gRPC for Swift 2.3

Apply the Swift 6.3 baseline first. These rules cover the grpc-swift-2 2.3 line and were checked against 2.3.0 with grpc-swift-nio-transport 2.6.2 and grpc-swift-protobuf 2.2.1. These packages require Swift tools 6.0 or later and use Swift 6 language mode. On Apple platforms, target macOS 15, iOS/tvOS 18, watchOS 11, or visionOS 2 or later.

Treat every RPC message, metadata entry, peer identity, resolver result, service configuration, and status detail as crossing a trust boundary.

Transport security and peer identity

• Verify the independently resolved core, transport, generator, and transitive versions in Package.resolved. Check SwiftNIO, NIOHTTP2, NIOSSL for POSIX TLS, and SwiftASN1 separately from gRPC: the transport's declared minimum versions admit releases that predate published fixes, and vulnerability scanners miss some of these advisories, so before each release compare the resolved versions with the fixed releases listed on each project's GitHub security advisory page and move to them with swift package update <name>.
• Use an HTTP/2 NIO transport with TransportSecurity.tls or mTLS for every non-local connection; reserve .plaintext for an explicitly isolated, authenticated channel such as a test or protected sidecar link.
• On clients, retain TLS.serverCertificateVerification = .fullVerification; never ship .noVerification or .noHostnameVerification as a workaround for certificate, hostname, or trust-root failures.
• Use a trusted DNS target and keep config.http2.authority under deployment control: an override changes both the