gRPC-Go 1.82

Apply the Go 1.27 baseline first. These rules cover google.golang.org/grpc 1.82 clients, servers, credentials, interceptors, protobuf messages, streaming, retries, authorization policy, xDS, and operational services.

Version, transport, and authority

• Take the newest 1.82 patch while you stay on this line, and confirm what the build selects with go list -m google.golang.org/grpc, since another module's requirement can raise it to a newer minor. gRPC-Go patches the two minor releases before its newest only on demand or for serious security problems, and not every fix is backported, as the receive-buffer rule below shows, so plan the move to a newer minor before this line leaves that window.
• Create clients with grpc.NewClient and grpc.WithTransportCredentials(credentials.NewTLS(...)); use insecure.NewCredentials() only on an isolated plaintext transport carrying no credentials or protected data.
• Configure client and server tls.Config with trusted roots, expected DNS names, and client certificates where service identity is required; never use InsecureSkipVerify without an equivalent chain and hostname check in VerifyConnection. Enable server TLS with grpc.Creds(credentials.NewTLS(...)) and a server certificate; for mutual TLS, set ClientAuth: tls.RequireAndVerifyClientCert and trusted ClientCAs.
• Return true from credentials.PerRPCCredentials.RequireTransportSecurity for bearer tokens and other reusable secrets, and bound token acquisition with the RPC context.
• Accept grpc.WithAuthority and grpc.CallAuthority values only from trusted