fix(gapic-common): require grpc >= 1.83 for post-quantum key exchange - #73
Draft
torreypayne wants to merge 1 commit into
Draft
torreypayne wants to merge 1 commit into
torreypayne wants to merge 1 commit into
Conversation
gRPC began defaulting to the X25519MLKEM768 hybrid post-quantum key exchange in 1.83 (grpc/grpc#42560). The existing "~> 1.66" floor permits a resolver to select any release in the 1.66-1.82 range, which silently downgrades the transport to classical-only cryptography with no signal to the caller and no way for them to detect it. Raising the floor to ">= 1.83", "< 2.a" guarantees that every downstream generated client resolves a PQC-capable gRPC transport. The upper bound preserves the existing practice of excluding a future 2.x major. The resolved version in Gemfile.lock is unchanged at 1.83.0; only the declared constraint moves.
This was referenced Sep 15, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Raises the
gapic-commongRPC floor from~> 1.66to">= 1.83", "< 2.a"so every downstream generated Ruby client resolves a transport capable of post-quantum key exchange.gRPC began defaulting to the
X25519MLKEM768hybrid key exchange in 1.83 (v1.83.0 release notes). The current floor lets a resolver select anything in1.66–1.82, silently downgrading to classical-only cryptography with no signal to the caller and no way to detect it. The< 2.abound matches this gemspec's convention (faraday,faraday-retry).This executes a directive from the approved parent design, go/cloudsdk-pqc-ruby:
Reviewer notes
fix:deliberately. This is the only customer-facing change in the Ruby PQC effort and the only one that triggers a publication, sorelease-pleaseneeds to cut a patch release.chore:orbuild:would leave it unpublished.Gemfile.lockchanges on the constraint line only; it already resolved to1.83.0.grpc 1.83cannot resolve the nextgapic-commonpatch. No Ruby support is dropped:grpc 1.83.0needs >= 3.1, this gem already requires >= 3.2.toys cion Ruby 4.0.5: rubocop clean, 308 runs / 0 failures, yardoc clean.The companion Showcase conformance work is gapic-generator-ruby#1330 → #1331 → #1351 → #1352, decoupled so this release is not blocked on harness review.
Design: go/client-libraries:ruby-pqc