feat(mysql): make rsa dependency optional (RUSTSEC-2023-0071)

[sylvain-pierrot]

Does your PR solve an issue?

No related issue. This addresses RUSTSEC-2023-0071 (CVE-2023-49092, "Marvin Attack"), a known timing side-channel in the rsa crate with no patched release (patched = [] in the advisory).

Is this a breaking change?

Yes, for users of sha256_password or caching_sha2_password over non-TLS connections: they must now enable features = ["rsa"] on sqlx-mysql explicitly. All other users are unaffected.

The breakage is intentional and narrow: the rsa crate has a known, unfixed cryptographic vulnerability. Keeping it as an unconditional dependency silently exposes every sqlx user to RUSTSEC-2023-0071 in their cargo audit output, even those who never enable the mysql feature. Opting in makes the risk visible and deliberate.

---

Problem

Because Cargo resolves optional dependencies eagerly to produce a lock file valid for all feature combinations, rsa appears in the lock file of any project that depends on sqlx, even when the mysql feature is never enabled. This causes every such project to fail cargo audit for a vulnerability that cannot be compiled, let alone reached.

Solution

Make rsa an opt-in feature of sqlx-mysql.

MySQL's sha256_password and caching_sha2_password plugins use RSA only on non-TLS connections. When the connection is already TLS-encrypted the driver sends the password in cleartext over the secure channel and never touches RSA. Users who always connect over TLS (the recommended practice) have no need for the rsa crate at all.

Changes

• sqlx-mysql/Cargo.toml: rsa = "0.9" → rsa = { version = "0.9", optional = true } + rsa = ["dep:rsa"] feature
• sqlx-mysql/src/connection/auth.rs: use rand::thread_rng, use rsa::{…}, the non-TLS RSA body of encrypt_rsa, and parse_rsa_pub_key are all gated with #[cfg(feature = "rsa")]; when the feature is absent a non-TLS RSA attempt returns a protocol error directing users to enable it

Behaviour

Scenario	Before	After
Any TLS connection	✅ works	✅ unchanged
Non-TLS + sha256_password / caching_sha2_password, rsa feature enabled	✅ works	✅ unchanged
Non-TLS + sha256_password / caching_sha2_password, rsa feature absent	✅ works	❌ clear error: enable rsa feature
cargo audit without mysql feature	❌ RUSTSEC-2023-0071	✅ clean

No other auth plugins affected.

[DocteurPing]

That's a great PR i was thinking of doing something like this for my project because sqlx makes my CI fails even if i'm not using mysql.