gRPC for Swift 1.26.2

Apply the Swift 6.3 baseline first. These rules cover existing gRPC Swift 1.26.2 integrations. The package's Swift tools 5.10 minimum describes compiler compatibility, not maintenance. The published v1 policy ends gRPC Swift 1.x support once Swift 6.4 ships, which it has, and keeping a Swift 6.3 compiler does not extend it; that package policy says nothing about Swift 6.3's own maintenance, which the baseline covers. Regular v1 releases came from the newest 1.x minor, and the 1.26 line's one later backport carried no maintenance commitment. Plan migration to gRPC Swift 2, the current major, with its own APIs and deployment requirements, and keep these controls on legacy listeners until then.

Treat decoded protobuf messages, metadata, remote peers, and stream timing as untrusted. Transport security and successful decoding do not establish application authorization.

Resolve the actual dependency graph

• Check swift-nio, swift-nio-http2, and, when you use NIOSSL, swift-nio-ssl separately from gRPC. The package declares minimums of 2.65.0 and 1.36.0 for the first two, which admit releases older than the HTTP/1 header limits and later HTTP/2 defenses, and vulnerability scanners miss some SwiftNIO advisories. Before each release, compare the versions in Package.resolved with the fixed releases listed on each project's GitHub security advisory page, move to them with swift package update <name>, and test the locked graph on the deployment toolchain.
• Generate stubs with a pinned protoc-gen-grpc-swift compatible with the 1.26.2 runtime; newer generators are not