diff --git a/Mk/Uses/gstreamer.mk b/Mk/Uses/gstreamer.mk
index d06b83a08fd1..f4b12fb34229 100644
--- a/Mk/Uses/gstreamer.mk
+++ b/Mk/Uses/gstreamer.mk
@@ -1,482 +1,482 @@
 # Support for GStreamer-related libraries and plugins
 #
 # Feature:		gstreamer
 # Usage:
 #   USES=		gstreamer[:version][,arg,...]
 #   USE_GSTREAMER=	[list of components]
 #
 # Valid ARGS:		<version>, _internal
 #
 # version:		1 -- default (this may be omitted since there is
 #			currently only one supported version)
 # _internal:		Only intended for use by multimedia/gstreamer1 to
 #			define specific variables like _GST1_VERSION so that
 #			it does not depend on itself
 #
 # MAINTAINER: multimedia@FreeBSD.org
 
 .if ! defined(_INCLUDE_USES_GSTREAMER_MK)
 _INCLUDE_USES_GSTREAMER_MK=	YES
 
 #== Argument handling
 
 # Preparations to support multiple gstreamer versions
 _GST_VER_SUPPORTED=	1
 _GST_VER_DEFAULT=	1
 _GST_VER=		#
 .  for ver in ${_GST_VER_SUPPORTED:O:u}
 .    if ${gstreamer_ARGS:M${ver}}
 .      if empty(_GST_VER)
 _GST_VER=	${ver}
 .      else
 IGNORE=	Incorrect USES=gstreamer:${gstreamer_ARGS} - multiple versions defined
 .      endif
 .    endif
 .  endfor
 
 .  if empty(_GST_VER)
 _GST_VER=	${_GST_VER_DEFAULT}
 .  endif
 
 #== Component setup
 
 # When modifying _GST1_VERSION, run `make -C ${PORTSDIR}/multimedia/gstreamer1 makesum-all`
 # to update the distinfo files for the entire suite.
-_GST1_VERSION=		1.28.3
+_GST1_VERSION=		1.28.4
 _GST1_LIB_VER=		1.0
 _GST1_SOVERSION=	0.${_GST1_VERSION:R:E}${${_GST1_VERSION:E} > 9:?:0}${_GST1_VERSION:E}.0
 
 _GST1_CATEGORIES=	audio comms devel ftp graphics multimedia net security \
 			sysutils textproc www x11 x11-toolkits
 _GST1_PLUGINS_audio= 	a52dec alsa amrnb amrwbdec bs2b cdparanoia chromaprint faac \
 			faad fdkaac flac flite gme gsm jack ladspa lame lv2 modplug \
 			mpg123 ogg openmpt opus pulse shout2 sidplay \
 			sndfile sndio soundtouch speex taglib twolame vorbis \
 			wavpack webrtcdsp
 _GST1_PLUGINS_comms=	spandsp
 _GST1_PLUGINS_devel=	devtools soup
 _GST1_PLUGINS_ftp=	curl
 _GST1_PLUGINS_graphics=	aalib cairo gdkpixbuf gl jpeg kms libcaca libvisual \
 			opencv openexr openjpeg png rsvg vulkan webp zbar
 _GST1_PLUGINS_multimedia=	aom assrender bad dash dts dv dvdread \
 			editing-services good hls libav libde265 \
 			mpeg2dec mpeg2enc mplex mm msdk openh264 resindvd \
 			rtsp-server rust smoothstreaming svtav1 theora ttml \
 			ugly v4l2 vpx webrtc x264 x265
 _GST1_PLUGINS_net=	sctp srtp
 _GST1_PLUGINS_security=	dtls
 _GST1_PLUGINS_sysutils=	cdio
 _GST1_PLUGINS_textproc=	zxing
 _GST1_PLUGINS_www=	neon srt
 _GST1_PLUGINS_x11=	x ximagesrc
 _GST1_PLUGINS_x11-toolkits=	gtk pango qt5 qt6
 
 #== Unversioned information
 
 # Gather all available plugins for the chosen version
 _GST_PLUGINS_BASE=	bad core good ugly libgstreamer plugins
 _GST_PLUGINS_VER:=	${_GST${_GST_VER}_CATEGORIES:S/^/\${_GST${_GST_VER}_PLUGINS_/:S/$/}/}
 
 _GST_VERSION=		${_GST${_GST_VER}_VERSION}
 _GST_LIB_VER=		${_GST${_GST_VER}_LIB_VER}
 _GST_SOVERSION=		${_GST${_GST_VER}_SOVERSION}
 
 # List of all available components
 _USE_GSTREAMER_ALL=	${_GST_PLUGINS_BASE} \
 			${_GST_PLUGINS_VER}
 
 #==  Dependency setup
 
 #==== Top-level components
 
 gst-plugins_PORT=	multimedia/gstreamer${_GST_VER}-plugins
 gst-plugins_IMPL=	# empty
 gst-plugins_SUFFIX=	#
 
 gst-bad_PORT=		multimedia/gstreamer${_GST_VER}-plugins-bad
 gst-bad_IMPL=		#
 
 gst-core_PORT=		multimedia/gstreamer${_GST_VER}-plugins-core
 gst-core_IMPL=		#
 gst-core_GST1_VERSION=	${_GST1_VERSION:R}
 gst-core_VERSION=	${gst-core_GST${_GST_VER}_VERSION}
 
 gst-good_PORT=		multimedia/gstreamer${_GST_VER}-plugins-good
 gst-good_IMPL=		#
 
 gst-ugly_PORT=		multimedia/gstreamer${_GST_VER}-plugins-ugly
 gst-ugly_IMPL=		#
 
 gst-libgstreamer_LIB=	libgstreamer${_GST${_GST_VER}_LIB_VER:D-${_GST${_GST_VER}_LIB_VER}}.so
 gst-libgstreamer_PORT=	multimedia/gstreamer${_GST_VER}
 
 #==== audio plugins section
 
 gst-a52dec_PORT=	audio/gstreamer${_GST_VER}-plugins-a52dec
 gst-a52dec_IMPL=	ugly
 
 gst-alsa_PORT=		audio/gstreamer${_GST_VER}-plugins-alsa
 gst-alsa_IMPL=		#
 
 gst-amrnb_PORT=		audio/gstreamer${_GST_VER}-plugins-amrnb
 gst-amrnb_IMPL=		ugly
 
 gst-amrwbdec_PORT=	audio/gstreamer${_GST_VER}-plugins-amrwbdec
 gst-amrwbdec_IMPL=	ugly
 
 gst-bs2b_PORT=		audio/gstreamer${_GST_VER}-plugins-bs2b
 gst-bs2b_IMPL=		bad
 
 gst-cdparanoia_PORT=	audio/gstreamer${_GST_VER}-plugins-cdparanoia
 gst-cdparanoia_IMPL=	#
 
 gst-chromaprint_PORT=	audio/gstreamer${_GST_VER}-plugins-chromaprint
 gst-chromeprint_IMPL=	bad
 
 gst-faac_PORT=		audio/gstreamer${_GST_VER}-plugins-faac
 gst-faac_IMPL=		bad
 
 gst-faad_PORT=		audio/gstreamer${_GST_VER}-plugins-faad
 gst-faad_IMPL=		bad
 
 gst-fdkaac_PORT=	audio/gstreamer${_GST_VER}-plugins-fdkaac
 gst-fdkaac_IMPL=	bad
 
 gst-flac_PORT=		audio/gstreamer${_GST_VER}-plugins-flac
 gst-flac_IMPL=		good
 
 gst-flite_PORT=		audio/gstreamer${_GST_VER}-plugins-flite
 gst-flite_IMPL=		bad
 
 gst-gme_PORT=		audio/gstreamer${_GST_VER}-plugins-gme
 gst-gme_IMPL=		bad
 
 gst-gsm_PORT=		audio/gstreamer${_GST_VER}-plugins-gsm
 gst-gsm_IMPL=		bad
 
 gst-jack_PORT=		audio/gstreamer${_GST_VER}-plugins-jack
 gst-jack_IMPL=		good
 
 gst-ladspa_PORT=	audio/gstreamer${_GST_VER}-plugins-ladspa
 gst-ladspa_IMPL=	bad
 
 gst-lame_PORT=		audio/gstreamer${_GST_VER}-plugins-lame
 gst-lame_IMPL=		ugly
 
 gst-lv2_PORT=		audio/gstreamer${_GST_VER}-plugins-lv2
 gst-lv2_IMPL=		bad
 
 gst-modplug_PORT=	audio/gstreamer${_GST_VER}-plugins-modplug
 gst-modplug_IMPL=	bad
 
 gst-mpg123_PORT=	audio/gstreamer${_GST_VER}-plugins-mpg123
 gst-mpg123_IMPL=	ugly
 
 gst-ogg_PORT=		audio/gstreamer${_GST_VER}-plugins-ogg
 gst-ogg_IMPL=		#
 
 gst-openmpt_PORT=	audio/gstreamer${_GST_VER}-plugins-openmpt
 gst-openmpt_IMPL=	bad
 
