From 47be779dc9a2ecbae6a5c7b98887518df06ee853 Mon Sep 17 00:00:00 2001
From: Torrey Payne <11740989+torreypayne@users.noreply.github.com>
Date: Tue, 15 Sep 2026 22:24:41 +0000
Subject: [PATCH] fix(gapic-common): require grpc >= 1.83 for post-quantum key
 exchange

gRPC began defaulting to the X25519MLKEM768 hybrid post-quantum key
exchange in 1.83 (grpc/grpc#42560). The existing "~> 1.66" floor permits
a resolver to select any release in the 1.66-1.82 range, which silently
downgrades the transport to classical-only cryptography with no signal
to the caller and no way for them to detect it.

Raising the floor to ">= 1.83", "< 2.a" guarantees that every downstream
generated client resolves a PQC-capable gRPC transport. The upper bound
preserves the existing practice of excluding a future 2.x major.

The resolved version in Gemfile.lock is unchanged at 1.83.0; only the
declared constraint moves.
---
 gapic-common/Gemfile.lock         | 2 +-
 gapic-common/gapic-common.gemspec | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gapic-common/Gemfile.lock b/gapic-common/Gemfile.lock
index 42048aa..28df410 100644
--- a/gapic-common/Gemfile.lock
+++ b/gapic-common/Gemfile.lock
@@ -10,7 +10,7 @@ PATH
       googleapis-common-protos (~> 1.6)
       googleapis-common-protos-types (~> 1.15)
       googleauth (~> 1.12)
-      grpc (~> 1.66)
+      grpc (>= 1.83, < 2.a)
 
 GEM
   remote: https://rubygems.org/
diff --git a/gapic-common/gapic-common.gemspec b/gapic-common/gapic-common.gemspec
index 204f9a0..dd28e43 100644
--- a/gapic-common/gapic-common.gemspec
+++ b/gapic-common/gapic-common.gemspec
@@ -43,5 +43,5 @@ Gem::Specification.new do |spec|
   spec.add_dependency "google-cloud-env", "~> 2.2"
   spec.add_dependency "google-logging-utils", "~> 0.1"
   spec.add_dependency "google-protobuf", "~> 4.26"
-  spec.add_dependency "grpc", "~> 1.66"
+  spec.add_dependency "grpc", ">= 1.83", "< 2.a"
 end