gRPC for Ruby 1.82

Use these requirements when building Ruby clients and servers with grpc 1.82; they were checked against 1.82.2. Apply the included Ruby 4.0 baseline first.

Version and remaining native defects

• gRPC supports only its current release and the one before it, backporting security fixes further only case by case, and the 1.82 line is outside that window. Plan migration to a supported line rather than treating a 1.82 patch release as a safe long-term production pin.
• gRPC publishes some security fixes only as repository advisories without a CVE, and bundle-audit and OSV-Scanner don't report those for the grpc gem. Check the grpc/grpc security advisories and release notes for the line you run on a schedule, and take a release they list as fixing yours.
• Lock grpc in Gemfile.lock so every platform installs the same release, whether from a precompiled native gem or a source build, and test each production Ruby, CPU, libc, and protobuf combination. The 1.82.2 gemspec allows Ruby >= 3.2 with google-protobuf >= 3.25, < 5.0 and googleapis-common-protos-types ~> 1.0; the Ruby 3.2 minimum is not a support recommendation because that runtime is end-of-life.
• Keep the message_size_refactoring, ph2_perf_01, and header_data_frame experiments enabled, as they are by default, because they carry the protections against unbounded decompression, oversized GOAWAY debug-data allocation, and memory amplification from tiny HTTP/2 DATA frames. Reject deployment settings that disable them through negative entries in GRPC_EXPERIMENTS.
• While using 1.82.2, permit only