=== release 1.28.7 ===

2026-09-07 20:11:13 +0100  Tim-Philipp Müller <tim@centricular.com>

	* gst-plugins-good.doap:
	* meson.build:
	  Release 1.28.7

2026-07-10 20:47:29 +0200  Mathieu Duponchelle <mathieu@centricular.com>

	* docs/gst_plugins_cache.json:
	* gst/rtpmanager/rtpsession.c:
	* gst/rtpmanager/rtpsession.h:
	* gst/rtpmanager/rtpsource.c:
	* gst/rtpmanager/rtpsource.h:
	* tests/check/elements/rtpsession.c:
	  rtpsession: implement DoS protection mechanisms
	  Prior to this commit, the number of sources tracked by RTPSession
	  was unlimited, opening it up to malicious attacks.
	  This implements two mechanisms:
	  * A global maximum for the total number of non-internal sources, with
	  a LRU mechanism for discarding the least-recently seen SSRC / CSRC.
	  Selected default: 150
	  * A per SSRC maximum for limiting the number of contributing sources
	  for a single synchronization source, with a LRU mechanism for
	  discarding the least-recently seen CSRC.
	  Selected default: 15
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12436>

2026-08-31 15:03:59 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/adaptivedemux2/downloadhelper.c:
	* ext/adaptivedemux2/downloadhelper.h:
	* ext/adaptivedemux2/gstadaptivedemux.c:
	* ext/meson.build:
	* ext/soup/gstsouploader.c:
	* ext/soup/gstsouploader.h:
	* ext/soup/stub/soup.h:
	  adaptivedemux2: Use a SoupCookieJar and keep track of cookie origins correctly
	  This makes sure we're not leaking cookies to different origins. Same fix as for
	  souphttpsrc but not behind a property, which should be unnecessary here.
	  Require libsoup 2.68 (released in 2019) for the soup_cookie_jar_add_cookie_full() API.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5174
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12438>

2026-08-12 20:48:37 +0300  Sebastian Dröge <sebastian@centricular.com>

	* docs/gst_plugins_cache.json:
	* ext/soup/gstsouphttpsrc.c:
	* ext/soup/gstsouphttpsrc.h:
	* ext/soup/gstsouploader.c:
	* ext/soup/gstsouploader.h:
	  souphttpsrc: Add new `location-trusted` property
	  When disabled (default), explicitly set cookies or extra-headers or
	  authentication information are not set when handling automatic redirects to a
	  different origin.
	  This is the same as CVE-2018-1000007 in curl and CVE-2021-31879 in wget, and the
	  solution is the same as in curl.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5174
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12438>

2026-08-07 16:21:42 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: Don't try splitting CEA608 samples without known framerate
	  Splitting them would lead to invalid sized buffers and divisions by zero for the
	  timestamp calculations.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12437>

2026-08-07 16:21:05 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: Ensure enough data is available for reading closed caption boxes
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5235
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12437>

2026-08-31 12:55:53 +0800  aisuneko icecat <aicecat@igalia.com>

	* gst/effectv/gstquark.c:
	* gst/effectv/gstquark.h:
	  effectv: quarktv: apply proper stride for pixel iteration
	  Iterate row by row with GST_VIDEO_FRAME_PLANE_STRIDE to ensure
	  the last row is touched and the pixels are correctly indexed.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12422>

2026-08-31 12:48:18 +0800  aisuneko icecat <aicecat@igalia.com>

	* gst/effectv/gstquark.c:
	  effectv: quarktv: add error checking for gst_buffer_map
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12422>

2026-08-19 22:42:20 +0800  aisuneko icecat <aicecat@igalia.com>

	* gst/effectv/gstquark.c:
	  effectv: quarktv: read from mapped memory to improve performance
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12422>

2026-08-12 11:13:39 +0200  Frank Wennerdahl <frank.wennerdahl@soundtrack.io>

	* ext/soup/gstsouphttpsrc.c:
	  soup: fix redirect uri when not using automatic redirects
	  If `automatic-redirects` is set to `false`, the resulting
	  error should contain the redirect URI in the field
	  `"http-redirect-uri"`. This isn't the case, as
	  `src->redirection_uri` is never set before the error
	  is constructed.
	  This fix ensures that the URI is set when the status
	  is a redirect, allowing manual handling of redirects.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12391>

2026-09-01 10:51:50 +0200  Edward Hervey <edward@centricular.com>

	* gst/flx/gstflxdec.c:
	  flxdec: Actually read full palette
	  The default 0 in file means there's a full 256 palette
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12387>

2026-09-01 10:47:12 +0200  Edward Hervey <edward@centricular.com>

	* gst/flx/gstflxdec.c:
	  flxdec: Check for invalid header values
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12387>

