[goravel-agent]

Summary

• Cover {{ csrf_field }} end-to-end under both drivers: the hidden _token input reaches the page as raw HTML (template.HTML), while a hostile session token is HTML-escaped inside the value attribute.
• Cover the fillShared assignability guard: rendering a view with map[string]string data while a session exists skips shared values that cannot be assigned to the map element type instead of panicking, and csrf_token is still merged in.
• Pin github.com/goravel/gin to v1.18.1-0.20261026033159-4d2c4e578ae1 and github.com/goravel/fiber to v1.18.1-0.20261026033240-13f6b8ac2d3c (the merged feat: Add {{ csrf_field }} template function gin#258 and feat: Add {{ csrf_field }} template function fiber#313 commits) so the coverage runs against the fixed behavior.

Why

middleware.StartSession() is registered globally, so every view render carries csrf_token and csrf_field in the shared data. Before goravel/gin#258 and goravel/fiber#313 there was no csrf_field at all, and fillShared wrote shared values with an unguarded reflect.Value.SetMapIndex, which panics as soon as a map[string]string view receives a template.HTML value. This PR adds regression coverage for both halves of that fix in the existing ViewTestSuite, which tests/feature/fiber_test.go already re-runs under TestFiberDriver, so neither driver can regress unnoticed. resources/views/admin/index.tmpl and tests/feature/http_test.go are deliberately untouched — they are owned by the open #160.

The templates render {{ .csrf_token }} beside {{ .csrf_field }}, so a single full-body comparison fails loudly if the hidden input comes back escaped. The map[string]string case needs no test-only session mutation: the fixed token is written through the normal test session helper.

facades.Route().Prefix("view-csrf").Group(func(router route.Router) {
	// csrf_field is template.HTML, so the <input> tag must reach the page unescaped.
	router.Get("field", func(ctx http.Context) http.Response {
		return ctx.Response().View().Make("admin/csrf_field.tmpl")
	})

	// map[string]string data plus a session: csrf_field is not assignable to the
	// map element type, so the driver must skip it instead of panicking.
	router.Get("string-map", func(ctx http.Context) http.Response {
		return ctx.Response().View().Make("admin/csrf_string_map.tmpl", map[string]string{
			"name": "Goravel",
		})
	})
})

Dependency note: the require line for github.com/goravel/framework moved to v1.18.1-0.20261019082352-bc9e320af832 only as module-graph bookkeeping, because the new gin requires a newer framework. The replace directive still pins the framework code compiled and tested here to v1.18.1-0.20260925125002-93850001fe6f (there is a matching comment above that replace line in go.mod). This is not a framework upgrade. The direct go.opentelemetry.io/otel* and google.golang.org/grpc bumps are MVS-forced by gin/fiber's own go.mod; go.sum is regenerated and go mod tidy -diff is empty. Verified with go test ./tests/feature -run '^TestViewTestSuite$' -v (gin) PASS, go test ./tests/feature -run 'TestFiberDriver/TestRender_' -v (fiber) PASS, gofmt -l routes tests clean, and go build ./... OK.