chore(deps): upgrade grpc-java to 1.83.1 and jackson to 2.18.10

build.gradle

@@ -6,7 +6,7 @@ plugins {
 }
 
 ext {
-    grpcVersion = "1.83.0"
+    grpcVersion = "1.83.1"
 }
 
 allprojects {

common/build.gradle

@@ -8,7 +8,9 @@ sourceCompatibility = 1.8
 
 
 dependencies {
-    api group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.6' // https://github.com/FasterXML/jackson-databind/issues/3627
+    // avoid x.y.z.w micro-patches, they may ship broken Gradle module metadata:
+    // https://github.com/FasterXML/jackson-databind/issues/3627
+    api group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.10'
     api "com.cedarsoftware:java-util:3.2.0"
     api group: 'org.apache.httpcomponents', name: 'httpasyncclient', version: '4.1.1'
     api group: 'commons-codec', name: 'commons-codec', version: '1.11'

framework/src/main/java/org/tron/common/application/RpcService.java

@@ -100,9 +100,8 @@ protected NettyServerBuilder initServerBuilder() {
       serverBuilder = serverBuilder.executor(this.executorService);
     }
     // Set configs from config.conf or default value
-    serverBuilder = GrpcNettyMaxConcurrentStreamsLimiter.configurePlaintext(
-        serverBuilder, parameter.getMaxConcurrentCallsPerConnection());
     serverBuilder
+        .maxConcurrentCallsPerConnection(parameter.getMaxConcurrentCallsPerConnection())
         .flowControlWindow(parameter.getFlowControlWindow())
         .maxConnectionIdle(parameter.getMaxConnectionIdleInMillis(), TimeUnit.MILLISECONDS)
         .maxConnectionAge(parameter.getMaxConnectionAgeInMillis(), TimeUnit.MILLISECONDS)

framework/src/test/java/org/tron/common/application/NettyHttp2HeaderSecurityTest.java

@@ -0,0 +1,53 @@
+/*
+ * java-tron is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * java-tron is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with java-tron.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.tron.common.application;
+
+import static org.junit.Assert.assertEquals;
+
+import io.netty.handler.codec.http2.DefaultHttp2Connection;
+import io.netty.handler.codec.http2.DefaultHttp2ConnectionEncoder;
+import io.netty.handler.codec.http2.DefaultHttp2FrameWriter;
+import io.netty.handler.codec.http2.Http2Connection;
+import io.netty.handler.codec.http2.Http2ConnectionEncoder;
+import io.netty.handler.codec.http2.Http2FrameWriter;
+import io.netty.handler.codec.http2.Http2Settings;
+import org.junit.Test;
+
+/** Guards the netty HTTP/2 header-size behaviour the gRPC server relies on. */
+public class NettyHttp2HeaderSecurityTest {
+
+  /**
+   * CVE-2026-50560: SETTINGS_MAX_HEADER_LIST_SIZE tells the server what the client is willing to
+   * receive, so it must not shrink the server encoder's own limit. Otherwise a hostile client can
+   * advertise a tiny value and make every response-header write throw, which is a Rapid-Reset-like
+   * denial of service. Netty enforced the client value before 4.1.135.Final / 4.2.15.Final.
+   */
+  @Test
+  public void shouldIgnoreClientMaxHeaderListSizeOnServer() throws Exception {
+    Http2Connection connection = new DefaultHttp2Connection(true);
+    Http2FrameWriter frameWriter = new DefaultHttp2FrameWriter();
+    Http2ConnectionEncoder encoder =
+        new DefaultHttp2ConnectionEncoder(connection, frameWriter);
+    long originalMaxHeaderListSize =
+        encoder.configuration().headersConfiguration().maxHeaderListSize();
+
+    encoder.remoteSettings(new Http2Settings().maxHeaderListSize(1));
+
+    assertEquals(originalMaxHeaderListSize,
+        encoder.configuration().headersConfiguration().maxHeaderListSize());
+    encoder.close();
+  }
+}