2026-08-25 10:55:23 -0400  Eric <eric.chandrasekhar@ipconfigure.com>

	* gst/rtpmanager/gstrtpbin.c:
	* gst/rtpmanager/gstrtpjitterbuffer.c:
	* gst/rtpmanager/rtpsession.c:
	  rtpmanager: Fix malformed SDES processing segfault
	  gst_rtcp_packet_sdes_get_entry can return FALSE when the SDES entry is
	  malformed, and this wasn't being handled by the callers.
	  Now if gst_rtcp_packet_sdes_get_entry returns FALSE, the rest of the
	  SDES packet is skipped.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12375>

2026-04-14 13:08:55 +0200  Pablo García <pgarcia@fluendo.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: Add 'stream-format' field for AC-4 caps
	  According to Annex G of the AC-4 spec, the syncframe is an optional
	  layer for encapsulating AC-4 raw frames. This demuxer always outputs
	  raw frames, but the AC-4 parser/decoder needs to know.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12371>

2026-04-14 13:08:34 +0200  Pablo García <pgarcia@fluendo.com>

	* gst/isomp4/fourcc.h:
	* gst/isomp4/qtdemux_types.c:
	  qtdemux: Add AC-4 atoms
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12371>

2026-08-19 18:05:11 +1000  Matthew Waters <matthew@centricular.com>

	* ext/qt6/qt6glrenderer.cc:
	* ext/qt6/qt6glrenderer.h:
	  qt6renderer: keep output GL memory alive until next render
	  Qml seems to not correctly render an output if the output texture id is
	  the same as previously set. This can easily happen if the output texture
	  is destroyed and a new texture created with the same ID. This is
	  particularly evident with a downstream element that reads from the
	  texture and then unrefs it causing the texture to be destroyed.
	  Fix by keeping the output texture alive until we have rendered the next
	  frame.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12342>

2026-08-19 15:13:43 +1000  Matthew Waters <matthew@centricular.com>

	* ext/qt6/qt6glrenderer.cc:
	  qml6gloverlay: map output memory write|gl
	  So that if a gldownload is downstream, it can successfully transfer the
	  contents.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12342>

2026-08-06 21:28:28 +0200  Marcus Hanestad <marlhan@proton.me>

	* gst/audiofx/gstscaletempo.c:
	  scaletempo: fix integer overflow in output_overlap_s16
	  The blend weights and sample delta can each approach 65535, so their product
	  overflows the 32-bit intermediate.
	  Compute the product and shift in 64 bits.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12265>

2026-08-05 13:04:46 +0100  Tim-Philipp Müller <tim@centricular.com>

	* meson.build:
	  Back to development after 1.28.6

=== release 1.28.6 ===

2026-08-05 12:59:39 +0100  Tim-Philipp Müller <tim@centricular.com>

	* gst-plugins-good.doap:
	* meson.build:
	  Release 1.28.6

2026-08-04 20:05:57 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/rtp/gstrtph264depay.c:
	* gst/rtp/gstrtph265depay.c:
	  rtph264depay: rtph265depay: Reset missing fields when resetting during fragmentation unit handling
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244>

2026-07-29 17:39:56 +0300  Sebastian Dröge <sebastian@centricular.com>

	* docs/gst_plugins_cache.json:
	* gst/rtp/gstrtph264depay.c:
	* gst/rtp/gstrtph264depay.h:
	* gst/rtp/gstrtph265depay.c:
	* gst/rtp/gstrtph265depay.h:
	  rtph264depay: rtph265depay: Limit the maximum fragmentation unit size
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5224
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244>

2026-07-20 13:12:48 +0100  Tim-Philipp Müller <tim@centricular.com>

	* gst/rtp/gstrtpqcelpdepay.c:
	  rtpqcelpdepay: use clear_packets also in finalize function
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12237>

2026-07-09 10:28:00 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/rtp/gstrtpqcelpdepay.c:
	  rtpqcelp: Clear queued packets on invalid input packets
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12237>

2026-07-09 10:26:20 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/rtp/gstrtpqcelpdepay.c:
	  rtpqcelpdepay: Don't push NULL buffers downstream
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12237>

2026-07-09 10:24:34 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/rtp/gstrtpqcelpdepay.c:
	* gst/rtp/gstrtpqcelpdepay.h:
	  rtpqcelpdepay: Handle changes in interleave value correctly
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5194
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12237>

2026-07-14 13:39:30 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/matroska/matroska-ids.c:
	  matroskademux: Make sure enough data is available when parsing FLAC headers
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5206
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12242>

