[pull] main from rust-db:main - #7

* Fixes a bug in `get_last_applied_migration` due to an incorrect SQL
  query that partially uses dynamic table names and partially hardcodes
  the default one.

* Adds a new utility function that enables dynamic migration discovery
  where embedding is not desirable.

Make the relative link to example work from the refinery folder

* generate EmbeddedMigrations enum

* create enum from migration

* consolidate regex and remove lazy_static

* fmt, cleanup

* remove unused trait

* use From for migration enum

* remove unneeded usings

* add feature flag, update example project

* fmt

* Update refinery_core/src/util.rs

Co-authored-by: João Oliveira <hello@jxs.pt>

* Update refinery_core/src/util.rs

Co-authored-by: João Oliveira <hello@jxs.pt>

* Update refinery_core/src/util.rs

Co-authored-by: João Oliveira <hello@jxs.pt>

* Update refinery_core/src/util.rs

Co-authored-by: João Oliveira <hello@jxs.pt>

---------

Co-authored-by: João Oliveira <hello@jxs.pt>

closes #325

* Allow Postgres tests to be run on a different database

Not everyone has a "scratch" PostgreSQL running on localhost:5432 for refinery to scribble all over.
Now you can specify an arbitrary PostgreSQL server to work on with the `DB_URI` environment variable (which appears to be what `refinery-cli` already uses) to test in.

* Improve DB reset process

* Use a more appropriate name for the function that does the work
* Clean just the `public` schema, rather than drop/create the whole DB.  This means that running the tests no longer requires superuser privs, and that we don't have to temporarily hide out in `template1`.
* Drop the `catch_unwind`, because it's needed any more.

---------

Co-authored-by: João Oliveira <hello@jxs.pt>

* Enable math functions for SQLite

* Update .cargo/config.toml

---------

Co-authored-by: Pamplemousse <git@xaviermaso.com>
Co-authored-by: João Oliveira <hello@jxs.pt>

remove no longer required async section and mention external drivers

This allows avoiding double iteration when calling migrate with the grouped option active

Co-authored-by: Youser Nayme <7685106-NeutralModder@users.noreply.gitlab.com>
Co-authored-by: João Oliveira <hello@jxs.pt>

Co-authored-by: Robert McGregor <rob@aa.net.uk>
Co-authored-by: João Oliveira <hello@jxs.pt>

Co-authored-by: João Oliveira <hello@jxs.pt>

* Add support for using TLS with PostgreSQL (#260)

* Make use_tls optional in config

* Include openssl crates in refinery module

* tls support for postgres using native-tls

* use tls for tokio_postgres as well

* nit

* nit

* fix issues

* avoid touching main Cargo.toml

* add new tests

* fix serde bug

---------

Co-authored-by: moss <moss@banay.me>
Co-authored-by: João Oliveira <hello@jxs.pt>

* Support int8 migration versions via new int8-versions feature

This addresses, though does not really *fix* #83, because it doesn't make refinery support timestamped migrations *by default*, but only if you opt-in to the new feature.
However, making it an optional feature neatly sidesteps the unanswered questions in the issue, and so makes the implementation easier to complete and land.

* cargo clippy

* update wording

* remove repr

* fix enum migrations

* enable int8-versions test

* fix PR

---------

Co-authored-by: João Oliveira <hello@jxs.pt>

execute functions, to avoid double iteration.

* feat: derive Serialize for Migration if serde is enabled

* time/serde dep feature

* ci

Co-authored-by: Youser Nayme <7685106-NeuralModder@users.noreply.gitlab.com>

* Allow disabling Config for postgres and tokio-postgres

* Fix building refinery_cli with no deault features

* Enable config for refinery features

* Add config to tiberius-config

* Make tls opt-in rather than opt-out

* Use postgres-tls in cli

* Test postgres + tls

---------

Co-authored-by: João Oliveira <hello@jxs.pt>

Bumps [rand](https://github.com/rust-random/rand) from 0.9.2 to 0.9.4.
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.9.4/CHANGELOG.md)
- [Commits](rust-random/rand@rand_core-0.9.2...0.9.4)

---
updated-dependencies:
- dependency-name: rand
  dependency-version: 0.9.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from 0.10.73 to 0.10.78.
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.73...openssl-v0.10.78)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.78
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: João Oliveira <hello@jxs.pt>

* fix(core): guard native-tls usage with tls feature flag

When tokio-postgres or postgres features are enabled without the tls
feature, config.rs still referenced native_tls and postgres_native_tls
crates that are no longer pulled in. Guard those code paths with
#[cfg(feature = "tls")] so that no-TLS builds do not require openssl.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(core): panic when TLS requested but tls feature not enabled

Instead of silently falling back to an unencrypted connection when
use_tls() is true but the 'tls' feature is disabled, panic with a
clear message so the misconfiguration is immediately visible.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(core): add tokio-postgres-rustls feature for rustls TLS support

Adds a new `tokio-postgres-rustls` feature to refinery/refinery-core
that provides TLS for the config-based tokio-postgres connection path
using rustls instead of native-tls/openssl.

Design: no crypto provider is bundled. Callers must install a global
provider (e.g. ring or aws-lc-rs) before running migrations with TLS.
System trust roots are loaded via rustls-native-certs. When use_tls()
is true but the feature is disabled, a clear panic is raised.

Note: tokio-postgres-rustls 0.13 has an unconditional ring dep for
certificate fingerprinting (unrelated to the TLS crypto provider).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: Update `rustls-webpki` to fix `RUSTSEC-2026-0104`

* chore: Add ISC to allowed licenses

* Make `tokio-postgres-*` tls features imply `tokio-postgres`

* Add `tokio-postgres-rustls` test

Also make postgres connection string configurable via `POSTGRES_URL` environment
variable.

* style: Format sources

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: João Oliveira <hello@jxs.pt>

Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from 0.10.78 to 0.10.80.
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.80)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.80
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Prepare 0.9.1 (#423)

* prepare 0.9.1

* Support rusqlite 0.38.x (#410)

Co-authored-by: Youser Nayme <7685106-NeuralModder@users.noreply.gitlab.com>

* do not log warning on nested dirs when finding migrations (#421)

---------

Co-authored-by: Youser Nayme <51252915+NeuralModder@users.noreply.github.com>
Co-authored-by: Youser Nayme <7685106-NeuralModder@users.noreply.gitlab.com>

* Apply suggestion from @jxs

* Update refinery/Cargo.toml

---------

Co-authored-by: Youser Nayme <51252915+NeuralModder@users.noreply.github.com>
Co-authored-by: Youser Nayme <7685106-NeuralModder@users.noreply.gitlab.com>

* Prepare 0.9.2

- Bump versions to 0.9.2 in all crates
- Update inter-crate dependency references
- Add 0.9.2 changelog entries for TLS opt-in (#408),
  tokio-postgres-rustls feature (#426), rusqlite 0.39.x (#425),
  and toml 1.1.2 (#430)

* Bump mysql to 0.28.x and mysql_async to 0.37.x

* Apply suggestion from @jxs

* Apply suggestion from @jxs