chore: Update non-major dependencies

[renovate]

Summary

• Non-major dependencies are bumped (gofakeit v7.17.1, urfave/cli/v3 v3.13.0, and genproto digest updates), keeping the framework on current non-major releases.
• google.golang.org/grpc is pinned to the patched pre-release v1.85.0-dev.0.20260825072537-93e31b48545e in both the root and tests modules, replacing the vulnerable v1.84.0 reported by govulncheck (GO-2026-6443), so the govulncheck CI job passes again.
• Renovate now carries an allowedVersions guard on google.golang.org/grpc, so the vulnerable v1.84.0 cannot be re-introduced by a future non-major update.

Why

Renovate moved google.golang.org/grpc to v1.84.0 as part of this non-major batch, and that release is flagged under GO-2026-6443 / CVE-2026-84445, which fails the govulncheck CI job for the whole branch. gRPC is a direct dependency of the framework, so every application that dials a server through facades.Grpc() resolves the same module version.

conn, err := facades.Grpc().Connect("user")
if err != nil {
    return err
}
defer conn.Close()

client := userpb.NewUserServiceClient(conn)
resp, err := client.Get(ctx, &userpb.GetRequest{
    Name: "goravel",
})

The fix pins both modules to the patched pre-release and adds a Renovate guard so the vulnerable version cannot slip back in. Runtime behavior is unchanged for applications: the same client code keeps working, and it now compiles and connects against a gRPC build without the reported vulnerability.

// Before: the framework's module graph resolved the vulnerable release.
require google.golang.org/grpc v1.84.0

// After: it resolves the patched pre-release, and govulncheck is clean.
require google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e

[renovate]

ℹ️ Artifact update notice

File name: tests/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 12 additional dependencies were updated

Details:

Package	Change
github.com/dave/dst	v0.27.4 -> v0.28.0
github.com/dromara/carbon/v2	v2.6.11 -> v2.6.17
github.com/mattn/go-runewidth	v0.0.29 -> v0.0.30
github.com/urfave/cli/v3	v3.11.0 -> v3.13.0
golang.org/x/crypto	v0.56.0 -> v0.57.0
golang.org/x/exp	v0.0.0-20260824195058-e88cd73687aa -> v0.0.0-20260908205506-85c1c2202aba
golang.org/x/net	v0.58.0 -> v0.59.0
golang.org/x/sync	v0.22.0 -> v0.23.0
golang.org/x/sys	v0.47.0 -> v0.48.0
golang.org/x/term	v0.45.0 -> v0.46.0
golang.org/x/text	v0.41.0 -> v0.42.0
google.golang.org/grpc	v1.83.2 -> v1.84.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.71%. Comparing base (f54ab13) to head (30cc7f3).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1563   +/-   ##
=======================================
  Coverage   72.71%   72.71%           
=======================================
  Files         412      412           
  Lines       26791    26791           
=======================================
  Hits        19482    19482           
  Misses       7307     7307           
  Partials        2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.