deps: bump radiance — proxyless rule-set detour (#549)

[myleshorton]

What

Bump getlantern/radiance 686b6b9 → 4356bc0.

Changes pulled (5 commits)

Commit	Impact
4356bc0 radiance#549 — client honors ConfigResponse.NonSelectableOutbounds	the change we want
166e907 iOS-only mobile memory-limits fix	fix (low risk)
737cdb7 / 1485f2a / 01d51f2 stale-bot CI workflow	CI-only, no runtime impact

Transitively bumps getlantern/common to the merged NonSelectableOutbounds field (common#27).

Why

This is the client half of the CN geosite cold-start fix. With #549, radiance merges server-declared infrastructure outbounds (e.g. the proxyless rule-set-fetch detour) into the box config so their references resolve, but excludes them from both the auto (URLTest) group and the manual selector — so such an outbound can never be auto-selected or user-picked (which would route traffic directly and expose the user's IP).

It's inert until the server (lantern-cloud#2936) enables the proxyless detour — which is itself gated behind a feature flag and a PROXYLESS_MIN_CLIENT_VERSION floor set to the release carrying this bump. So this needs to ship first, then the server flag is enabled.

Context: getlantern/engineering#3657.

Testing

go build ./... passes; go mod tidy clean (only radiance + the transitive common bump).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WGpKfgkbfdJwwsTaouMDoR

Summary by CodeRabbit

• Chores
  • Updated two indirect dependencies to newer revisions for improved stability and compatibility.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4197799a-23b4-40a3-a344-ac668f5c83ef

📥 Commits

Reviewing files that changed from the base of the PR and between b3e3457 and b33bf6d.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

---

📝 Walkthrough

Walkthrough

This PR bumps two indirect Go module dependencies in go.mod: github.com/getlantern/radiance and github.com/getlantern/common, each updated to a newer pseudo-version commit revision. No other changes are included.

Changes

Dependency updates

Layer / File(s)	Summary
Indirect dependency version bumps go.mod	Updates github.com/getlantern/radiance and github.com/getlantern/common indirect dependencies to newer commit revisions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• getlantern/lantern#8883: Both PRs update the github.com/getlantern/radiance version in go.mod.
• getlantern/lantern#8886: Both PRs bump the github.com/getlantern/radiance dependency version in go.mod.
• getlantern/lantern#8894: Both PRs bump github.com/getlantern/radiance and another indirect dependency in go.mod.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the dependency bump and the proxyless rule-set detour change included in the update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fisk/bump-radiance-proxyless

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR bumps the github.com/getlantern/radiance dependency (and its transitive github.com/getlantern/common bump) to pick up radiance#549 support for server-declared ConfigResponse.NonSelectableOutbounds, enabling infrastructure-only outbounds (e.g., proxyless rule-set detours) to be merged for reference resolution while being excluded from both auto-selection and manual selection.

Changes:

• Bump github.com/getlantern/radiance to v0.0.0-20260706174732-4356bc07f9a0.
• Pull in transitive github.com/getlantern/common update to v1.2.1-0.20260705172801-57aaafd97c1b (adds NonSelectableOutbounds).
• Update go.sum accordingly.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
go.mod	Updates required module versions for radiance and indirect common to pick up NonSelectableOutbounds.
go.sum	Refreshes module checksums to match the updated radiance/common pseudo-versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[myleshorton]

Heads-up: the gating design changed from a hardcoded client-version floor to capability negotiation. lantern-cloud now gates the proxyless detour on the client advertising non_selectable_outbounds (getlantern/common#28), which radiance only does in getlantern/radiance#555. So this bump should be re-pointed to a radiance commit that includes both #549 and #555 before the release — otherwise the client won't advertise the capability and the (capability-gated) server will never send the detour. Will re-point once #555 merges.