[AnthonyRonning]

Why

The pinned Linux desktop Nixpkgs snapshot provides GLib 2.88.3 without the D-Bus introspection parser fix for CVE-2026-58016. A malformed nested <node> in introspection XML can cause an out-of-bounds read and denial of service when an application parses untrusted XML. This is a source/build risk; this PR does not claim a deployed vulnerable bundle or a reachable application input path.

Change

• Backport GNOME/glib@c9da977c to the exact pinned GLib 2.88.3 source. The parser fix and upstream regression vectors are retained; the test registration path is adapted to 2.88.3.
• Apply the patch only to Linux GLib 2.88.3 through the root Nix overlay. A future Nixpkgs refresh must assess its own fixed/backported state before carrying this override forward.

Validation

• Patch applied cleanly to the exact pinned GLib 2.88.3 source tarball; regression test registration is present.
• nix flake check --no-build --all-systems --no-update-lock-file passed.
• nix develop --no-update-lock-file -c just lane repo passed on macOS, including 574 CI script tests.
• The Linux desktop Nix shell closure contains patched GLib derivations. The repository pre-commit gates passed.
• A compiled Linux GLib test and packaged Linux desktop smoke are pending CI evidence; this Mac has no native Linux builder.

This PR changes no production deployment, release, or runtime configuration.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}