 gst-opus_PORT=		audio/gstreamer${_GST_VER}-plugins-opus
 gst-opus_IMPL=		#
 
 gst-pulse_PORT=		audio/gstreamer${_GST_VER}-plugins-pulse
 gst-pulse_IMPL=		good
 
 gst-shout2_PORT=	audio/gstreamer${_GST_VER}-plugins-shout2
 gst-shout2_IMPL=	good
 
 gst-sidplay_PORT=	audio/gstreamer${_GST_VER}-plugins-sidplay
 gst-sidplay_IMPL=	ugly
 
 gst-sndfile_PORT=	audio/gstreamer${_GST_VER}-plugins-sndfile
 gst-sndfile_IMPL=	bad
 
 gst-sndio_PORT=		audio/gstreamer${_GST_VER}-plugins-sndio
 gst-sndio_IMPL=		#
 gst-sndio_GST1_VERSION=	1.24.0
 gst-sndio_VERSION=	${gst-sndio_GST${_GST_VER}_VERSION}
 
 gst-soundtouch_PORT=	audio/gstreamer${_GST_VER}-plugins-soundtouch
 gst-soundtouch_IMPL=	bad
 
 gst-speex_PORT=		audio/gstreamer${_GST_VER}-plugins-speex
 gst-speex_IMPL=		good
 
 gst-taglib_PORT=	audio/gstreamer${_GST_VER}-plugins-taglib
 gst-taglib_IMPL=	good
 
 gst-twolame_PORT=	audio/gstreamer${_GST_VER}-plugins-twolame
 gst-twolame_IMPL=	ugly
 
 gst-vorbis_PORT=	audio/gstreamer${_GST_VER}-plugins-vorbis
 gst-vorbis_IMPL=	#
 
 gst-wavpack_PORT=	audio/gstreamer${_GST_VER}-plugins-wavpack
 gst-wavpack_IMPL=	good
 
 gst-webrtcdsp_PORT=	audio/gstreamer${_GST_VER}-plugins-webrtcdsp
 gst-webrtcdsp_IMPL=	bad
 
 #==== comms plugin section
 
 gst-spandsp_PORT=	comms/gstreamer${_GST_VER}-plugins-spandsp
 gst-spandsp_IMPL=	bad
 
 #==== devel plugin section
 
 gst-devtools_PORT=	devel/gstreamer${_GST_VER}-devtools
 gst-devtools_SUFFIX=	#
 gst-devtools_IMPL=	#
 
 gst-soup_PORT=		devel/gstreamer${_GST_VER}-plugins-soup
 gst-soup_IMPL=		good
 
 #==== ftp plugin section
 
 gst-curl_PORT=		ftp/gstreamer${_GST_VER}-plugins-curl
 gst-curl_IMPL=		bad
 
 #==== graphics plugin section
 
 gst-aalib_PORT=		graphics/gstreamer${_GST_VER}-plugins-aalib
 gst-aalib_IMPL=		good
 
 gst-cairo_PORT=		graphics/gstreamer${_GST_VER}-plugins-cairo
 gst-cairo_IMPL=		good
 
 gst-gdkpixbuf_PORT=	graphics/gstreamer${_GST_VER}-plugins-gdkpixbuf
 gst-gdkpixbuf_IMPL=	good
 
 gst-gl_PORT=		graphics/gstreamer${_GST_VER}-plugins-gl
 gst-gl_IMPL=		bad
 
 gst-jpeg_PORT=		graphics/gstreamer${_GST_VER}-plugins-jpeg
 gst-jpeg_IMPL=		good
 
 gst-kms_PORT=		graphics/gstreamer${_GST_VER}-plugins-kms
 gst-kms_IMPL=		bad
 
 gst-libcaca_PORT=	graphics/gstreamer${_GST_VER}-plugins-libcaca
 gst-libcaca_IMPL=	good
 
 gst-libvisual_PORT=	graphics/gstreamer${_GST_VER}-plugins-libvisual
 gst-libvisual_IMPL=	#
 
 gst-opencv_PORT=	graphics/gstreamer${_GST_VER}-plugins-opencv
 gst-opencv_IMPL=	bad
 
 gst-openexr_PORT=	graphics/gstreamer${_GST_VER}-plugins-openexr
 gst-openexr_IMPL=	bad
 
 gst-openjpeg_PORT=	graphics/gstreamer${_GST_VER}-plugins-openjpeg
 gst-openjpeg_IMPL=	bad
 
 gst-png_PORT=		graphics/gstreamer${_GST_VER}-plugins-png
 gst-png_IMPL=		good
 
 gst-rsvg_PORT=		graphics/gstreamer${_GST_VER}-plugins-rsvg
 gst-rsvg_IMPL=		bad
 
 gst-vulkan_PORT=	graphics/gstreamer${_GST_VER}-plugins-vulkan
 gst-vulkan_IMPL=	bad
 
 gst-webp_PORT=		graphics/gstreamer${_GST_VER}-plugins-webp
 gst-webp_IMPL=		bad
 
 gst-zbar_PORT=		graphics/gstreamer${_GST_VER}-plugins-zbar
 gst-zbar_IMPL=		bad
 
 #==== multimedia plugins section
 
 gst-aom_PORT=		multimedia/gstreamer${_GST_VER}-plugins-aom
 gst-aom_IMPL=		bad
 
 gst-assrender_PORT=	multimedia/gstreamer${_GST_VER}-plugins-assrender
 gst-assrender_IMPL=	bad
 
 gst-dash_PORT=		multimedia/gstreamer${_GST_VER}-plugins-dash
 gst-dash_IMPL=		bad
 
 gst-dvdread_PORT=	multimedia/gstreamer${_GST_VER}-plugins-dvdread
 gst-dvdread_IMPL=	ugly
 
 gst-dts_PORT=		multimedia/gstreamer${_GST_VER}-plugins-dts
 gst-dts_IMPL=		bad
 
 gst-dv_PORT=		multimedia/gstreamer${_GST_VER}-plugins-dv
 gst-dv_IMPL=		good
 
 gst-editing-services_PORT=	multimedia/gstreamer${_GST_VER}-editing-services
 gst-editing-services_SUFFIX=	#
 gst-editing-services_IMPL=	#
 
 gst-hls_PORT=		multimedia/gstreamer${_GST_VER}-plugins-hls
 gst-hls_IMPL=		bad
 
 gst-libav_PORT=		multimedia/gstreamer${_GST_VER}-libav
 gst-libav_SUFFIX=	#
 gst-libav_IMPL=		#
 
 gst-libde265_PORT=	multimedia/gstreamer${_GST_VER}-plugins-libde265
 gst-libde265_IMPL=	bad
 
 gst-mm_PORT=		multimedia/gstreamermm
 gst-mm_PREFIX=		gstreamer
 gst-mm_SUFFIX=		#
 gst-mm_IMPL=		#
 gst-mm_GST1_VERSION=	1.10.0
 gst-mm_VERSION=		${gst-mm_GST${_GST_VER}_VERSION}
 
 gst-mpeg2dec_PORT=	multimedia/gstreamer${_GST_VER}-plugins-mpeg2dec
 gst-mpeg2dec_IMPL=	ugly
 
 gst-mpeg2enc_PORT=	multimedia/gstreamer${_GST_VER}-plugins-mpeg2enc
 gst-mpeg2enc_IMPL=	bad
 
 gst-mplex_PORT=		multimedia/gstreamer${_GST_VER}-plugins-mplex
 gst-mplex_IMPL=		bad
 
 gst-msdk_PORT=		multimedia/gstreamer${_GST_VER}-plugins-msdk
 gst-msdk_IMPL=		bad
 
 gst-openh264_PORT=	multimedia/gstreamer${_GST_VER}-plugins-openh264
 gst-openh264_IMPL=	bad
 
 gst-resindvd_PORT=	multimedia/gstreamer${_GST_VER}-plugins-resindvd
 gst-resindvd_IMPL=	bad
 
 gst-rtsp-server_PORT=	multimedia/gstreamer${_GST_VER}-rtsp-server
 gst-rtsp-server_SUFFIX=	#
 gst-rtsp-server_IMPL=	#
 
 gst-rust_PORT=		multimedia/gstreamer${_GST_VER}-plugins-rust
 gst-rust_IMPL=		#
 gst-rust_GST1_VERSION=	0.15.2
 gst-rust_VERSION=	${gst-rust_GST${_GST_VER}_VERSION}
 
 gst-smoothstreaming_PORT=	multimedia/gstreamer${_GST_VER}-plugins-smoothstreaming
 gst-smoothstreaming_IMPL=	bad
 
 gst-svtav1_PORT=	multimedia/gstreamer${_GST_VER}-plugins-svt-av1
 gst-svtav1_IMPL=	bad
 
 gst-theora_PORT=	multimedia/gstreamer${_GST_VER}-plugins-theora
 gst-theora_IMPL=	#
 
 gst-ttml_PORT=		multimedia/gstreamer${_GST_VER}-plugins-ttml
 gst-ttml_IMPL=		bad
 
 gst-v4l2_PORT=		multimedia/gstreamer${_GST_VER}-plugins-v4l2
 gst-v4l2_IMPL=		good
 
 gst-vpx_PORT=		multimedia/gstreamer${_GST_VER}-plugins-vpx
 gst-vpx_IMPL=		good
 
 gst-webrtc_PORT=	multimedia/gstreamer${_GST_VER}-plugins-webrtc
 gst-webrtc_IMPL=	bad
 
 gst-x264_PORT=		multimedia/gstreamer${_GST_VER}-plugins-x264
 gst-x264_IMPL=		ugly
 
 gst-x265_PORT=		multimedia/gstreamer${_GST_VER}-plugins-x265
 gst-x265_IMPL=		bad
 