2026-07-14 13:22:38 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/avi/gstavidemux.c:
	  avidemux: Don't read a subindex with too many items
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12241>

2026-07-14 13:22:04 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/avi/gstavidemux.c:
	  avidemux: Avoid integer overflow in bounds checks when parsing the index
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12241>

2026-07-14 12:35:12 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/avi/gstavidemux.c:
	  avidemux: Use correct divisor for calculating available number of vprp field infos
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12241>

2026-07-14 12:29:14 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/avi/gstavidemux.c:
	  avidemux: Check that at least 1 byte is available before dereferencing tag pointer
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12241>

2026-07-14 12:27:37 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/avi/gstavidemux.c:
	  avidemux: Don't modify read-only mapped buffer data
	  And improve const-correctness in many places.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12241>

2026-07-14 12:00:34 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/avi/gstavidemux.c:
	  avidemux: Make sure enough data is available when parsing FUJIFILM strd
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12241>

2026-07-16 14:12:56 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/audioparsers/gstaacparse.c:
	  aacparse: Don't assert on parsing errors or insufficient data
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12143>

2026-07-18 16:19:17 +0200  Tim-Philipp Müller <tim@centricular.com>

	* ext/gdk_pixbuf/gstgdkanimation.h:
	* sys/ximage/gstximagesrc.h:
	  gdkpixbuf, ximage: remove incorrect G_GNUC_CONST annotation for get_type() functions
	  G_GNUC_CONST must only be used for functions that don't modify global state.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12157>

2026-07-30 01:45:49 -0400  Thibault Saunier <tsaunier@igalia.com>

	* tests/check/elements/qtmux.c:
	  tests: qtmux: drain to EOS before teardown in test_caps_renego
	  The test pulled one output buffer and immediately tore the harness down.
	  gst_harness_teardown() releases the request sink pad while the element is
	  still running, racing the aggregator srcpad task inside
	  gst_qt_mux_aggregate(): depending on the interleaving it either trips the
	  buf/last_buf assertion there or leaks the clipped buffer stored into
	  pad->last_buf after gst_qt_mux_pad_reset() ran. The window is wide under
	  valgrind, which is where it shows up in CI.
	  Pull events until EOS before teardown: once the muxer has pushed EOS it is
	  in GST_QT_MUX_STATE_EOS and aggregate() no longer touches the sink pads, so
	  releasing the request pad can't race. Does not fix the underlying element
	  race, only the test.
	  Example failed CI job:
	  https://gitlab.freedesktop.org/gstreamer/gstreamer/-/jobs/104277021
	  Relates: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/4970
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12200>

2026-06-16 16:49:47 +0900  Qi Hou <qi.hou@nxp.com>

	* sys/v4l2/gstv4l2object.c:
	* sys/v4l2/gstv4l2object.h:
	  v4l2: Use MPLANE flag to determine n_v4l_planes directly
	  Add GST_V4L2_MPLANE flag to GstV4L2FormatFlags and mark all
	  non-contiguous multi-planar V4L2 formats (e.g. YUV420M, NV12M)
	  with this flag in gst_v4l2_formats[].
	  Instead of using prefered_non_contiguous field, determine
	  the number of n_v4l_planes directly by checking the GST_V4L2_MPLANE
	  flag of the selected format descriptor. This avoids the
	  contiguity check for format lookup.
	  Remove the prefered_non_contiguous field from GstV4l2Object as
	  it's no longer needed.
	  Fixes #4269
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12177>

2026-06-09 20:31:25 +0200  Mathieu Duponchelle <mathieu@centricular.com>

	* gst/rtpmanager/rtpsession.c:
	* gst/rtpmanager/rtpsource.c:
	* gst/rtpmanager/rtpsource.h:
	* gst/rtpmanager/rtpstats.h:
	  rtpsource: fix bitrate estimation for RTX
	  RTX packets with decreasing running times routinely come through
	  send_rtp , causing miscalculation of elapsed.
	  Fix by using current_time instead to calculate the bandwidth for RTX
	  sources, and also guard against potential underflows in elapsed
	  calculation.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12171>

2026-07-16 12:56:53 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/y4m/gsty4mdec.c:
	  y4mdec: Don't read more data than available when skipping over frame header
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12122>

2026-07-16 12:56:16 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/y4m/gsty4mdec.c:
	  y4mdec: Don't assert on too small header buffers
	  This might happen on EOS before enough data is available.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12122>

2026-07-08 23:48:39 +0200  Tim-Philipp Müller <tim@centricular.com>

	* meson.build:
	  Back to development after 1.28.5

=== release 1.28.5 ===

2026-07-08 23:42:39 +0200  Tim-Philipp Müller <tim@centricular.com>

	* gst-plugins-good.doap:
	* meson.build:
	  Release 1.28.5

2026-07-02 18:33:04 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/matroska/lzo.c:
	* gst/matroska/lzo.h:
	  matroska: Update lzo decompression implementation from latest ffmpeg
	  See also CVE-2014-4610.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5184
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12079>

