Skip to content

docs: update README to provide users with guidance to turn on PQC encryption - #8974

Open
danieljbruce wants to merge 4 commits into
mainfrom
pqc-update-readme
Open

docs: update README to provide users with guidance to turn on PQC encryption#8974
danieljbruce wants to merge 4 commits into
mainfrom
pqc-update-readme

Conversation

@danieljbruce

Copy link
Copy Markdown
Contributor

Description

Users need to know that they must upgrade their Node version to 22.20 or higher to ensure their network traffic is secure against post-quantum decryption algorithms like Shor's algorithm. So this PR updates the README to ensure customers are well informed.

Impact

Informs users so that they can better encrypt their network traffic.

@danieljbruce
danieljbruce requested a review from a team as a code owner July 27, 2026 18:32
@github-actions
github-actions Bot requested a review from feywind July 27, 2026 18:33

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the README.md file to include information about network traffic security against post-quantum decryption algorithms. Feedback indicates a typo in the Node.js version (should be 22.2.0 instead of 22.20) and notes that because this file is auto-generated, the change should be made in the upstream generator or template rather than directly in this file.

Comment thread README.md Outdated
Comment on lines +292 to +293
Network traffic is only secure against post-quantum decryption algorithms for
users running Node version 22.20+.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Node.js enabled the post-quantum key agreement algorithm (X25519Kyber768Draft) by default in version 22.2.0, not 22.20. Please update this version reference in the upstream generator or template rather than editing this auto-generated file directly, as manual changes will be overwritten.

References
  1. Do not manually edit auto-generated files to fix typos or make other changes, as these edits will be overwritten during the next regeneration. Instead, apply the fixes upstream in the generator or templates.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This statement doesn't appear to be true. I tried this version of Node out on main...pqc-version-check-again and the test fails so I think 22.20 is the right version.

image

@pearigee

pearigee commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Should we give it its on heading?

I think the key things people need to know:

  • What is the minimum node version?
  • Is it enabled automatically? If not, how do I turn it on?
  • If automatic, what triggers it?

Suggestion (feel free to ignore/rewrite accordingly):

## Post-quantum Cryptography

A minimum Node version of >=22.20 is required for post-quantum cryptography to be used. If using a supported runtime, traffic will be automatically upgraded when [condition].

@danieljbruce

Copy link
Copy Markdown
Contributor Author

Should we give it its on heading?

I think the key things people need to know:

  • What is the minimum node version?
  • Is it enabled automatically? If not, how do I turn it on?
  • If automatic, what triggers it?

Suggestion (feel free to ignore/rewrite accordingly):

## Post-quantum Cryptography

A minimum Node version of >=22.20 is required for post-quantum cryptography to be used. If using a supported runtime, traffic will be automatically upgraded when [condition].

I modified this slightly just to capture the fact that it is the client library requests specifically that are secure when the user is importing a client library.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants