go mod tidy: drop stale lantern-box v0.0.106 hashes

[myleshorton]

Follow-up to #586, which I got wrong.

What happened

#586 bumped go.mod to lantern-box v0.0.107 but left v0.0.106's hashes in go.sum, so main currently carries both with valid hashes:

github.com/getlantern/lantern-box v0.0.106 h1:5czWMqdgrhCslLcE+ttt+us+d0dmCutpjxqmCOZnqKw=
github.com/getlantern/lantern-box v0.0.106/go.mod h1:HHdmZsGwkiaweBycCYv1Jolk3jkrXbb/R5UUXtY2n3o=
github.com/getlantern/lantern-box v0.0.107 h1:uTRoj5BKijO6Q2a9JZWunFL7Z29WDg8WzEuoliJ+kJg=
github.com/getlantern/lantern-box v0.0.107/go.mod h1:HHdmZsGwkiaweBycCYv1Jolk3jkrXbb/R5UUXtY2n3o=

Why it matters

This is the precise condition that lets a build resolve a superseded version even though go.mod declares the newer one — the stale entry still verifies, so nothing complains. On 2026-04-13 that shipped a release with lantern-box v0.0.58 compiled in while go.mod said v0.0.65, silently disabling Reflex for every user. gomobile bind is the tool that has done this.

Given #586 exists specifically to carry a client-info fix out to clients, a build that quietly resolves v0.0.106 would deliver the release without the fix it was cut for.

How it got through

My working tree had untracked files (cmd/meek-probe, cmd/meek-fronts-dump, and a missing kindling/meek) that made go mod tidy exit early — after writing its go.mod change but before pruning go.sum. I then "verified" against git stash, which does not stash untracked files, so the contamination survived the check and I read the failure as pre-existing.

Worth noting for anyone reading #586's description: my claim there that go mod tidy is broken on main was wrong — it succeeds on a clean checkout. The cmd/lantern breakage I mentioned is real and tracked (cmd/lantern/lantern.go:170 calls ipc.NewClient() against a signature taking (context.Context, backend.Options) and returning two values), but it is unrelated to this.

Verification

Run on a clean git worktree of origin/main with no untracked files:

• go mod tidy — exit 0, removes exactly the two stale lines
• go mod verify — all modules verified
• library packages build and 18/18 test packages pass

🤖 Generated with Claude Code

https://claude.ai/code/session_01RVgb2MDpZ4wpH6fywKC2hE

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ab131b8-4a1d-4fa7-aaec-a57d0830dfa7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}