2026-06-26 12:03:09 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/wavparse/gstwavparse.c:
	  wavparse: Avoid NULL pointer dereference when parsing adtl in push mode
	  Fix provided by Michael Bommarito, who also reported this.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5177
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12078>

2026-06-23 10:34:39 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/rtp/gstrtpjpegdepay.c:
	  rtpjpegdepay: Ensure that quantization table is big enough
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5158
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12071>

2026-06-19 13:20:04 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/gdk_pixbuf/gstgdkpixbufdec.c:
	  gdkpixbufdec: Handle format and resolution changes correctly
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5121
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12060>

2026-06-19 13:15:02 +0300  Sebastian Dröge <sebastian@centricular.com>

	* docs/gst_plugins_cache.json:
	* ext/gdk_pixbuf/gstgdkpixbufdec.c:
	  gdkpixbufdec: Drop rank to NONE
	  gdk-pixbuf is not mean to be used on untrusted inputs so let's not ask for
	  problems here.
	  For the common image formats we have specialized elements with higher ranks and
	  for a proper replacement follow this issue:
	  https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/issues/764
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12060>

2026-06-19 13:00:27 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/rtp/gstrtpsbcdepay.c:
	  rtpsbcdepay: Remove wrong variable shadowing
	  `samples` is expected to be set in the outer scope at a later time.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12059>

2026-06-19 12:55:34 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/rtp/gstrtpsbcdepay.c:
	  rtpsbcdepay: Check that enough data is available for the payload header
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12059>

2026-06-19 12:50:32 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/rtp/gstrtpsbcdepay.c:
	  rtpsbcdepay: Check for available data in the adapter before getting data
	  Consider empty packets with the last flag as bad packets.
	  Also reset buffers to NULL after giving away ownership of them to avoid
	  returning an already freed buffer.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5119
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12059>

2026-06-17 16:18:50 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/isomp4/atomsrecovery.c:
	  qtmoovrecover: Validate box sizes
	  Also validate box versions where it matters.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5118
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5120
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12058>

2026-06-14 23:46:02 +0100  Tim-Philipp Müller <tim@centricular.com>

	* gst/rtp/gstrtpceltdepay.c:
	  rtpceltdepay: error out if anyone tries to use this element
	  Forbid use of this element and comment out all processing code.
	  There is no plausible reason this code should ever be executed in 2026
	  seeing that this was an experimental audio codec that never really gained
	  adoption and was superseded by (and included in) Opus more than a decade
	  ago. There are no decoders or encoders in GStreamer for this, and the
	  RTP mapping RFC never made it out of draft state either.
	  We post an error message in the state change function, so this processing
	  function should never be reached, we just ifdef the code out for clarity.
	  If anyone actually does have a legitimate need for this and can provide
	  sample streams, we will happily implement a depayloader in Rust.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5157
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12039>

2026-07-03 09:22:31 +0200  Pablo García <pgarcia@fluendo.com>

	* docs/gst_plugins_cache.json:
	* gst/isomp4/gstqtmuxmap.c:
	  qtmux: Allow connection to ac3parse
	  ac3parse doesn't output the field 'parsed' so they cannot connect.
	  'framed' is also required by the muxer.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12028>

2026-07-03 08:50:07 +0900  amy.ko <amy.ko@lge.com>

	* gst/shapewipe/gstshapewipe.c:
	  shapewipe: Fix missing mutex unlock in shutdown path
	  A deadlock may occur if the function returns with the
	  mask_mutex locked when the element is shutting down.
	  Add the missing g_mutex_unlock() in the shutdown label.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12016>

2026-03-27 17:27:47 -0300  L. E. Segovia <amy@centricular.com>

	* ext/libpng/gstpngdec.c:
	  pngdec: fix wrong macro being used for ICC support test
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11972>

2026-06-22 12:14:35 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/matroska/matroska-read-common.c:
	  matroskademux: Don't pass non-GstElement pointers to GST_ELEMENT_ERROR
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11918>

