx6zrdpy1EPUJ3r9p4ZlNP3TiMHkNe/xa5S/Y2A1FBTTkco0Z5V1
-1KD+QTvy3RAAKk9gNKcCAwEAAaOBvjCBuzAdBgNVHQ4EFgQUEcuoFxzUZ4VV9VPv
-5frDyIuFA5cwgYsGA1UdIwSBgzCBgIAUEcuoFxzUZ4VV9VPv5frDyIuFA5ehXaRb
-MFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJ
-bnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMTCWxvY2FsaG9zdIIJAIYf
-g4EQ2pVAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAHwMzmXdtz3R
-83HIdRQic40bJQf9ucSwY5ArkttPhC8ewQGyiGexm1Tvx9YA/qT2rscKPHXCPYcP
-IUE+nJTc8lQb8wPnFwGdHUsJfCvurxE4Yv4Oi74+q1enhHBGsvhFdFY5jTYD9unM
-zBEn+ZHX3PlKhe3wMub4khBTbPLK+n/laQWuZNsa+kj7BynkAg8W/6RK0Z0cJzzw
-aiVP0bSvatAAcSwkEfKEv5xExjWqoewjSlQLEZYIjJhXdtx/8AMnrcyxrFvKALUQ
-9M15FXvlPOB7ez14xIXQBKvvLwXvteHF6kYbzg/Bl1Q2GE9usclPa4UvTpnLv6gq
-NmFaAhoxnXA=
+MIIDkzCCAnugAwIBAgIUTF4DePeZT01AB1mAluKLZDeRGtUwDQYJKoZIhvcNAQEL
+BQAwWTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MB4X
+DTI2MDYwOTA4NDY1MVoXDTM2MDYwNjA4NDY1MVowWTELMAkGA1UEBhMCQVUxEzAR
+BgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5
+IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAoBuQbHbDf5DXwzAugtcvs3/URbYWQ5XMSOOfgWn/SRI6XeaQKry+
+7NmRhhYB1KVrCoIVRsIpL708RpHrsUhbZ4XB6s9ZHm18OzyFk4ZwGBx0+pxBZuOo
+oN6+vXekYrVcviLXYx55T/RK0NROzNszh8aKbNGjxQKLigw/ipcjy8qUk0rgnfra
+C3BaC5pW5Su773L/U3GOfQN+PLEfDf0fqIiBfJoBRGThzdn9857xMh2hC8MMxktE
+fm4huFdWRghJrqIl+AMv+3zAYWFtWOMlSgRXKAIn0Q6yBMfWSE25sTMjnGhk07IZ
+MvFGlWqGWVByxJ1cG3BMd6RLta02NYv5KwIDAQABo1MwUTAdBgNVHQ4EFgQUpiCS
+JHcnxUjr4GKKg0Icbmk4W14wHwYDVR0jBBgwFoAUpiCSJHcnxUjr4GKKg0Icbmk4
+W14wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAgZK5UPdkhgI8
+BEeV7gm/ZmDiX3Dhp8l+PjagpDSpXkV0LmCEeA4jxskL5FdIr349lT4CZ7QWPkyv
+OEmwG4N6qWU5H0fNmSHwBPVhQy6EknmCAhs0LsVXoy235ONHFbdgi3SVfJ5pMYgK
+BVX/ADXErM4ifJzQoZFuQ6S8P3IstDDybeT+aPWOi5Fh2o7wYp9GqBFL/G+Nh9SI
+xPs3x8oYzw/qDTXHduL1Onb8+ZTOSkMC9ONDUgmQUlIlpd/SCC1M8wzleyH5atMc
+h/kmDuWEegS1ohJrZ1ATA5u66hyWU2eDFHi1NCIYwIuEfoULKihSqABDSuwe3wXS
+RkTYLofsiw==
 -----END CERTIFICATE-----

tokio-postgres/Cargo.toml

@@ -44,7 +44,7 @@ with-uuid-0_8 = ["postgres-types/with-uuid-0_8"]
 with-uuid-1 = ["postgres-types/with-uuid-1"]
 with-time-0_2 = ["postgres-types/with-time-0_2"]
 with-time-0_3 = ["postgres-types/with-time-0_3"]
-js = ["postgres-protocol/js", "postgres-types/js"]
+js = ["postgres-protocol/js", "postgres-types/js", "getrandom/wasm_js"]
 