 #==== net plugins section
 
 gst-sctp_PORT=		net/gstreamer${_GST_VER}-plugins-sctp
 gst-sctp_IMPL=		bad
 
 gst-srtp_PORT=		net/gstreamer${_GST_VER}-plugins-srtp
 gst-srtp_IMPL=		bad
 
 #==== security plugins section
 
 gst-dtls_PORT=		security/gstreamer${_GST_VER}-plugins-dtls
 gst-dtls_IMPL=		bad
 
 #==== sysutils plugins section
 
 gst-cdio_PORT=		sysutils/gstreamer${_GST_VER}-plugins-cdio
 gst-cdio_IMPL=		ugly
 
 #==== textproc plugins section
 
 gst-zxing_PORT=		textproc/gstreamer${_GST_VER}-plugins-zxing
 gst-zxing_IMPL=		bad
 
 #==== www plugins section
 
 gst-neon_PORT=		www/gstreamer${_GST_VER}-plugins-neon
 gst-neon_IMPL=		bad
 
 gst-srt_PORT=		www/gstreamer${_GST_VER}-plugins-srt
 gst-srt_IMPL=		bad
 
 #==== x11 plugins section
 
 gst-x_PORT=		x11/gstreamer${_GST_VER}-plugins-x
 gst-x_IMPL=		#
 
 gst-ximagesrc_PORT=	x11/gstreamer${_GST_VER}-plugins-ximagesrc
 gst-ximagesrc_IMPL=	good
 
 #==== x11-toolkits plugins section
 
 gst-gtk_PORT=		x11-toolkits/gstreamer${_GST_VER}-plugins-gtk
 gst-gtk_IMPL=		bad
 
 gst-pango_PORT=		x11-toolkits/gstreamer${_GST_VER}-plugins-pango
 gst-pango_IMPL=		#
 
 gst-qt5_PORT=		x11-toolkits/gstreamer${_GST_VER}-plugins-qt5
 gst-qt5_IMPL=		good
 
 gst-qt6_PORT=		x11-toolkits/gstreamer${_GST_VER}-plugins-qt6
 gst-qt6_IMPL=		good
 
 #== Dependency creation
 
 .  if empty(gstreamer_ARGS:M_internal)
 _GST_BR_DEPENDS=	#
 _GST_LIB_DEPENDS=	#
 
 USE_GSTREAMER?=		#
 # everything wants this
 USE_GSTREAMER+=		libgstreamer
 .    if ${PORTDIRNAME} != gstreamer${_GST_VER}-plugins
 USE_GSTREAMER+=		plugins
 .    endif
 
 # Gather all Impl values
 _GST_IMPL_LIST:=	${USE_GSTREAMER:S/^/\${gst-/:S/$/_IMPL}/}
 
 # Combine the wanted copmonents and the required implementations
 _USE_GSTREAMER=		${USE_GSTREAMER} \
 			${_GST_IMPL_LIST}
 
 .    for component in ${_USE_GSTREAMER:O:u}
 # Fill in the common default component values
 gst-${component}_VERSION?=	${_GST_VERSION}
 gst-${component}_NAME?=		${component}
 gst-${component}_PREFIX?=	gstreamer${_GST_VER}-
 gst-${component}_SUFFIX?=	plugins-
 gst-${component}_PKG?=		${gst-${component}_PREFIX}${gst-${component}_SUFFIX}${gst-${component}_NAME}
 
 .      if empty(_USE_GSTREAMER_ALL:M${component})
 IGNORE=	unknown gstreamer component '${component}' for gstreamer:${_GST_VER}
 .      endif
 .      if !empty(gst-${component}_LIB)
 _GST_LIB_DEPENDS+=	${gst-${component}_LIB}:${gst-${component}_PORT}
 .      else
 _GST_BR_DEPENDS+=	${gst-${component}_PKG}>=${gst-${component}_VERSION}:${gst-${component}_PORT}
 .      endif
 .    endfor
 