2026-03-30 09:44:27 -0300  L. E. Segovia <amy@centricular.com>

	* docs/gst_plugins_cache.json:
	* ext/gdk_pixbuf/gstgdkpixbufdec.c:
	* ext/gdk_pixbuf/meson.build:
	  gdkpixbufdec: remove Sun and Andrew raster formats
	  They were both removed in 2.32.1:
	  https://github.com/GNOME/gdk-pixbuf/commit/af2fca9bba5c127ca092c3a4bf7656015d6168ad
	  Moreover, the Andrew raster format (image/x-cmu-raster) doesn't match at
	  all the Sun raster format, the former is similar to LaTeX while the
	  latter is binary.
	  As a double safety measure, let's bump the minimum gdk-pixbuf version as
	  2.32.1 was released in 2015 [1] while 2.8.0 is from 2005 [2].
	  Fixes #5004
	  [1]: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/tags/2.32.0
	  [2]: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/tags/GTK_2_8_0
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11901>

2026-06-15 15:24:24 +0200  Benoît Mauduit <benoit.mauduit@devialet.com>

	* ext/flac/gstflacenc.c:
	  flacenc: Use dash for property name in DO_UPDATE
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11860>

2026-05-06 14:31:21 +0200  Benoît Mauduit <benoit.mauduit@devialet.com>

	* ext/flac/gstflacenc.c:
	  flacenc: Fix g_object_notify on loose-mid-side-stereo property
	  Fix an assertion warning on g_object_notify (in DO_UPDATE macro)
	  because there is no Gobject property named `loose_mid_side` (property
	  is loose_mid_side_stereo).
	  Assertion was :
	  ```
	  g_object_notify: object class 'GstFlacEnc' has no property named
	  'loose_mid_side'
	  ```
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11860>

2026-06-12 13:27:54 +0100  Tim-Philipp Müller <tim@centricular.com>

	* meson.build:
	  Back to development after 1.28.4

=== release 1.28.4 ===

2026-06-12 13:19:43 +0100  Tim-Philipp Müller <tim@centricular.com>

	* gst-plugins-good.doap:
	* meson.build:
	  Release 1.28.4

2026-06-11 15:43:40 +1000  Matthew Waters <matthew@centricular.com>

	* ext/qt6/qt6glrenderer.cc:
	  qt6: remove an unneeded QOpenGLContext->makeCurrent()
	  This is no longer needed with Qt6.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11833>

2026-06-05 12:33:30 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/audioparsers/gstsbcparse.c:
	  sbcparse: Add bounds checking to header parsing
	  Also the minimum valid frame size is 7 and not 6 (assertion) or 8 (header
	  parsing).
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5087
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11817>

2026-06-05 11:24:33 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackdec.c:
	  wavpackdec: Unmap input buffer directly after decoding
	  In case of decoder errors we would otherwise unmap the buffer after
	  finish_frame(), which potentially invalidates the input buffer already.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811>

2026-06-05 11:24:29 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackdec.c:
	  wavpackdec: Avoid integer overflow when checking input buffer size
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811>

2026-06-05 11:24:25 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackdec.c:
	  wavpackdec: Use correctly-sized variable types
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811>

2026-06-05 11:24:21 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackdec.c:
	  wavpackdec: Avoid integer overflow when calculating output buffer size
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5069
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811>

2026-05-31 14:46:21 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackenc.c:
	  wavpackenc: Handle >8 channels correctly when reordering
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11757>

2026-05-31 13:42:32 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/audioparsers/gstwavpackparse.c:
	  wavpackparse: Fix parsing of number of channels in new-style channel info chunks
	  The number of channels is spread out over three bytes, not two.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11757>

2026-05-31 13:41:36 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/audioparsers/gstwavpackparse.c:
	  wavpackparse: Only default channel mask if no channels are given
	  A zero channel mask is completely valid for unpositioned channels.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11757>

2026-05-31 12:30:58 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/audioparsers/gstwavpackparse.c:
	  wavpackparse: Map unsupported channel layouts to unpositioned channels
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11757>

2026-05-31 12:13:47 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackdec.c:
	* ext/wavpack/gstwavpackdec.h:
	  wavpackdec: Handle unsupported channel layouts by mapping to unpositioned channels
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11757>

2026-05-31 12:03:49 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackenc.c:
	  wavpackenc: Handle unpositioned and unsupported channel layouts
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5129
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11757>

2026-05-31 12:00:39 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackcommon.c:
	  wavpack: Map unknown/invalid channel positions to an unpositioned layout
	  Instead of randomly failing or producing incomplete channel masks.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11757>

2026-05-31 11:58:59 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackcommon.c:
	* ext/wavpack/gstwavpackcommon.h:
	  wavpack: Remove unused function
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11757>

2026-05-31 11:45:48 +0300  Sebastian Dröge <sebastian@centricular.com>

	* ext/wavpack/gstwavpackcommon.c:
	* ext/wavpack/gstwavpackcommon.h:
	* ext/wavpack/gstwavpackdec.c:
	* ext/wavpack/gstwavpackdec.h:
	* ext/wavpack/gstwavpackenc.c:
	* ext/wavpack/gstwavpackenc.h:
	  wavpack: Use more correct types and add some const qualifiers
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11757>

