gRPC Python 1.82

Apply these rules on top of the Python 3 baseline for services and clients built on the gRPC Python 1.82 release line (grpcio 1.82.x and its companion packages).

Version scope and dependencies

• On grpcio 1.82.0 and 1.82.1, which predate the 1.82.2 fix for GHSA-hf3w-6hpw-qp67, the bundled C-core can be driven out of memory by a compressed message that inflates past the receive limit, a GOAWAY frame header that claims a large payload, or a stream split into tiny DATA frames. That advisory names no PyPI package, so pip-audit and OSV-Scanner may not report it, and a clean package scan is not evidence that those releases are unaffected.
• Never install grpcio 1.82.0, which was yanked from PyPI after companion packages allowed protobuf runtimes older than their generated code.
• Run this line only on a security-supported CPython minor that a 1.82 release ships a wheel for. Every 1.82 release declares Python >=3.10 and publishes CPython 3.10–3.14 wheels only: that range does not restore security support to end-of-life Python 3.10, and on a newer minor such as 3.15 pip falls back to compiling the bundled C-core from the source distribution. Keep the Python baseline's --only-binary :all: and move to a supported gRPC line rather than building 1.82 from source.
• Keep grpcio-tools, grpcio-status, grpcio-reflection, grpcio-health-checking, and grpcio-channelz on the same release as grpcio and upgrade them together, because each one requires a grpcio at least as new as itself.
• Keep protobuf inside the range those packages declare, at or above 7.35.1 and below 8.0.0,