fix(gapic-common): require grpc >= 1.83 for post-quantum key exchange

gapic-common/Gemfile.lock

@@ -10,7 +10,7 @@ PATH
       googleapis-common-protos (~> 1.6)
       googleapis-common-protos-types (~> 1.15)
       googleauth (~> 1.12)
-      grpc (~> 1.66)
+      grpc (>= 1.83, < 2.a)
 
 GEM
   remote: https://rubygems.org/

gapic-common/README.md

@@ -24,6 +24,35 @@ work, but are unsupported and not recommended. See
 https://www.ruby-lang.org/en/downloads/branches/ for details about the Ruby
 support schedule.
 
+## Post-Quantum Key Exchange
+
+Clients built on this library negotiate the hybrid post-quantum key exchange
+group `X25519MLKEM768` — classical X25519 paired with ML-KEM-768 ([NIST FIPS
+203][]) — over TLS 1.3. No application code changes are required, because the
+handshake belongs to the transport layer. The two transports source that
+support differently:
+
+| Transport | Cryptographic provider | Requirement | Enforced by this gem? |
+| --- | --- | --- | --- |
+| gRPC | BoringSSL, vendored inside the `grpc` gem | `grpc >= 1.83` | Yes |
+| REST | Host system OpenSSL, via `Net::HTTP` and Faraday | OpenSSL `>= 3.5` | No |
+
+gRPC clients get post-quantum key exchange automatically: `gapic-common`
+depends on `grpc >= 1.83`, the first release to offer `X25519MLKEM768` in the
+TLS ClientHello by default.
+
+The REST requirement cannot be expressed as a gem dependency. Ruby's `openssl`
+is a default gem bound to whatever `libssl` the host provides, and ML-KEM first
+ships in OpenSSL 3.5. On an older host, REST connections negotiate classical
+X25519 instead — a safe fallback rather than an error, but not post-quantum. To
+check the OpenSSL your Ruby is linked against:
+
+```sh
+ruby -ropenssl -e 'puts OpenSSL::OPENSSL_LIBRARY_VERSION'
+```
+
+[NIST FIPS 203]: https://csrc.nist.gov/pubs/fips/203/final
+
 ## Contributing
 
 Contributions to this library are always welcome and highly encouraged.

gapic-common/gapic-common.gemspec

@@ -43,5 +43,5 @@ Gem::Specification.new do |spec|
   spec.add_dependency "google-cloud-env", "~> 2.2"
   spec.add_dependency "google-logging-utils", "~> 0.1"
   spec.add_dependency "google-protobuf", "~> 4.26"
-  spec.add_dependency "grpc", "~> 1.66"
+  spec.add_dependency "grpc", ">= 1.83", "< 2.a"
 end