2026-05-29 11:53:08 +0900  Hou Qi <qi.hou@nxp.com>

	* sys/v4l2/gstv4l2bufferpool.c:
	  v4l2: Fix buffer leak on qbuf failure
	  When gst_v4l2_buffer_pool_qbuf() fails in the output buffer processing
	  path of gst_v4l2_buffer_pool_process(), the to_queue buffer is not
	  unreferenced before jumping to the queue_failed error label. This buffer
	  was either obtained via gst_buffer_ref() on the input buffer or acquired
	  from the buffer pool, both of which take a reference that must be
	  released on failure.
	  Add the missing gst_buffer_unref() call to prevent leaking a buffer
	  reference each time qbuf fails.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11759>

2026-05-29 17:37:07 +0200  Jan Schmidt <jan@centricular.com>

	* tests/check/elements/mpegaudioparse.c:
	  tests/mpegaudioparse: Fix raciness in the state change handling
	  This test_parse_gapless_and_skip_padding_samples test sometimes
	  got stuck changing state synchronously if appsink prerolled too
	  quickly. Fix it to use asynchronous state changes and waiting
	  in all the required places.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11724>

2026-05-29 11:00:33 +0800  Hou Qi <qi.hou@nxp.com>

	* gst/matroska/matroska-mux.c:
	* gst/matroska/matroska-mux.h:
	  matroska-mux: Write ReferenceBlock for non-keyframe video in BlockGroups
	  When writing video frames using BlockGroups, the muxer did not include
	  a ReferenceBlock element for non-keyframe frames. According to the
	  Matroska specification, the absence of ReferenceBlock in a BlockGroup
	  signals that the block is a keyframe. Without it, demuxers have no way
	  to distinguish keyframes from delta frames when parsing BlockGroups.
	  This caused interoperability issues with demuxers that rely on
	  ReferenceBlock presence to identify non-keyframe video frames as delta
	  units, which is the standard behavior per the Matroska spec.
	  Add a ReferenceBlock element to BlockGroups for non-keyframe video
	  blocks so that demuxers can correctly flag them as delta units.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11722>

2026-05-29 13:26:37 +0300  Rares Branici <rares.branici@senstar.com>

	* gst/rtp/gstrtph265depay.c:
	  rtph265depay: fix mem leak
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11715>

2026-05-19 10:29:37 +0200  Piotr Brzeziński <piotr@centricular.com>

	* sys/osxaudio/gstosxcoreaudio.c:
	  osxaudio: Fix stack overflow with >64ch audio devices
	  The fallback path for invalid channel positions didn't account for the
	  64 channel limit we have in osxaudio including the positions array, and
	  would overflow it if more channels were present.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11658>

2026-05-19 18:09:25 +0200  dec05eba <dec05eba@protonmail.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: parse mastering luminance as u32 instead of u16
	  According to the specification in ISO/IEC 14496-12 2020 12.1.7.1
	  these fields should be u32, not u16.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11661>

2026-05-11 18:33:25 +0100  Tim-Philipp Müller <tim@centricular.com>

	* meson.build:
	  Back to development after 1.28.3

=== release 1.28.3 ===

2026-05-11 18:28:12 +0100  Tim-Philipp Müller <tim@centricular.com>

	* gst-plugins-good.doap:
	* meson.build:
	  Release 1.28.3

2026-04-16 17:03:44 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: Check for minimum stride requirements and width/height constraints with uncompressed video
	  And return an explicit error on mismatches.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5043
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11591>

2026-05-08 22:58:24 +1000  Jan Schmidt <jan@centricular.com>

	* ext/adaptivedemux2/hls/gsthlsdemux.c:
	  hlsdemux2: Abort wait for variant playlist on shutdown
	  If the element is stopped while waiting for the variant playlist,
	  exit the loop.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11572>

2026-05-08 22:24:52 +1000  Jan Schmidt <jan@centricular.com>

	* ext/adaptivedemux2/gstadaptivedemux-stream.c:
	  adaptivedemux2: Fix mismatched clock-time vs clock-stime check
	  Adaptive demux stream start_position is an unsigned clock-time value,
	  it should not be compared against GST_CLOCK_STIME_NONE
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11572>

2026-05-08 22:09:46 +1000  Jan Schmidt <jan@centricular.com>

	* ext/adaptivedemux2/hls/gsthlsdemux-stream.c:
	* ext/adaptivedemux2/hls/gsthlsdemux.c:
	* ext/adaptivedemux2/hls/gsthlsdemux.h:
	  hlsdemux2: Error out cleanly on resync failure
	  Instead of asserting when the variant stream doesn't have a current
	  position to resynchronise to after a discontinuity, throw an element
	  error instead.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11572>

