Post-quantum TLS readiness report
ProprietaryClassifies every Maven and Gradle module by how far it is from post-quantum TLS, joining the module's JDK level with the BouncyCastle artifacts it resolves, and records one row per module per BouncyCastle artifact in a data table. Modules with no BouncyCastle at all get exactly one row, so absence is reported rather than inferred from silence. Direct org.bouncycastle declarations in modules that have a gap are marked. bcutil and everything reachable only through it is pruned from the graph walk: it is an internal support artifact that declares BouncyCastle with version ranges, which would otherwise make the reported versions drift with every patch release. Only BouncyCastle that appears in a resolved dependency graph is seen: jars vendored into the repository and wired up with Gradle fileTree/flatDir or Maven system scope, and BouncyCastle shaded into a fat jar, carry no coordinates and therefore report as no-bc. Modules whose build tool did not run are reported as build-file-not-resolved rather than being dropped, so that gap is visible instead of silent.
io.Optional
The lowest bctls version considered hybrid-capable, compared as the Semver range [version,). Defaults to 1.81, the first release carrying NamedGroup.X25519MLKEM768; 1.80 has only the pure ML-KEM draft codepoints. Raise to 1.84 if the interop stance requires the javax.crypto.KEM based implementation.
The lowest JDK level whose JSSE offers hybrid ML-KEM key exchange, per JEP 527. Defaults to 27.
The lowest JDK level shipping the ML-KEM and ML-DSA providers, per JEP 496 and JEP 497. TLS is an explicit non-goal of those JEPs, so this level alone does not make TLS post-quantum. Defaults to 24.
mod run .Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.