gRPC Java 1.84

Apply the Java 25 baseline first. These rules cover gRPC Java 1.84, which supports Java 8 and later and, on Android, minSdkVersion 24 with Java 8 language desugaring.

Dependencies and runtime scope

• Keep every io.grpc artifact on one release through io.grpc:grpc-bom and move them together; a mixed classpath of grpc-api, grpc-core, grpc-netty, grpc-stub, and grpc-xds across releases risks internal API incompatibilities. gRPC supports only its latest release and the one before it, with no LTS, so move to a newer release before 1.84 drops out of that window.
• Inspect grpc-netty-shaded itself for its bundled Netty version, using the JAR's META-INF/io.grpc.netty.shaded.io.netty.versions.properties and that gRPC tag's dependency declarations. Check official advisories and release notes for gRPC, Netty, native TLS, and protobuf; an external io.netty override does not patch relocated classes, and a newer gRPC artifact is not proof that a particular Netty fix is bundled.
• Use grpc-netty-shaded in non-Android production only after verifying its bundled dependencies meet the application's security requirements, and verify the selected TLS provider. If a required fix is absent and the complete dependency graph can remove the shaded transport, evaluate grpc-netty with an aligned, compatible io.netty:netty-bom set; exclude the shaded transport, change shaded imports, and test ALPN, TLS providers, native libraries, and HTTP/2 behavior before deploying.
• Account for grpc-xds and grpc-s2a using shaded Netty internally: replacing the application's