LoginSign Up
← Back to all sparks
G

gRPC

DEVOPS
Velocity6.3

High-performance universal remote procedure call framework

grpc.io ↗

gRPC just made post-quantum key exchange the TLS default — no flag, no opt-in.

rpc frameworkpost-quantum cryptotlseventenginerelease cadence
◆Current state
gRPC Core is on a roughly monthly minor cadence with a prerelease ahead of each one, and the substance sits almost entirely in Core rather than the language bindings. The 1.83 release turns on post-quantum cryptography by default in TLS key exchange; 1.82 added regional access boundary policy metadata to call credentials; 1.81 and 1.80 were dominated by EventEngine correctness work and TLS private key offload. The prereleases themselves carry no notes at all.
◆Where it's heading
Two threads run through these releases. The transport-security stack is being modernized in place — private key offload, in-memory certificate providers, per-signer handshaker factories, and now post-quantum defaults — while EventEngine is being finished off as the universal I/O layer, having been enabled for Python by default and given fork support. Both are the kind of work that changes behavior for every user without appearing in any API.
◆Prediction
With post-quantum defaults landed in Core, expect the next cycles to chase the fallout — interoperability fixes against peers that reject the hybrid key exchange, and configuration knobs to force the classical path. The regional access boundary work in 1.82 also looks unfinished; more call-credential metadata plumbing is the likely follow-on.

◆Recent moves

  1. 15d ago

    Post-quantum key exchange becomes the TLS default

    ⚡ SPARK

    The security modernization thread running through the last several releases reaches its most consequential point: post-quantum key exchange is now the default, not an option. It lands quietly, in a release otherwise described as refinements and bug fixes.

    View source ↗
  2. 20d ago

    Call credentials gain regional access boundary metadata

    Call credentials can now look up and attach regional access boundary policy metadata, extending the credential path toward data-residency enforcement. It fits the same security-plumbing arc as the TLS work, one layer up at the authorization boundary.

    View source ↗
  3. 27d ago

    1.83.0 prerelease cut

    A prerelease with no itemized changes — the project's standard two-week staging step before a minor. The post-quantum default that defines 1.83 only becomes visible in the final release notes.

    View source ↗
  4. 29d ago

    Python protobuf floor raised to 7.35.1

    A single-commit patch backporting a protobuf lower-bound bump for the Python package. Dependency floor maintenance, with no behavior change of its own.

    View source ↗
  5. 1mo ago

    1.82.0 second prerelease

    The second staging build for 1.82, again with no itemized content. Two prereleases in a cycle is the visible cost of the monthly minor cadence.

    View source ↗
  6. 1mo ago

    EventEngine race fixes and per-signer SSL handshakers

    A correctness-heavy release: a Windows use-after-free and assertion race in EventEngine, and a completion queue shutdown race on weak memory models like ARM. The server-side handshaker factory also moves to a map of key signers, groundwork the later TLS work builds on.

    View source ↗