 LIB_DEPENDS+=	${_GST_LIB_DEPENDS:O:u}
 BUILD_DEPENDS+=	${_GST_BR_DEPENDS:O:u}
 RUN_DEPENDS+=	${_GST_BR_DEPENDS:O:u}
 
 .  endif
 .endif
diff --git a/devel/gstreamer1-devtools/distinfo b/devel/gstreamer1-devtools/distinfo
index 88a26c9283aa..a211ca5b0303 100644
--- a/devel/gstreamer1-devtools/distinfo
+++ b/devel/gstreamer1-devtools/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1779386133
-SHA256 (gst-devtools-1.28.3.tar.xz) = 2b558e3fd9a8a2d4ebad65119753340842bc80ceefb7b7c145843853221fc731
-SIZE (gst-devtools-1.28.3.tar.xz) = 1637076
+TIMESTAMP = 1781903663
+SHA256 (gst-devtools-1.28.4.tar.xz) = 11d4f1188639d3a9762039065bbb7b2c309b7a8ecc6fa4aed12245568bf00db3
+SIZE (gst-devtools-1.28.4.tar.xz) = 1640224
diff --git a/multimedia/gstreamer1-editing-services/distinfo b/multimedia/gstreamer1-editing-services/distinfo
index a3a3962fb5d5..57d04d56e064 100644
--- a/multimedia/gstreamer1-editing-services/distinfo
+++ b/multimedia/gstreamer1-editing-services/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1779386127
-SHA256 (gst-editing-services-1.28.3.tar.xz) = 07a7dabffbc23bf201daec3b463857f93ff5ba3a8f2766abf88587fd1b27dacb
-SIZE (gst-editing-services-1.28.3.tar.xz) = 861332
+TIMESTAMP = 1781903662
+SHA256 (gst-editing-services-1.28.4.tar.xz) = 6f7eb55e58718dde5b5869f619ed90ebf3b0cfa0376c169c1b83fc773811914a
+SIZE (gst-editing-services-1.28.4.tar.xz) = 864100
diff --git a/multimedia/gstreamer1-libav/distinfo b/multimedia/gstreamer1-libav/distinfo
index 58cd18049cc3..da5e5903397c 100644
--- a/multimedia/gstreamer1-libav/distinfo
+++ b/multimedia/gstreamer1-libav/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1779386128
-SHA256 (gst-libav-1.28.3.tar.xz) = 28fcd45d9ace261d4bda896466d5326af6efd2fcf0a20f24502094b5a9955bdf
-SIZE (gst-libav-1.28.3.tar.xz) = 210768
+TIMESTAMP = 1781903662
+SHA256 (gst-libav-1.28.4.tar.xz) = bd17a5df2874a7a58bcbaf7b940223379ad9613624db8ead783db03e74bb904b
+SIZE (gst-libav-1.28.4.tar.xz) = 213672
diff --git a/multimedia/gstreamer1-plugins-bad/files/patch-git_3833dd7 b/multimedia/gstreamer1-plugins-bad/files/patch-git_3833dd7
new file mode 100644
index 000000000000..85941d9c1624
--- /dev/null
+++ b/multimedia/gstreamer1-plugins-bad/files/patch-git_3833dd7
@@ -0,0 +1,77 @@
+From 3833dd745ef7b1cd5f699c90897ecca3ef09c59b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Tue, 16 Jun 2026 09:30:00 +0300
+Subject: [PATCH] pcapparse: Add missing bounds checks to ensure packets are
+ large enough
+
+Patch based on a patch by Junyi Liu, who also reported this.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5106
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11867>
+---
+ .../gst/pcapparse/gstpcapparse.c               | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/subprojects/gst-plugins-bad/gst/pcapparse/gstpcapparse.c b/subprojects/gst-plugins-bad/gst/pcapparse/gstpcapparse.c
+index 4f0c77292a3..6e546c8e3ec 100644
+--- gst/pcapparse/gstpcapparse.c.orig
++++ gst/pcapparse/gstpcapparse.c
+@@ -354,6 +354,7 @@ gst_pcap_parse_read_uint32 (GstPcapParse * self, const guint8 * p)
+ #define SLL2_HEADER_LEN    20
+ #define IP_HEADER_MIN_LEN 20
+ #define UDP_HEADER_LEN     8
++#define TCP_HEADER_MIN_LEN 20
+ 
+ #define IP_PROTO_UDP      17
+ #define IP_PROTO_TCP      6
+@@ -438,7 +439,8 @@ gst_pcap_parse_scan_frame (GstPcapParse * self,
+     return FALSE;
+ 
+   ip_header_size = (b & 0x0f) * 4;
+-  if (buf_ip + ip_header_size > buf + buf_size)
++  if (ip_header_size < IP_HEADER_MIN_LEN ||
++      buf_ip + ip_header_size > buf + buf_size)
+     return FALSE;
+ 
+   flags = buf_ip[6] >> 5;
+@@ -460,6 +462,11 @@ gst_pcap_parse_scan_frame (GstPcapParse * self,
+   memcpy (&ip_dst_addr, buf_ip + 16, sizeof (ip_dst_addr));
+   buf_proto = buf_ip + ip_header_size;
+   ip_packet_len = GUINT16_FROM_BE (*(guint16 *) (buf_ip + 2));
++  if (ip_packet_len < ip_header_size)
++    return FALSE;
++
++  if (buf_proto + 4 > buf + buf_size)
++    return FALSE;
+ 
+   /* ok for tcp and udp */
+   src_port = GUINT16_FROM_BE (*((guint16 *) (buf_proto + 0)));
+@@ -467,6 +474,8 @@ gst_pcap_parse_scan_frame (GstPcapParse * self,
+ 
+   /* extract some params and data according to protocol */
+   if (ip_protocol == IP_PROTO_UDP) {
++    if (buf_proto + 6 > buf + buf_size)
++      return FALSE;
+     len = GUINT16_FROM_BE (*((guint16 *) (buf_proto + 4)));
+     if (len < UDP_HEADER_LEN || buf_proto + len > buf + buf_size)
+       return FALSE;
+@@ -474,10 +483,13 @@ gst_pcap_parse_scan_frame (GstPcapParse * self,
+     *payload = buf_proto + UDP_HEADER_LEN;
+     *payload_size = len - UDP_HEADER_LEN;
+   } else {
+-    if (buf_proto + 12 >= buf + buf_size)
++    if (buf_proto + 13 > buf + buf_size)
+       return FALSE;
+     len = (buf_proto[12] >> 4) * 4;
+-    if (buf_proto + len > buf + buf_size)
++    if (len < TCP_HEADER_MIN_LEN || buf_proto + len > buf + buf_size)
++      return FALSE;
++    if (ip_packet_len < ip_header_size + len ||
++        buf_ip + ip_packet_len > buf + buf_size)
+       return FALSE;
+ 
+     /* all remaining data following tcp header is payload */
+-- 
+GitLab
+
diff --git a/multimedia/gstreamer1-plugins-bad/files/patch-git_6c14677 b/multimedia/gstreamer1-plugins-bad/files/patch-git_6c14677
new file mode 100644
index 000000000000..c95f4f957f88
--- /dev/null
+++ b/multimedia/gstreamer1-plugins-bad/files/patch-git_6c14677
@@ -0,0 +1,101 @@
+From 6c146775d784bbe91ff7afc6701ba351306282ce Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Tue, 16 Jun 2026 10:30:54 +0300
+Subject: [PATCH] vnmdec: Avoid integer overflows when rectangle positions and
+ sizes
+
+Patch based on a patch by Junyi Liu, who also reported this.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5107
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11869>
+---
+ .../gst-plugins-bad/gst/vmnc/vmncdec.c        | 39 +++++++++++++++----
+ 1 file changed, 31 insertions(+), 8 deletions(-)
+
+diff --git a/subprojects/gst-plugins-bad/gst/vmnc/vmncdec.c b/subprojects/gst-plugins-bad/gst/vmnc/vmncdec.c
+index e6e52af9a11..32dd3978930 100644
+--- gst/vmnc/vmncdec.c.orig
++++ gst/vmnc/vmncdec.c
+@@ -155,6 +155,20 @@ struct RfbRectangle
+ typedef int (*rectangle_handler) (GstVMncDec * dec, struct RfbRectangle * rect,
+     const guint8 * data, int len, gboolean decode);
+ 
++static gboolean
++vmnc_rect_payload_size (struct RfbRectangle *rect, guint bytes_per_pixel,
++    gsize * size)
++{
++  gsize pixels;
++
++  if (!g_size_checked_mul (&pixels, rect->width, rect->height))
++    return FALSE;
++  if (!g_size_checked_mul (size, pixels, bytes_per_pixel))
++    return FALSE;
++
++  return TRUE;
++}
++
+ static int
+ vmnc_handle_wmvi_rectangle (GstVMncDec * dec, struct RfbRectangle *rect,
+     const guint8 * data, int len, gboolean decode)
+@@ -395,7 +409,8 @@ vmnc_handle_wmvd_rectangle (GstVMncDec * dec, struct RfbRectangle *rect,
+ {
+   /* Cursor data. */
+   int datalen = 2;
+-  int type, size;
++  int type;
++  gsize size;
+ 
+   if (len < datalen) {
+     GST_LOG_OBJECT (dec, "Cursor data too short");
+@@ -405,9 +420,19 @@ vmnc_handle_wmvd_rectangle (GstVMncDec * dec, struct RfbRectangle *rect,
+   type = RFB_GET_UINT8 (data);
+ 
+   if (type == CURSOR_COLOUR) {
+-    datalen += rect->width * rect->height * dec->format.bytes_per_pixel * 2;
++    if (!vmnc_rect_payload_size (rect, dec->format.bytes_per_pixel, &size) ||
++        size > ((gsize) G_MAXINT - datalen) / 2) {
++      GST_WARNING_OBJECT (dec, "Cursor data size overflow");
++      return ERROR_INVALID;
++    }
++    datalen += size * 2;
+   } else if (type == CURSOR_ALPHA) {
+-    datalen += rect->width * rect->height * 4;
++    if (!vmnc_rect_payload_size (rect, 4, &size) ||
++        size > (gsize) G_MAXINT - datalen) {
++      GST_WARNING_OBJECT (dec, "Cursor data size overflow");
++      return ERROR_INVALID;
++    }
++    datalen += size;
+   } else {
+     GST_WARNING_OBJECT (dec, "Unknown cursor type: %d", type);
+     return ERROR_INVALID;
+@@ -422,22 +447,20 @@ vmnc_handle_wmvd_rectangle (GstVMncDec * dec, struct RfbRectangle *rect,
+   dec->cursor.type = type;
+   dec->cursor.width = rect->width;
+   dec->cursor.height = rect->height;
+-  dec->cursor.type = type;
+   dec->cursor.hot_x = rect->x;
+   dec->cursor.hot_y = rect->y;
+ 
+   g_free (dec->cursor.cursordata);
+   g_free (dec->cursor.cursormask);
+ 
+-  if (type == 0) {
+-    size = rect->width * rect->height * dec->format.bytes_per_pixel;
++  if (type == CURSOR_COLOUR) {
+     dec->cursor.cursordata = g_malloc (size);
+     dec->cursor.cursormask = g_malloc (size);
+     memcpy (dec->cursor.cursordata, data + 2, size);
+     memcpy (dec->cursor.cursormask, data + 2 + size, size);
+   } else {
+-    dec->cursor.cursordata = g_malloc (rect->width * rect->height * 4);
+-    memcpy (dec->cursor.cursordata, data + 2, rect->width * rect->height * 4);
++    dec->cursor.cursordata = g_malloc (size);
++    memcpy (dec->cursor.cursordata, data + 2, size);
+     dec->cursor.cursormask = NULL;
+   }
+ 
+-- 
+GitLab
+
diff --git a/multimedia/gstreamer1-plugins-bad/files/patch-git_8c6d4df b/multimedia/gstreamer1-plugins-bad/files/patch-git_8c6d4df
new file mode 100644
index 000000000000..e8c7ce8c2180
--- /dev/null
+++ b/multimedia/gstreamer1-plugins-bad/files/patch-git_8c6d4df
@@ -0,0 +1,31 @@
+From 8c6d4df57b531c7b41a5f3bce28d2c7bc98a1d3d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Tue, 16 Jun 2026 15:23:13 +0300
+Subject: [PATCH] h264parse: Check for enough slice header data being available
+
+Patch provided by Ramesh Adhikari, who also reported this.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5108
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11938>
+---
+ subprojects/gst-plugins-bad/gst/videoparsers/gsth264parse.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/subprojects/gst-plugins-bad/gst/videoparsers/gsth264parse.c b/subprojects/gst-plugins-bad/gst/videoparsers/gsth264parse.c
+index 8bbddb07239..1b97678993f 100644
+--- gst/videoparsers/gsth264parse.c.orig
++++ gst/videoparsers/gsth264parse.c
+@@ -1129,7 +1129,8 @@ gst_h264_parse_process_nal (GstH264Parse * h264parse, GstH264NalUnit * nalu)
+       h264parse->picture_start = TRUE;
+ 
+       /* don't need to parse the whole slice (header) here */
+-      if (*(nalu->data + nalu->offset + nalu->header_bytes) & 0x80) {
++      if (nalu->size > nalu->header_bytes &&
++          *(nalu->data + nalu->offset + nalu->header_bytes) & 0x80) {
+         /* means first_mb_in_slice == 0 */
+         /* real frame data */
+         GST_DEBUG_OBJECT (h264parse, "first_mb_in_slice = 0");
+-- 
+GitLab
+
diff --git a/multimedia/gstreamer1-plugins-bad/files/patch-git_eec42c2 b/multimedia/gstreamer1-plugins-bad/files/patch-git_eec42c2
new file mode 100644
index 000000000000..da25597b7fb7
--- /dev/null
+++ b/multimedia/gstreamer1-plugins-bad/files/patch-git_eec42c2
@@ -0,0 +1,37 @@
+From eec42c2fedda888085d3356b3a5af1ada86f5746 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Wed, 17 Jun 2026 10:03:36 +0300
+Subject: [PATCH] h266parser: Check aspect ratio index against lookup table
+ length
+
+Patch provided by Ramesh Adhikari, who also reported this.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5109
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11939>
+---
