[AnthonyRonning]

Why

The published Maple Research v3.4.8 Linux AppImage contains GStreamer 1.28.7 in its core library and affected plugin binaries. GStreamer's November 6 security advisories identify issues in gst-plugins-good and gst-plugins-bad fixed in 1.28.9, including SA-2026-0097 / CVE-2026-121629 (local-file access through HLS/DASH manifest references). SA-2026-0083 and other October 8 advisories also affect bundled core/base/good/bad components below 1.28.8. The 1.28.9 stable release contains these fixes.

Source review has not established a user-controlled HLS/DASH manifest playback path in Maple Research. This PR addresses a vulnerable published component; it does not assert observed exploitation or a live user impact.

Change

• Hash-pin official GStreamer 1.28.9 source tarballs for core, base, good, and bad within the Linux Nix package scope used by the desktop bundle.
• Carry the same scope through WebKitGTK and the gst-plugins-bad dependency chain (libnice and OpenAL/PipeWire dependencies), so the Linux derivation graph does not retain a second 1.28.7 core/base/bad.
• Point the AppImage plugin join and helper path at that scoped set. No nixpkgs-wide revision change, signing, publication, or infrastructure change.

Validation and current blocker

• nix develop --no-update-lock-file -c just lane repo passed on macOS, including flake evaluation and repository checks. The selected pre-commit checks and python3 scripts/ci/plan.py lint passed.
• nix derivation show -r of devShells.x86_64-linux.default resolves core/base/good/bad only at 1.28.9. gst-libav remains 1.28.7 and links to the scoped 1.28.9 core/base.
• Unsigned Linux package CI run 42614844348 built core, base, good, bad, and the plugin join. The uncached WebKitGTK rebuild started at 12:18 UTC and was still running when the job reached its 45-minute limit at 12:56 UTC. The run was cancelled by the limit before packaging; there is no new AppImage to inspect.

Blocked before merge: complete a longer bounded unsigned Linux package build or another validated packaging strategy, then inspect the resulting AppImage for the patched core and affected plugins with no older copy. This draft is not a validated release candidate.

Limits

This PR does not update gst-libav, assess FFmpeg's separately reported same-class issue, audit all historical GStreamer advisories, replace the existing v3.4.8 release, or change system GStreamer packages used by .deb/.rpm installations. Source, package build, published release, and installed-client status remain separate.