2026-04-09 09:59:52 +0900  Shigeharu Kamiya <s_kamiya@toa.co.jp>

	* gst/rtsp/gstrtspsrc.c:
	  rtspsrc: include user-agent property in HTTP tunnel requests
	  The user-agent property is correctly sent in regular RTSP
	  requests via gst_rtspsrc_init_request(), but was missing from
	  HTTP tunnel GET and POST requests. Add it to the connection's
	  extra HTTP headers when tunneled mode is configured.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11286>

2026-05-06 19:50:35 +0100  Arthur Chan <arthur.chan@adalogics.com>

	* gst/isomp4/qtdemux.c:
	  isomp4: Fix memory leak when file is corrupted
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11564>

2026-04-07 13:09:24 +0100  Nirbheek Chauhan <nirbheek@centricular.com>

	* meson.build:
	  meson: Require C std gnu11 or c11
	  When using gcc or clang, gnu11 will be used, and when using MSVC c11
	  will be used which will pass /std:c11. This provides us with the
	  `restrict` keyword on all supported platforms.
	  We can do this now because we require Visual Studio 2019.
	  This feature was added in Meson 1.3
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11563>

2026-05-06 19:49:33 +0100  Arthur Chan <arthur.chan@adalogics.com>

	* gst/matroska/ebml-read.c:
	  matroska: Fix wrong object type bug
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11561>

2026-04-30 12:57:35 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/wavparse/gstwavparse.c:
	  wavparse: Remove assertion about upstream file size
	  Upstream can report bogus values and we shouldn't assert on that but just ignore
	  it in that case.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5077
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11506>

2026-04-21 10:43:37 +0200  Ognyan Tonchev <ognyan@axis.com>

	* gst/rtsp/gstrtspsrc.c:
	  gstrtspsrc: mki is optional upon crypto update
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5050
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11448>

2026-04-04 20:34:19 +0530  Nirbheek Chauhan <nirbheek@centricular.com>

	* sys/osxaudio/gstosxcoreaudiocommon.h:
	  applemedia: Require Xcode 12.4 for all builds
	  Xcode 12.4 is the newest Xcode that you can install on macOS 10.15. We
	  require Xcode 12.4, but we only support macOS builds on it. For iOS,
	  tvOS, etc a newer (currently unspecified) Xcode version is required.
	  Fixes #4941
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11369>

2026-04-20 15:36:34 +0900  Jeongmin Kwak <jeongmin.kwak@lge.com>

	* gst/isomp4/qtdemux.c:
	  isomp4: qtdemux: Add bounds checks for ESDS descriptors
	  Validate minimum sizes before accessing descriptor fields to prevent
	  out-of-bounds reads on truncated or malformed MP4 files.
	  - ES_DESCRIPTOR_TAG: require 3 bytes
	  - DECODER_CONFIG_DESC_TAG: require 13 bytes
	  - SL_CONFIG_DESC_TAG: require 1 byte
	  Skip short descriptors instead of reading invalid memory.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11382>

2025-10-15 11:16:46 +0200  Michael Olbrich <m.olbrich@pengutronix.de>

	* sys/v4l2/gstv4l2transform.c:
	  v4l2transform: release input buffers earlier
	  The transform operation is synchronous. So the input buffer is no longer needed
	  once the output buffer is ready. Release it immediately so it can be reused by
	  the upstream pipeline.
	  This can reduce the number of buffers needed.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11368>

2025-10-15 14:23:03 +0200  Michael Olbrich <m.olbrich@pengutronix.de>

	* sys/v4l2/gstv4l2bufferpool.c:
	* sys/v4l2/gstv4l2bufferpool.h:
	  v4l2: pool: add helper to release buffers
	  Factor out the code to dequeue and release buffers that are ready.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11368>

2026-04-14 15:43:58 +0200  Tobias Koenig <tobias.koenig@kdab.com>

	* ext/qt6/qt6glitem.cc:
	  qml6glsink: Fix redraw issues on buffer change
	  Mark the texture as dirty if the new buffer is different from
	  the previous one to make sure the item is rerendered.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11338>