+ .../gst-libs/gst/codecparsers/gsth266parser.c               | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth266parser.c b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth266parser.c
+index ba8cc2fcc91..747227c7435 100644
+--- gst-libs/gst/codecparsers/gsth266parser.c.orig
++++ gst-libs/gst/codecparsers/gsth266parser.c
+@@ -558,9 +558,13 @@ gst_h266_parse_vui_parameters (GstH266VUIParams * vui, NalReader * nr)
+       READ_UINT16 (nr, vui->sar_height, 16);
+       vui->par_n = vui->sar_width;
+       vui->par_d = vui->sar_height;
+-    } else {
++    } else if (vui->aspect_ratio_idc <= 16) {
+       vui->par_n = aspect_ratios[vui->aspect_ratio_idc].par_n;
+       vui->par_d = aspect_ratios[vui->aspect_ratio_idc].par_d;
++    } else {
++      GST_WARNING ("Invalid bitstream: aspect_ratio_idc set "
++          "to value %d (must be 0-16 or %d)",
++          vui->aspect_ratio_idc, EXTENDED_SAR);
+     }
+   } else {
+     vui->aspect_ratio_constant_flag = 0;
+-- 
+GitLab
+
diff --git a/multimedia/gstreamer1-plugins-bad/files/patch-git_f3b6692 b/multimedia/gstreamer1-plugins-bad/files/patch-git_f3b6692
new file mode 100644
index 000000000000..6da58bb99e74
--- /dev/null
+++ b/multimedia/gstreamer1-plugins-bad/files/patch-git_f3b6692
@@ -0,0 +1,237 @@
+From f3b66928a194b32b27fac3c3379d3d20e5966442 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Sun, 14 Jun 2026 22:03:25 +0300
+Subject: [PATCH] librfb: Validate framebuffer update rectangles against the
+ framebuffer size
+
+Patch provided by Junyi Liu, who also reported this.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5105
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11866>
+---
+ .../gst-plugins-bad/gst/librfb/rfbdecoder.c   | 136 +++++++++++++++---
+ 1 file changed, 115 insertions(+), 21 deletions(-)
+
+diff --git a/subprojects/gst-plugins-bad/gst/librfb/rfbdecoder.c b/subprojects/gst-plugins-bad/gst/librfb/rfbdecoder.c
+index f0507a36f46..7f94a28d319 100644
+--- gst/librfb/rfbdecoder.c.orig
++++ gst/librfb/rfbdecoder.c
+@@ -45,6 +45,10 @@ static gboolean rfb_decoder_corre_encoding (RfbDecoder * decoder, gint start_x,
+     gint start_y, gint rect_w, gint rect_h);
+ static gboolean rfb_decoder_hextile_encoding (RfbDecoder * decoder,
+     gint start_x, gint start_y, gint rect_w, gint rect_h);
++static gboolean rfb_decoder_clip_rectangle (RfbDecoder * decoder, gint * x,
++    gint * y, gint * w, gint * h, gint * skip_x, gint * skip_y);
++static gboolean rfb_decoder_clip_copyrect (RfbDecoder * decoder, gint * dst_x,
++    gint * dst_y, gint * src_x, gint * src_y, gint * w, gint * h);
+ 
+ RfbDecoder *
+ rfb_decoder_new (void)
+@@ -802,23 +806,20 @@ rfb_decoder_state_framebuffer_update_rectangle (RfbDecoder * decoder)
+   if (!rfb_decoder_read (decoder, 12))
+     return FALSE;
+ 
+-  x = RFB_GET_UINT16 (decoder->data + 0) - decoder->offset_x;
+-  y = RFB_GET_UINT16 (decoder->data + 2) - decoder->offset_y;
++  x = RFB_GET_UINT16 (decoder->data + 0);
++  y = RFB_GET_UINT16 (decoder->data + 2);
+   w = RFB_GET_UINT16 (decoder->data + 4);
+   h = RFB_GET_UINT16 (decoder->data + 6);
+   encoding = RFB_GET_UINT32 (decoder->data + 8);
+ 
++  x -= (gint) decoder->offset_x;
++  y -= (gint) decoder->offset_y;
++
+   GST_DEBUG ("update received");
+   GST_DEBUG ("x:%d y:%d", x, y);
+   GST_DEBUG ("w:%d h:%d", w, h);
+   GST_DEBUG ("encoding: %d", encoding);
+ 
+-  if (((w * h) + (x * y)) > (decoder->width * decoder->height)) {
+-    GST_ERROR ("Desktop resize is unsupported.");
+-    decoder->state = NULL;
+-    return TRUE;
+-  }
+-
+   switch (encoding) {
+     case ENCODING_TYPE_RAW:
+       ret = rfb_decoder_raw_encoding (decoder, x, y, w, h);
+@@ -857,11 +858,20 @@ static gboolean
+ rfb_decoder_raw_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
+     gint rect_w, gint rect_h)
+ {
+-  gint size;
++  gint copy_x, copy_y, copy_w, copy_h;
++  gint skip_x = 0, skip_y = 0;
++  guint32 size;
+   guint8 *frame, *p;
+   guint32 raw_line_size;
++  guint32 copy_line_size;
++
++  if (rect_w <= 0 || rect_h <= 0)
++    return TRUE;
+ 
+   raw_line_size = rect_w * decoder->bytespp;
++  if (rect_h > 0 && raw_line_size > G_MAXUINT32 / rect_h)
++    return FALSE;
++
+   size = rect_h * raw_line_size;
+ 
+   GST_DEBUG ("Reading %d bytes (%dx%d)", size, rect_w, rect_h);
+@@ -869,13 +879,23 @@ rfb_decoder_raw_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
+   if (!rfb_decoder_read (decoder, size))
+     return FALSE;
+ 
++  copy_x = start_x;
++  copy_y = start_y;
++  copy_w = rect_w;
++  copy_h = rect_h;
++
++  if (!rfb_decoder_clip_rectangle (decoder, &copy_x, &copy_y, &copy_w, &copy_h,
++          &skip_x, &skip_y))
++    return TRUE;
++
+   frame =
+-      decoder->frame + (((start_y * decoder->rect_width) +
+-          start_x) * decoder->bytespp);
+-  p = decoder->data;
++      decoder->frame + (((copy_y * decoder->rect_width) +
++          copy_x) * decoder->bytespp);
++  p = decoder->data + (skip_y * raw_line_size) + (skip_x * decoder->bytespp);
++  copy_line_size = copy_w * decoder->bytespp;
+ 
+-  while (rect_h--) {
+-    memcpy (frame, p, raw_line_size);
++  while (copy_h--) {
++    memcpy (frame, p, copy_line_size);
+     p += raw_line_size;
+     frame += decoder->line_size;
+   }
+@@ -887,7 +907,8 @@ static gboolean
+ rfb_decoder_copyrect_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
+     gint rect_w, gint rect_h)
+ {
+-  guint16 src_x, src_y;
++  gint src_x, src_y;
++  gint copy_x, copy_y, copy_w, copy_h;
+   gint line_width, copyrect_width;
+   guint8 *src, *dst;
+ 
+@@ -895,20 +916,28 @@ rfb_decoder_copyrect_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
+     return FALSE;
+ 
+   /* don't forget the offset */
+-  src_x = RFB_GET_UINT16 (decoder->data) - decoder->offset_x;
+-  src_y = RFB_GET_UINT16 (decoder->data + 2) - decoder->offset_y;
++  src_x = RFB_GET_UINT16 (decoder->data) - (gint) decoder->offset_x;
++  src_y = RFB_GET_UINT16 (decoder->data + 2) - (gint) decoder->offset_y;
+   GST_DEBUG ("Copyrect from %d %d", src_x, src_y);
+ 
+-  copyrect_width = rect_w * decoder->bytespp;
++  copy_x = start_x;
++  copy_y = start_y;
++  copy_w = rect_w;
++  copy_h = rect_h;
++  if (!rfb_decoder_clip_copyrect (decoder, &copy_x, &copy_y, &src_x, &src_y,
++          &copy_w, &copy_h))
++    return TRUE;
++
++  copyrect_width = copy_w * decoder->bytespp;
+   line_width = decoder->line_size;
+   src =
+       decoder->prev_frame + ((src_y * decoder->rect_width) +
+       src_x) * decoder->bytespp;
+   dst =
+-      decoder->frame + ((start_y * decoder->rect_width) +
+-      start_x) * decoder->bytespp;
++      decoder->frame + ((copy_y * decoder->rect_width) +
++      copy_x) * decoder->bytespp;
+ 
+-  while (rect_h--) {
++  while (copy_h--) {
+     memcpy (dst, src, copyrect_width);
+     src += line_width;
+     dst += line_width;
+@@ -926,6 +955,9 @@ rfb_decoder_fill_rectangle (RfbDecoder * decoder, gint x, gint y, gint w,
+   guint32 *offset;
+   gint i, j;
+ 
++  if (!rfb_decoder_clip_rectangle (decoder, &x, &y, &w, &h, NULL, NULL))
++    return;
++
+   for (i = 0; i < h; i++) {
+     offset =
+         (guint32 *) (decoder->frame + ((x + (y +
+@@ -1101,6 +1133,68 @@ rfb_decoder_hextile_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
+   return TRUE;
+ }
+ 
++static gboolean
++rfb_decoder_clip_rectangle (RfbDecoder * decoder, gint * x, gint * y, gint * w,
++    gint * h, gint * skip_x, gint * skip_y)
++{
++  gint x1, y1, x2, y2;
++  gint orig_x, orig_y;
++
++  if (*w <= 0 || *h <= 0)
++    return FALSE;
++
++  orig_x = *x;
++  orig_y = *y;
++  x1 = MAX (orig_x, 0);
++  y1 = MAX (orig_y, 0);
++  x2 = MIN (orig_x + *w, (gint) decoder->rect_width);
++  y2 = MIN (orig_y + *h, (gint) decoder->rect_height);
++
++  if (x2 <= x1 || y2 <= y1)
++    return FALSE;
++
++  *x = x1;
++  *y = y1;
++  *w = x2 - x1;
++  *h = y2 - y1;
++
++  if (skip_x)
++    *skip_x = x1 - orig_x;
++  if (skip_y)
++    *skip_y = y1 - orig_y;
++
++  return TRUE;
++}
++
++static gboolean
++rfb_decoder_clip_copyrect (RfbDecoder * decoder, gint * dst_x, gint * dst_y,
++    gint * src_x, gint * src_y, gint * w, gint * h)
++{
++  gint left, top, right, bottom;
++
++  if (*w <= 0 || *h <= 0)
++    return FALSE;
++
++  left = MAX (0, MAX (-*dst_x, -*src_x));
++  top = MAX (0, MAX (-*dst_y, -*src_y));
++  right = MIN (*w, MIN ((gint) decoder->rect_width - *dst_x,
++          (gint) decoder->rect_width - *src_x));
++  bottom = MIN (*h, MIN ((gint) decoder->rect_height - *dst_y,
++          (gint) decoder->rect_height - *src_y));
++
++  if (right <= left || bottom <= top)
++    return FALSE;
++
++  *dst_x += left;
++  *dst_y += top;
++  *src_x += left;
++  *src_y += top;
++  *w = right - left;
++  *h = bottom - top;
++
++  return TRUE;
++}
++
+ static gboolean
+ rfb_decoder_state_set_colour_map_entries (RfbDecoder * decoder)
+ {
+-- 
+GitLab
+
diff --git a/multimedia/gstreamer1-plugins/distinfo b/multimedia/gstreamer1-plugins/distinfo
index d965fcd30ad5..94b3717c6bac 100644
--- a/multimedia/gstreamer1-plugins/distinfo
+++ b/multimedia/gstreamer1-plugins/distinfo
@@ -1,9 +1,9 @@
-TIMESTAMP = 1779386147
-SHA256 (gst-plugins-base-1.28.3.tar.xz) = 27880f3d87efa3bb5aa5f99f7ef6e4be7c95229f44eee928c1633d32e87d0099
-SIZE (gst-plugins-base-1.28.3.tar.xz) = 2537504
-SHA256 (gst-plugins-bad-1.28.3.tar.xz) = 4213f43ddb875bb141e5040e97735579d74665bec3d17b51052aade395b83f00
-SIZE (gst-plugins-bad-1.28.3.tar.xz) = 8003472
-SHA256 (gst-plugins-ugly-1.28.3.tar.xz) = 0c04763200467b9b61a916b33646a6916a97cc9869d8b6dca57427b1f2734dee
-SIZE (gst-plugins-ugly-1.28.3.tar.xz) = 234348
-SHA256 (gst-plugins-good-1.28.3.tar.xz) = 47f78f500cbd900f758f9ba74288fda0e2ca5a7855096025641e121ffec40a5d
-SIZE (gst-plugins-good-1.28.3.tar.xz) = 5986464
+TIMESTAMP = 1781903664
+SHA256 (gst-plugins-base-1.28.4.tar.xz) = a898afd5766172b0049e6781558e0689098bf87b9d82b846c652e571c01d60d8
+SIZE (gst-plugins-base-1.28.4.tar.xz) = 2543124
+SHA256 (gst-plugins-bad-1.28.4.tar.xz) = 332b7320f30c60f2d5941446d03b9d05e3781f2c2561befbe88718bd777f0e47
+SIZE (gst-plugins-bad-1.28.4.tar.xz) = 8008632
+SHA256 (gst-plugins-ugly-1.28.4.tar.xz) = 5486cd145c5af43259fd37caca59d048e2a67ddb07082ea8f50ef0f02a85f8a5
+SIZE (gst-plugins-ugly-1.28.4.tar.xz) = 238056
+SHA256 (gst-plugins-good-1.28.4.tar.xz) = c825ea737c59cea0e4a0c41da2388045ff5dd32d162220ac93a7a82ee4a04e61
+SIZE (gst-plugins-good-1.28.4.tar.xz) = 5990568
diff --git a/multimedia/gstreamer1-rtsp-server/distinfo b/multimedia/gstreamer1-rtsp-server/distinfo
index a964d010d4f0..674aa375be83 100644
--- a/multimedia/gstreamer1-rtsp-server/distinfo
+++ b/multimedia/gstreamer1-rtsp-server/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1779386129
-SHA256 (gst-rtsp-server-1.28.3.tar.xz) = 9379585ea9d30a00811f4590760208d3412e2ea6dbd9562b07fba6872f275664
-SIZE (gst-rtsp-server-1.28.3.tar.xz) = 294312
+TIMESTAMP = 1781903662
+SHA256 (gst-rtsp-server-1.28.4.tar.xz) = bfb6780542bf0d402736232aeae6c5a1b943c445775bf40305bcb86ca70705a0
+SIZE (gst-rtsp-server-1.28.4.tar.xz) = 297068
diff --git a/multimedia/gstreamer1/Makefile b/multimedia/gstreamer1/Makefile
index 69a4c5f2d297..075eb502772b 100644
--- a/multimedia/gstreamer1/Makefile
+++ b/multimedia/gstreamer1/Makefile
@@ -1,74 +1,112 @@
 PORTNAME=	gstreamer
 PORTVERSION=	${_GST_VERSION}
-PORTREVISION=	3
 CATEGORIES=	multimedia
 MASTER_SITES=	https://gstreamer.freedesktop.org/src/gstreamer/
 PKGNAMESUFFIX=	1
 
