fix(gapic-common): require grpc >= 1.83 for post-quantum key exchange - #73
Merged
Merged
Conversation
This was referenced Sep 15, 2026
Merged
gRPC began defaulting to the X25519MLKEM768 hybrid post-quantum key exchange in 1.83 (grpc/grpc#42560). The existing "~> 1.66" floor permits a resolver to select any release in the 1.66-1.82 range, which silently downgrades the transport to classical-only cryptography with no signal to the caller and no way for them to detect it. Raising the floor to ">= 1.83", "< 2.a" guarantees that every downstream generated client resolves a PQC-capable gRPC transport. The upper bound preserves the existing practice of excluding a future 2.x major. The resolved version in Gemfile.lock is unchanged at 1.83.0; only the declared constraint moves.
torreypayne
marked this pull request as ready for review
September 21, 2026 17:07
torreypayne
force-pushed
the
grpc-pqc-floor
branch
from
September 21, 2026 17:08
47be779 to
2ec646b
Compare
…key exchange The grpc >= 1.83 floor added in this PR is enforceable in the gemspec, so gRPC gets post-quantum key exchange automatically. REST cannot work that way: it delegates to the host's system OpenSSL, ML-KEM first ships in OpenSSL 3.5, and Ruby's openssl is a default gem bound to whatever libssl the host provides, so no gem constraint can express it. That leaves documentation as the only way to state the REST requirement. Below OpenSSL 3.5 a REST connection silently negotiates classical X25519 - correct and safe, but not post-quantum, and until now nothing told the user which of the two they were getting.
quartzmo
approved these changes
Sep 23, 2026
torreypayne
added a commit
to googleapis/gapic-generator-ruby
that referenced
this pull request
Sep 24, 2026
gapic-common 1.4.0 requires grpc >= 1.83, the first grpc release that negotiates the X25519MLKEM768 post-quantum key exchange by default (googleapis/ruby-core-libraries#73). Generated clients previously declared gapic-common "~> 1.3", which permits 1.4.0 but also lets a resolver backtrack to 1.3.0 and its grpc "~> 1.66" constraint. Raising the emitted floor to "~> 1.4" makes a PQC-capable grpc a hard requirement of every regenerated client. Goldens regenerated with `toys gen`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Raises the
gapic-commongRPC floor from~> 1.66to">= 1.83", "< 2.a"so every downstream generated Ruby client resolves a transport capable of post-quantum key exchange.gRPC began defaulting to the
X25519MLKEM768hybrid key exchange in 1.83 (v1.83.0 release notes). The current floor lets a resolver select anything in1.66–1.82, silently downgrading to classical-only cryptography. The< 2.abound matches this gemspec's convention (faraday,faraday-retry).This executes a directive from the approved parent design, go/cloudsdk-pqc-ruby:
Reviewer notes
fix:deliberately. This is the only customer-facing change in the Ruby PQC effort and the only one that triggers a publication, sorelease-pleaseneeds to cut a patch release.chore:orbuild:would leave it unpublished.Gemfile.lockchanges on the constraint line only; it already resolved to1.83.0.>= 3.5requirement cannot be expressed as a gem dependency.gapic-common/README.mdnow states it, since nothing else could.grpc 1.83cannot resolve the nextgapic-commonpatch. No Ruby support is dropped:grpc 1.83.0needs >= 3.1, this gem already requires >= 3.2.The companion Showcase conformance work is gapic-generator-ruby#1330 → #1331 → #1351 → #1352, decoupled so this release is not blocked on harness review.
Design: go/client-libraries:ruby-pqc