 [dependencies]
 async-trait = "0.1"
@@ -53,6 +53,7 @@ byteorder = "1.0"
 fallible-iterator = "0.2"
 futures-channel = { version = "0.3", features = ["sink"] }
 futures-util = { version = "0.3", default-features = false, features = ["sink"] }
+getrandom = { version = "0.3", optional = true }
 log = "0.4"
 parking_lot = "0.12"
 percent-encoding = "2.0"

tokio-postgres/src/query.rs

@@ -73,7 +73,7 @@ where
         let param_oids = params.iter().map(|(_, t)| t.oid()).collect::<Vec<_>>();
 
         client.with_buf(|buf| {
-            frontend::parse("", query, param_oids.into_iter(), buf).map_err(Error::parse)?;
+            frontend::parse("", query, param_oids, buf).map_err(Error::parse)?;
             encode_bind_raw("", params, "", buf)?;
             frontend::describe(b'S', "", buf).map_err(Error::encode)?;
             frontend::execute("", 0, buf).map_err(Error::encode)?;

tokio-postgres/tests/test/types/mod.rs

@@ -46,7 +46,7 @@ mod uuid_1;
 
 async fn test_type<T, S>(sql_type: &str, checks: &[(T, S)])
 where
-    T: PartialEq + for<'a> FromSqlOwned + ToSql + Sync,
+    T: PartialEq + FromSqlOwned + ToSql + Sync,
     S: fmt::Display,
 {
     let client = connect("user=postgres").await;

tokio-postgres/tests/test/types/time_03.rs

@@ -15,8 +15,10 @@ use crate::types::test_type;
 #[tokio::test]
 async fn test_primitive_date_time_params() {
     fn make_check(time: &str) -> (Option<PrimitiveDateTime>, &str) {
-        let format =
-            format_description::parse("'[year]-[month]-[day] [hour]:[minute]:[second]'").unwrap();
+        let format = format_description::parse_borrowed::<1>(
+            "'[year]-[month]-[day] [hour]:[minute]:[second]'",
+        )
+        .unwrap();
         (Some(PrimitiveDateTime::parse(time, &format).unwrap()), time)
     }
     test_type(
@@ -34,8 +36,10 @@ async fn test_primitive_date_time_params() {
 #[tokio::test]
 async fn test_with_special_primitive_date_time_params() {
     fn make_check(time: &str) -> (Timestamp<PrimitiveDateTime>, &str) {
-        let format =
-            format_description::parse("'[year]-[month]-[day] [hour]:[minute]:[second]'").unwrap();
+        let format = format_description::parse_borrowed::<1>(
+            "'[year]-[month]-[day] [hour]:[minute]:[second]'",
+        )
+        .unwrap();
         (
             Timestamp::Value(PrimitiveDateTime::parse(time, &format).unwrap()),
             time,
@@ -58,7 +62,7 @@ async fn test_with_special_primitive_date_time_params() {
 async fn test_offset_date_time_params() {
     fn make_check(time: &str) -> (Option<OffsetDateTime>, &str) {
         let format =
-            format_description::parse("'[year]-[month]-[day] [hour]:[minute]:[second] [offset_hour sign:mandatory][offset_minute]'").unwrap();
+            format_description::parse_borrowed::<1>("'[year]-[month]-[day] [hour]:[minute]:[second] [offset_hour sign:mandatory][offset_minute]'").unwrap();
         (Some(OffsetDateTime::parse(time, &format).unwrap()), time)
     }
     test_type(
@@ -77,7 +81,7 @@ async fn test_offset_date_time_params() {
 async fn test_with_special_offset_date_time_params() {
     fn make_check(time: &str) -> (Timestamp<OffsetDateTime>, &str) {
         let format =
-            format_description::parse("'[year]-[month]-[day] [hour]:[minute]:[second] [offset_hour sign:mandatory][offset_minute]'").unwrap();
+            format_description::parse_borrowed::<1>("'[year]-[month]-[day] [hour]:[minute]:[second] [offset_hour sign:mandatory][offset_minute]'").unwrap();
         (
             Timestamp::Value(OffsetDateTime::parse(time, &format).unwrap()),
             time,
@@ -99,7 +103,7 @@ async fn test_with_special_offset_date_time_params() {
 #[tokio::test]
 async fn test_date_params() {
     fn make_check(date: &str) -> (Option<time_03::Date>, &str) {
-        let format = format_description::parse("'[year]-[month]-[day]'").unwrap();
+        let format = format_description::parse_borrowed::<1>("'[year]-[month]-[day]'").unwrap();
         (Some(time_03::Date::parse(date, &format).unwrap()), date)
     }
     test_type(
@@ -117,7 +121,7 @@ async fn test_date_params() {
 #[tokio::test]
 async fn test_with_special_date_params() {
     fn make_check(date: &str) -> (Date<time_03::Date>, &str) {
-        let format = format_description::parse("'[year]-[month]-[day]'").unwrap();
+        let format = format_description::parse_borrowed::<1>("'[year]-[month]-[day]'").unwrap();
         (
             Date::Value(time_03::Date::parse(date, &format).unwrap()),
             date,
@@ -139,7 +143,7 @@ async fn test_with_special_date_params() {
 #[tokio::test]
 async fn test_time_params() {
     fn make_check(time: &str) -> (Option<time_03::Time>, &str) {
-        let format = format_description::parse("'[hour]:[minute]:[second]'").unwrap();
+        let format = format_description::parse_borrowed::<1>("'[hour]:[minute]:[second]'").unwrap();
         (Some(time_03::Time::parse(time, &format).unwrap()), time)
     }
     test_type(