RUSTSEC-2026-0178: Panic on a `DataRow` with fewer fields than columns allows denial of service

Panic on a DataRow with fewer fields than columns allows denial of service

A malicious or compromised server can send a row containing fewer fields than
its row description declares columns. Reading one of the missing columns then
panics with an out-of-bounds index, aborting the calling task. This affects even
the otherwise non-panicking try_get, and both Row and SimpleQueryRow.

Applications that connect only to a trusted database are not exposed; the risk
applies to clients that may connect to untrusted or user-supplied servers, or
whose connection can be intercepted by a man-in-the-middle.

See advisory page for additional details.

Start with graph-node's tokio-postgres 0.7.15 dependency, then read the linked upstream commit and the RUSTSEC-2026-0178 advisory. Confirm how the dependency is resolved and update it to a patched version at least 0.7.18; done means the affected dependency is no longer selected and relevant checks pass.