 MAINTAINER=	multimedia@FreeBSD.org
 COMMENT=	Media applications framework
 WWW=		https://gstreamer.freedesktop.org/
 
 LICENSE=	LGPL20+
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 LIB_DEPENDS=	libunwind.so:devel/libunwind
 
 USES=		bison gnome gstreamer:_internal meson ninja \
 		pkgconfig python:build shebangfix tar:xz
 USE_GNOME=	glib20 introspection:build
 USE_GSTREAMER=	#
 USE_LDCONFIG=	yes
 
 SHEBANG_FILES=	docs/gst-plugins-doc-cache-generator.py \
 		gst/parse/get_flex_version.py \
 		scripts/extract-release-date-from-doap-file.py \
 
 MESON_ARGS=	-D dbghelp=disabled \
 		-D doc=disabled \
 		-D examples=disabled \
 		-D libdw=disabled \
 		-D tests=disabled
 
 PORTSCOUT=	limitw:1,even
 
 PLIST_SUB=	SOVERSION=${_GST_SOVERSION} \
 		VERSION=${_GST_LIB_VER}
 
 OPTIONS_DEFINE=		BASH NLS
 OPTIONS_DEFAULT=	BASH
 # The PTP helper requires Rust since GStreamer 1.24.0, so only enable it on
 # platforms that have Rust support.
 .for arch in aarch64 amd64 armv7 i386 powerpc64 powerpc64le powerpc riscv64
 OPTIONS_DEFINE_${arch}=	PTP
 OPTIONS_DEFAULT_${arch}=PTP
 .endfor
 OPTIONS_SUB=		yes
 
