go.mod: bump lantern-box to v0.0.111 for the broflake teardown fix

[myleshorton]

Why

Delivers the unbounded teardown-leak fix to clients. Radiance is the link in the chain that gets it from the SDK into a release.

Chain: getlantern/unbounded#412 (merged) → getlantern/lantern-box#297 (merged, tagged v0.0.111) → this → lantern → 9.1.20-beta.

What was leaking

A broflake WorkerFSM parked in a control-plane send on com.tx could not be cancelled: the send had no ctx guard, and the FSM only checks ctx.Done() between states. So its wg.Done() never ran, and BroflakeEngine.stop() — which waited on that WaitGroup before cancelling the engine ctx — never released the bus, both routers, or any other worker. Every re-create of the unbounded outbound accumulated a full WebRTC/ICE stack.

Signature in Freshdesk 181174 (Windows 9.1.18, CN): the outbound re-created 82 times in 13h at a flat ~6/hr, CPU climbing to 80% with disk at 0 MB/s and network at 0 Mbps — a per-event leak, not a spin. Reproduced in broflake's tests at 30 goroutines leaked over 10 create/stop cycles, 0 after the fix.

v0.0.111 brings:

• cancellable control-plane sends (sendCtx across all 11 sites), checking ctx.Err() first so a cancelled ctx wins deterministically over an available buffer
• NewWorkerFSM initializing ctx/cancel — Stop() before Start() previously panicked on a nil CancelFunc
• a bounded engine-stop wait, so any future unguarded blocking send degrades to a bounded leak
• unbounded.Outbound.Close() stopping the workers before closing the QUIC layer they drain into

Diff

lantern-box v0.0.107 → v0.0.111, which transitively upgrades the indirect broflake f2cacf69fe86 → bef5e5234952. Two lines in go.mod, four in go.sum; go mod tidy run, both committed together.

Verified the resolved module actually carries the fix (go list -m + sendCtx present in the resolved broflake), not just that the version string changed.

v0.0.107 → v0.0.111 also carries three unrelated lantern-box changes: goodput metric buckets (#296) and peerconn accept-event / listener-registry work (#255, #256).

Testing

go build -tags "with_clash_api standalone" ./... and go test -tags "with_clash_api standalone" ./... — 18 packages, 0 failures.

Note on the standalone tag: cmd/lantern calls the 0-arg ipc.NewClient, which only exists in client_nonmobile.go (//go:build (!android && !ios && !darwin) || (darwin && standalone)). On macOS without standalone, the toolchain selects the 2-arg mobile variant and cmd/lantern does not compile. CI builds on linux and so selects nonmobile — this is a local-only wrinkle, not a change in behavior, but worth knowing if you build on a Mac.

Prod mitigation already in place

Track unbounded-linode-free (id 1570) had its client-version floor raised from >=9.1.16 to >=9.1.20-beta, so no currently-released client receives unbounded. Verified live against /v1/config-new: 9.1.19 → 0/5 probes, 9.1.20-beta → 4/5, 9.1.20 → 4/5 (the misses are bandit selection, not eligibility). Once 9.1.20-beta ships with this bump, it will receive the fixed code.

Pre-PR review (local Codex gate)

• Rounds: 1 — final: CODEX GATE: verdict=approve critical=0 important=0 minor=0
• Exit: approve
• Fixed: none (no findings raised)
• Dismissed: none

🤖 Generated with Claude Code

https://claude.ai/code/session_01RVgb2MDpZ4wpH6fywKC2hE

Summary by CodeRabbit

• Chores
  • Updated internal dependencies to newer versions.
  • No visible changes to application functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 32a32817-1104-4f88-b5d8-dc66e0e164f9

📥 Commits

Reviewing files that changed from the base of the PR and between 10624e2 and 9654294.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

---

📝 Walkthrough

Walkthrough

This change updates the lantern-box and indirect broflake Go module versions in go.mod. No exported or public entities changed.

Changes

Go dependency updates

Layer / File(s)	Summary
Go module version updates go.mod	Updates github.com/getlantern/lantern-box from v0.0.107 to v0.0.111 and updates the indirect github.com/getlantern/broflake pseudo-version.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• getlantern/radiance#551: Updates the same lantern-box dependency.
• getlantern/radiance#567: Updates lantern-box and its transitive broflake dependency.
• getlantern/radiance#586: Updates the lantern-box dependency version.

Suggested reviewers: garmr-ulfr, wendelhime

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency bump and its purpose, matching the main changes and PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fisk/bump-lantern-box-teardown

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates Radiance’s Go module dependencies to pull in the lantern-box v0.0.111 release (and its transitive broflake upgrade) so clients receive the upstream broflake teardown-leak fix described in the PR context.

Changes:

• Bump github.com/getlantern/lantern-box from v0.0.107 to v0.0.111.
• Update the indirect github.com/getlantern/broflake pseudo-version to v0.0.0-20260810172605-bef5e5234952.
• Refresh go.sum entries to match the updated resolved module set.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
go.mod	Bumps lantern-box to v0.0.111 and updates the indirect broflake version to the resolved newer commit.
go.sum	Updates checksums to reflect the new lantern-box and broflake versions (and removes the old ones).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.