deps: bump radiance, and the sing-box-minimal replace to match

[myleshorton]

Brings radiance to 149f0d7 and moves the sing-box-minimal replace with it.

What radiance picks up

584a056..149f0d7, four commits:

commit	change
radiance#579	one smart dialer per config host, so a blocked host can't take the rest down
radiance#580	smart dialer: reversed disorder/split ordering fixed, plus test coverage and an Android test harness
radiance#581	sing-box-minimal bump
radiance#582	kindling bump (test-only, inert)

The headline is #580: split:200|disorder:1 was spelled backwards. configurl pipes left→right, so disorder ended up wrapping split and its *net.TCPConn assertion could never succeed — on every platform, with every base dialer. We were quietly running four of five TLS strategies in the smart dialer.

Why the replace moves too

This is the part worth reviewing. radiance#581 bumped sing-box-minimal d0cc8eb → 1739626, but a replace in the main module overrides a dependency's. Bumping radiance alone leaves us on the Jul 17 sing-box while radiance believes it has the Jul 27 one — a green PR that silently ships nothing. Same shape as the lantern-box v0.0.58/v0.0.65 incident.

That range is two process-routing PRs (4 files, +110/−52):

• sing-box-minimal#52 — the process searcher was only built at startup from whether any rule needed process matching, so a rule-set that gained a process rule at runtime had no searcher and silently never matched. Now created on live rule-set update.
• sing-box-minimal#55 — process name/path rules lowercased under C.IsWindows; Windows paths aren't case-sensitive, so a rule for lantern.exe failed against a process reported as Lantern.exe.

Both are desktop fixes, Windows in particular — mobile has no process matching. They're unrelated to the smart-dialer work; they ride along with #581.

Verification

• go build and go test with the CI tag set — pass
• make build-android (gomobile bind, arm64) — AAR builds

And because go.mod agreeing is not the same as the binary agreeing, checked what is actually linked into libgojni.so:

dep  github.com/getlantern/kindling  v0.0.0-20260727211028-573c1ef64464
dep  github.com/getlantern/radiance  v0.0.0-20260727212115-149f0d726208
=>   github.com/getlantern/sing-box-minimal  v1.12.22-lantern.0.20260727203219-1739626c9ad2

go mod tidy run; go.mod and go.sum committed together.

Caveats for the reviewer

• I can confirm the sing-box changes build and link, but not that the routing behaviour is right — no Windows host here, and the live-rule-set path needs a running tunnel. Whoever owns sing-box-minimal#52/Error starting with gui in KDE (Kubuntu 11.10) #55 should sign off on that half.
• Worth knowing: android-compile-check.yml is scoped to **/*.kt and build-android.yml is workflow_call-only, so a go.mod-only PR like this gets no Android build in CI. That's why I ran the AAR build locally. It's also the gap the lantern-box incident went through.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated internal networking and supporting components to newer versions.
  • No user-facing features or behavior changes were introduced.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 960dff32-7449-4d6c-9da3-000bfd1f37b0

📥 Commits

Reviewing files that changed from the base of the PR and between c46cde3 and 7863e70.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

---

📝 Walkthrough

Walkthrough

Updates three Lantern-related dependency entries in go.mod: the sing-box replacement, radiance, and kindling versions.

Changes

Dependency updates

Layer / File(s)	Summary
Update Lantern module versions go.mod	The sing-box replacement, radiance, and kindling requirements are updated to newer Lantern builds.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• getlantern/lantern#8913: Updates the same sing-box replacement and radiance dependency entries.
• getlantern/lantern#8883: Bumps the same radiance and kindling dependencies.
• getlantern/lantern#8886: Updates the same dependency entries in go.mod.

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main dependency updates, especially the radiance bump and matching sing-box-minimal replace.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fisk/bump-radiance-smart-dialer

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates the project’s Go module dependencies to pick up recent fixes in github.com/getlantern/radiance and ensure the main module’s replace for sing-box aligns with the version radiance expects, so the intended routing/process fixes actually ship in the final binary.

Changes:

• Bump github.com/getlantern/radiance to v0.0.0-20260727212115-149f0d726208.
• Move/update the replace github.com/sagernet/sing-box => github.com/getlantern/sing-box-minimal ... target to v1.12.22-lantern.0.20260727203219-1739626c9ad2.
• Update go.sum accordingly (including kindling indirect version/hash changes).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Bumps radiance and updates the sing-box → sing-box-minimal replace to the intended version so dependency updates take effect.
go.sum	Updates checksums for the bumped module versions (radiance/sing-box-minimal/kindling).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[myleshorton]

Agreed on the diagnosis — I raised the same gap in the PR description. Checked the mechanism you propose and it would work, but I'd rather not make the change in this PR. Reasoning below.

The suggestion is sound. Expanding the path filter really would give AAR coverage, not just re-run Kotlin compilation:

• the AAR cache key is hashFiles('go.mod', 'go.sum', 'Makefile', '**/*.go'), so a dep change is a guaranteed cache miss
• on a miss the job runs make install-android-deps, then make android-debug-ci
• android-debug-ci → $(ANDROID_DEBUG_BUILD) → $(ANDROID_DEBUG_BUILD): $(ANDROID_LIB_BUILD) → $(ANDROID_LIB_BUILD): $(GO_SOURCES) → make build-android, i.e. a real gomobile bind

So two lines in paths: would close it.

Why not here. The exclusion is deliberate and documented in the workflow header:

Scope: the PR trigger runs only on Kotlin (*.kt) changes. It intentionally does NOT run on Go/gomobile-AAR or Flutter/dep changes — a Go change that breaks the AAR<->Kotlin interface would surface in build-android.yml / release, not here.

Reversing a documented decision is a maintainer call with a real cost — it puts a full gomobile bind plus APK build on the critical path of every dependency PR — and it would need that header rewritten too, or the comment starts lying about the config. That is its own change with its own tradeoff discussion, not a rider on a dependency bump.

Coverage for this PR specifically: I ran the AAR build locally and verified against the linked binary rather than go.mod, since go.mod agreeing is not the same as the artifact agreeing:

$ go version -m jni/arm64-v8a/libgojni.so
dep  github.com/getlantern/kindling  v0.0.0-20260727211028-573c1ef64464
dep  github.com/getlantern/radiance  v0.0.0-20260727212115-149f0d726208
=>   github.com/getlantern/sing-box-minimal  v1.12.22-lantern.0.20260727203219-1739626c9ad2

Leaving this thread open rather than resolving it — happy to send the workflow change as a separate PR if a maintainer wants it.