 BASH_BUILD_DEPENDS=	bash-completion>0:shells/bash-completion
 BASH_MESON_ENABLED=	bash-completion
 
 NLS_USES=		gettext
 NLS_MESON_ENABLED=	nls
 
 PTP_DESC=		Precision Time Protocol support
 PTP_BUILD_DEPENDS=	rustc:lang/rust
 PTP_MESON_ENABLED=	ptp-helper
 
 .include <bsd.port.options.mk>
 
 .if ${ARCH:Naarch64:Namd64:Narmv7:Ni386:Npowerpc64:Npowerpc64le:Npowerpc:Nriscv64}
 MESON_ARGS+=	-D ptp-helper=disabled
 .endif
 
 # Custom target to update distinfo for all gstreamer1 ports under control of
 # _GST1_VERSION set in Mk/Uses/gstreamer.mk
 makesum-all: makesum
 .for p in editing-services libav rtsp-server
 	@${MAKE} -C ${.CURDIR:H:H}/multimedia/gstreamer1-${p} makesum
 .endfor
 	@${MAKE} -C ${.CURDIR:H:H}/devel/gstreamer1-devtools makesum
 	@${MAKE} -C ${.CURDIR:H:H}/multimedia/gstreamer1-plugins makesum-all
 	@${MAKE} -C ${.CURDIR:H:H}/multimedia/py-gstreamer1 makesum
 