2026-04-14 09:04:15 +0200  Michiel Westerbeek <happylinks@gmail.com>

	* gst/wavparse/gstwavparse.c:
	  wavparse: recover from invalid av_bps for PCM
	  Some PCM WAV files in the wild have an av_bps field (nAvgBytesPerSec)
	  that doesn't match blockalign * rate — only the metadata is wrong,
	  the PCM data is valid. Previously wavparse rejected these with a
	  fatal stream error.
	  For PCM, av_bps is fully determined by blockalign * rate, so
	  recompute to the authoritative value and warn. wav->bps is used at
	  :367 and :734 to translate timestamps to byte offsets for seeking,
	  so simply accepting the bogus value would silently produce wrong
	  seeks.
	  Non-PCM formats keep the strict rejection: for compressed formats
	  (ADPCM, GSM, etc.) the actual av_bps is much less than
	  blockalign * rate, so recomputing wouldn't give a correct value.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11331>

2026-04-10 17:02:53 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/avi/gstavidemux.c:
	  avidemux: Fix divide by zero if VPRP contains fields==0
	  Thanks to RTV for reporting.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5027
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11305>

2026-04-03 15:35:38 -0400  Nicolas Dufresne <nicolas.dufresne@collabora.com>

	* sys/v4l2/gstv4l2object.c:
	  v4l2: object: Fix caps filtering in caps negotiation
	  The dmabuf caps feature was not properly added to the probed caps. This would
	  lead to caps negotiation failure when trying to force DMABuf using a caps filter
	  after the stateful v4l2h*dec elements.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11288>

2026-04-07 20:07:19 +0100  Tim-Philipp Müller <tim@centricular.com>

	* meson.build:
	  Back to development after 1.28.2

=== release 1.28.2 ===

2026-04-07 20:02:23 +0100  Tim-Philipp Müller <tim@centricular.com>

	* gst-plugins-good.doap:
	* meson.build:
	  Release 1.28.2

2026-04-01 13:39:27 +0300  Cameron O'Neal <tzusec@gmail.com>

	* gst/matroska/matroska-read-common.c:
	  matroskademux: Add missing parenthesis when calculating bz2 buffer sizes
	  This fixes a heap buffer overflow.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5009
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11263>

2026-04-01 13:44:52 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/wavparse/gstwavparse.c:
	  wavparse: Use prepend+reverse instead of append when building the cues list
	  append has quadratic behaviour and this can matter if there are a lot of cues.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11262>

2026-04-01 13:42:51 +0300  Cameron O'Neal <tzusec@gmail.com>

	* gst/wavparse/gstwavparse.c:
	  wavparse: Fix integer overflow when checking available buffer size for reading cues
	  See https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5009
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11262>

2026-03-19 12:24:22 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/flv/gstflvdemux.c:
	  flvdemux: Avoid assertions on corrupted streams
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4975
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11258>

2026-03-13 11:56:45 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: Add various integer overflow and bounds checks to uncompressed video handling
	  Fixes ZDI-CAN-29392
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4963
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11252>

2026-03-19 11:00:50 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: Fix bit pattern check for omitted audio channels map
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11253>

2026-03-19 10:46:51 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: Avoid out-of-bounds reads and writes of 64 item audio channel positions array
	  When parsing both the chan and chnl boxes.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11253>

2026-03-19 10:34:54 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: Validate chnl defined layout before using it to index the layouts array
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4976
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11253>

2026-03-19 10:25:22 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/isomp4/qtdemux.c:
	  qtdemux: Avoid division by zero if 0 audio channels are signalled
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4977
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11253>

2026-04-03 16:15:26 +0200  Frédéric Chanal <frederic.chanal@ubicast.eu>

	* gst/flv/gstflvmux.c:
	  flvmux: fix race condition on caps get and check
	  Apart from fixing a race condition this commit also removes useless code that
	  remained after !10071 which removed the use of caps for audio and video sink
	  pads.
	  The race condition appears with this sequence:
	  [thread 1] the thread in which the mux video sink element runs
	  [thread 2] the thread running the aggregator task (gst_aggregator_loop)
	  * [thread 1] GST_EVENT_CAPS is send on muxer's video pad
	  * [thread 1] eventually `gst_aggregator_default_sink_event_pre_queue()` is called
	  and the event is pushed onto internal queue for later processing
	  * [thread 1] then `SRC_BROADCAST()` is called
	  => race appears here if [thread 2] is scheduled
	  * [thread 2] `SRC_WAIT()` from `gst_aggregator_wait_and_check()` is released and
	  this function is revaluate, and return TRUE with timeout being 1 (as both audio
	  and video codec are valid, and we are ready to mux)
	  * [thread 2] The `gst_flv_mux_aggregate()` is eveantually called ->
	  `gst_flv_mux_prepare_src_caps()` -> `gst_flv_mux_create_metadata()`
	  * [thread 2] in `gst_flv_mux_create_metadata(),` the caps for the first video
	  pad (`default_video_track_pad`) are retrieved but at this point the caps are