+# Automatically creates a VuXML entry for the GSreamer suite. This uses a
+# python script to scrape https://gstreamer.freedesktop.org/security/
+# and is pretty good in auto mode, but the output should still be verifed.
+# The script can be run manually with finer parameters for quirky cases.
+create-vuxml:
+	@if ! ${PYTHON_CMD} -c "import bs4" 2>/dev/null; then \
+		${ECHO_MSG} "====>  Error: create-vuxml target requires the bs4 Python module."; \
+		${ECHO_MSG} "====>  Please install it: pkg install ${PYTHON_PKGNAMEPREFIX}beautifulsoup4"; \
+		exit 1; \
+	fi
+	@if ! ${PYTHON_CMD} -c "import requests" 2>/dev/null; then \
+		${ECHO_MSG} "====>  Error: create-vuxml target requires the requests Python module."; \
+		${ECHO_MSG} "====>  Please install it: pkg install ${PYTHON_PKGNAMEPREFIX}requests"; \
+		exit 1; \
+	fi
+	@${ECHO_MSG} "===>  Auto-generating VuXML entry for GStreamer ${PORTVERSION}..."
+	@if [ -f "${FILESDIR}/generate-vuxml-entry.py" ]; then \
+		current_year=$$(date +%Y); \
+		vuxml_file="${.CURDIR:H:H}/security/vuxml/vuln/$${current_year}.xml"; \
+		tmp_vuxml=$$(${MKTEMP} -t gst_vuxml); \
+		trap '${RM} -f "$${tmp_vuxml}"' EXIT; \
+		if ! ${SETENV} ${PYTHON_CMD} ${FILESDIR}/generate-vuxml-entry.py -a -v "${PORTVERSION}" > "$${tmp_vuxml}"; then \
+			${ECHO_MSG} "====>  Error: Python VuXML generator failed."; \
+			exit 1; \
+		fi; \
+		if [ -s "$${tmp_vuxml}" ]; then \
+			if [ -f "$${vuxml_file}" ]; then \
+				${ECHO_CMD} "====> Prepending entry to $${vuxml_file}..."; \
+				${CAT} "$${tmp_vuxml}" "$${vuxml_file}" > "$${vuxml_file}.new"; \
+				${MV} "$${vuxml_file}.new" "$${vuxml_file}"; \
+			else \
+				${ECHO_CMD} "====> Warning: $${vuxml_file} not found. Saving to ${.CURDIR}/vuxml_entry.xml instead. Maybe it's the new year and security/vuxml needs to be updated?"; \
+				${CP} "$${tmp_vuxml}" ${.CURDIR}/vuxml_entry.xml; \
+			fi; \
+		fi; \
+	else \
+		${ECHO_CMD} "====> Warning: ${FILESDIR}/generate-vuxml-entry.py not found. Skipping VuXML generation."; \
+	fi
+
 .include <bsd.port.mk>
diff --git a/multimedia/gstreamer1/distinfo b/multimedia/gstreamer1/distinfo
index 2b814cec10ef..0b9d8c15dc96 100644
--- a/multimedia/gstreamer1/distinfo
+++ b/multimedia/gstreamer1/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1779386122
-SHA256 (gstreamer-1.28.3.tar.xz) = 5e84ecb942e136944eb9812f19cff7bcf05a85637482a32da55b892914c397d1
-SIZE (gstreamer-1.28.3.tar.xz) = 1938816
+TIMESTAMP = 1781903661
+SHA256 (gstreamer-1.28.4.tar.xz) = f5adc7e8f448c10260b3b25aa101c9d540674c8d9a54c2b77a86d04f2b3b50dd
+SIZE (gstreamer-1.28.4.tar.xz) = 1944508
diff --git a/multimedia/gstreamer1/files/generate-vuxml-entry.py b/multimedia/gstreamer1/files/generate-vuxml-entry.py
new file mode 100644
index 000000000000..d0da89a41498
--- /dev/null
+++ b/multimedia/gstreamer1/files/generate-vuxml-entry.py
@@ -0,0 +1,370 @@
+#!/usr/bin/env python3
+import argparse
+import os
+import re
+import uuid
+import sys
+from datetime import datetime
+import requests
+from bs4 import BeautifulSoup
+
+GST_SECURITY_URL = "https://gstreamer.freedesktop.org/security/"
+
+PACKAGE_MAP = {
+    'gstreamer': ['gstreamer1'],
+    'gst-devtools': ['gstreamer1-devtools'],
+    'gst-plugins-bad': ['gstreamer1-plugins-bad'],
+    'gst-plugins-base': ['gstreamer1-plugins'],
+    'gst-plugins-good': ['gstreamer1-plugins-good'],
+    'gst-plugins-rs': ['gstreamer1-plugins-rust'],
+    'gst-plugins-ugly': ['gstreamer1-plugins-ugly'],
+    'gst-libav': ['gstreamer1-libav'],
+    'gst-rtsp-server': ['gstreamer1-rtsp-server'],
+    'gst-editing-services': ['gstreamer1-editing-services']
+}
+
+def get_supported_python_versions():
+    """Parses Mk/Uses/python.mk to find active FreeBSD Python versions."""
+    portsdir = os.environ.get('PORTSDIR', '/usr/ports')
+    python_mk = os.path.join(portsdir, 'Mk', 'Uses', 'python.mk')
+    versions = []
+
+    try:
+        with open(python_mk, 'r') as f:
+            for line in f:
+                if line.strip().startswith('_PYTHON_VERSIONS'):
+                    data_part = line.split('#')[0]
+                    parts = data_part.split('=', 1)[1].strip().split()
+                    for v in parts:
+                        clean_v = v.replace('.', '')
+                        if clean_v and clean_v[0].isdigit() and clean_v.isalnum():
+                            versions.append(clean_v)
+                    break
+    except Exception as e:
+        print(f"[!] Warning: Could not parse {python_mk} ({e}). Falling back to py312.", file=sys.stderr)
+
+    return versions if versions else ['312']
+
+def map_module_to_port(module_name):
+    """Returns a list of correctly formatted FreeBSD port names."""
+    module_name = module_name.lower().strip()
+    if module_name == 'gst-python':
+        return [f"py{v}-gstreamer1" for v in get_supported_python_versions()]
+
+    return PACKAGE_MAP.get(module_name, [f"gstreamer1-{module_name.replace('gst-', '')}"])
+
+def parse_sa_id(sa_string):
+    match = re.search(r'(\d{4})-(\d{4})', sa_string)
+    if match:
+        return int(match.group(1) + match.group(2))
+    return 0
+
+def parse_version_string(v_str):
+    if not v_str:
+        return (0, 0, 0)
+    try:
+        return tuple(int(x) for x in v_str.split('.') if x.isdigit())
+    except ValueError:
+        return (0, 0, 0)
+
+def get_fixed_version_from_detail(url):
+    """Fetches a detail page and extracts the version it fixes."""
+    try:
+        resp = requests.get(url, timeout=5)
+        # Look for either a literal '<' or the HTML entity '&lt;'
+        match = re.search(r'(?:<|&lt;)\s*([0-9]+\.[0-9]+\.[0-9]+)', resp.text)
+        if match:
+            return match.group(1)
+    except requests.RequestException:
+        pass
+    return None
+
+def auto_detect_boundaries(soup, fixed_version, user_tip_sa=None, user_base_sa=None, max_lookahead=4):
+    """
+    Crawls the index top-down to find the contiguous batch of SAs.
+    Uses user_tip_sa as a strict start point (ceiling) and user_base_sa as a strict end point (floor).
+    """
+    print(f"[*] Auto-detecting SA range for version {fixed_version} (and newer)...", file=sys.stderr)
+    if user_tip_sa:
+        print(f"[*] Hard ceiling (tip) set to: {user_tip_sa}", file=sys.stderr)
+    if user_base_sa:
+        print(f"[*] Hard floor (base) set to: {user_base_sa}", file=sys.stderr)
+
+    target_v_tuple = parse_version_string(fixed_version)
+
+    # Normalize user boundaries to integer IDs to avoid prefix mismatch (e.g., "SA-2026-0040" vs "GStreamer-SA-2026-0040")
+    tip_id = parse_sa_id(user_tip_sa) if user_tip_sa else None
+    base_id = parse_sa_id(user_base_sa) if user_base_sa else None
+
+    sa_links = []
+    for tr in soup.find_all('tr'):
+        tds = tr.find_all(['td', 'th'])
+        if len(tds) >= 4:
+            raw_id_col = tds[0].get_text(separator=' ', strip=True)
+            sa_match = re.search(r'GStreamer-SA-(\d{4}-\d{4})', raw_id_col, re.IGNORECASE)
+            if sa_match:
+                a_tag = tds[3].find('a')
+                if a_tag and 'href' in a_tag.attrs:
+                    sa_links.append({
+                        'id': f"GStreamer-SA-{sa_match.group(1)}",
+                        'url': requests.compat.urljoin(GST_SECURITY_URL, a_tag['href'])
+                    })
+
+    matched_sas = []
+    started = False
+    miss_count = 0
+
+    for item in sa_links:
+        current_id = parse_sa_id(item['id'])
+
+        # Wait until we hit the explicit tip (if defined)
+        if tip_id and not started and current_id != tip_id:
+            continue
+
+        found_ver = get_fixed_version_from_detail(item['url'])
+        current_v_tuple = parse_version_string(found_ver)
+
+        # Match if the found version is equal to or newer than the target fixed_version
+        if current_v_tuple >= target_v_tuple:
+            matched_sas.append(item['id'])
+            started = True
+            miss_count = 0
+            print(f"  -> {item['id']} patches version {found_ver} (>= {fixed_version})", file=sys.stderr)
+        elif started:
+            miss_count += 1
+            print(f"  -> {item['id']} patches version {found_ver}. Lookahead buffer: {miss_count}/{max_lookahead}", file=sys.stderr)
+
+            # Only abort on lookahead if the user HAS NOT defined a hard base
+            if miss_count >= max_lookahead and not base_id:
+                print(f"[*] Hit {max_lookahead} older entries in a row. Ending auto-crawl.", file=sys.stderr)
+                break
+
+        # Hard stop if we hit the explicitly defined base
+        if base_id and current_id == base_id:
+            print(f"[*] Hit user-defined base floor {item['id']}. Ending auto-crawl.", file=sys.stderr)
+            break
+
+    if not matched_sas:
+        print(f"[!] Auto-detect failed: Could not find any SAs fixing >= {fixed_version} within boundaries.", file=sys.stderr)
+        sys.exit(1)
+
+    start_sa = min(matched_sas, key=parse_sa_id)
+    end_sa = max(matched_sas, key=parse_sa_id)
+
+    print(f"[*] Auto-detected range: {start_sa} to {end_sa}\n", file=sys.stderr)
+    return start_sa, end_sa
+
+def fetch_and_parse_advisories(sa1, sa2, fixed_version, auto_mode):
+    print(f"[*] Fetching GStreamer security advisories from {GST_SECURITY_URL}...", file=sys.stderr)
+    try:
+        response = requests.get(GST_SECURITY_URL, timeout=10)
+        response.raise_for_status()
+    except requests.RequestException as e:
+        print(f"[!] Error fetching security page: {e}", file=sys.stderr)
+        sys.exit(1)
+
+    soup = BeautifulSoup(response.text, 'html.parser')
+
+    if auto_mode:
+        # Pass sa1 strictly as the tip (start) and sa2 strictly as the base (end)
+        sa1, sa2 = auto_detect_boundaries(soup, fixed_version, user_tip_sa=sa1, user_base_sa=sa2)
+
+    id1 = parse_sa_id(sa1)
+    id2 = parse_sa_id(sa2)
+
+    start_id = min(id1, id2)
+    end_id = max(id1, id2)
+
+    cves = set()
+    sa_items = []
+    affected_packages = set()
+    dates = []
+    urls = set()
+
+    target_v_tuple = parse_version_string(fixed_version)
+
+    for tr in soup.find_all('tr'):
+        tds = tr.find_all(['td', 'th'])
+        if len(tds) >= 3:
+            raw_id_col = tds[0].get_text(separator=' ', strip=True)
+
+            sa_match = re.search(r'GStreamer-SA-(\d{4}-\d{4})', raw_id_col, re.IGNORECASE)
+            if not sa_match:
+                continue
+
+            sa_id = f"GStreamer-SA-{sa_match.group(1)}"
+            current_id = parse_sa_id(sa_id)
+
+            if start_id <= current_id <= end_id:
+                summary_text = tds[1].get_text(separator=' ', strip=True)
+
+                if "Reserved" in summary_text or "tbd" in summary_text.lower():
+                    continue
+
+                a_tag = tds[3].find('a') if len(tds) > 3 else None
+                detail_url = None
+                if a_tag and 'href' in a_tag.attrs:
+                    detail_url = requests.compat.urljoin(GST_SECURITY_URL, a_tag['href'])
+
+                skip_sa = False
+                det_text = ""
+
+                if detail_url:
+                    try:
+                        det_resp = requests.get(detail_url, timeout=5)
+                        det_resp.raise_for_status()
+
+                        # Extract and check the version
+                        match = re.search(r'(?:<|&lt;)\s*([0-9]+\.[0-9]+\.[0-9]+)', det_resp.text)
+                        found_ver = match.group(1) if match else None
+                        current_v_tuple = parse_version_string(found_ver)
+
+                        if current_v_tuple < target_v_tuple:
+                            print(f"[*] Skipping {sa_id} (fixes {found_ver} < {fixed_version})", file=sys.stderr)
+                            skip_sa = True
+                        else:
+                            det_soup = BeautifulSoup(det_resp.text, 'html.parser')
+                            det_text = det_soup.get_text(separator=' ', strip=True)
+
+                    except requests.RequestException as e:
+                        print(f"[!] Warning: Failed to fetch {detail_url}: {e}", file=sys.stderr)
+
+                if skip_sa:
+                    continue
+
+                # If we made it here, the SA is valid. Append to arrays.
+                date_text = tds[2].get_text(strip=True)
+                found_cves = re.findall(r'(CVE-\d{4}-\d{4,7})', raw_id_col, re.IGNORECASE)
+                cves.update([cve.upper() for cve in found_cves if "XXXX" not in cve.upper()])
+
+                if date_text and re.match(r'\d{4}-\d{2}-\d{2}', date_text):
+                    dates.append(date_text)
+
+                clean_summary = " ".join(summary_text.split())
+                sa_items.append((sa_id, clean_summary))
+
+                if detail_url:
+                    urls.add(detail_url)
+
+                # Parse affected packages using the text we already downloaded
+                if det_text:
+                    patterns = [
+                        r'Affected\s+Version[s]?[\s:]*(?:GStreamer\s+)?(gst-[a-z0-9-]+|gstreamer)',
+                        r'Affected\s+module[s]?[\s:]*(?:GStreamer\s+)?([a-z0-9-,\s]+)',
+                        r'Module[s]?[\s:]*(?:GStreamer\s+)?([a-z0-9-,\s]+)'
+                    ]
+
+                    found_for_this_sa = False
+                    for pat in patterns:
+                        matches = re.findall(pat, det_text, re.IGNORECASE)
+                        for match_str in matches:
+                            for mod in re.split(r'[,\s]+', match_str):
+                                mod = mod.strip().lower()
+                                if mod in PACKAGE_MAP or mod == 'gst-python':
+                                    affected_packages.update(map_module_to_port(mod))
+                                    found_for_this_sa = True
+
+                    if not found_for_this_sa:
+                        for mod in list(PACKAGE_MAP.keys()) + ['gst-python']:
+                            if mod != 'gstreamer' and re.search(r'\b' + re.escape(mod) + r'\b', det_text, re.IGNORECASE):
+                                affected_packages.update(map_module_to_port(mod))
+
+    if not sa_items:
+        print(f"[!] Error: No valid security advisories found in the specified range matching >= {fixed_version}.", file=sys.stderr)
+        sys.exit(1)
+
+    if not affected_packages:
+        print("[!] Warning: Could not parse any specific packages from the detail pages.", file=sys.stderr)
+        print("[!] Falling back to gstreamer1.", file=sys.stderr)
+        affected_packages.update(map_module_to_port("gstreamer"))
+
+    generate_vuxml(cves, sa_items, affected_packages, fixed_version, dates, urls)
+
+def generate_vuxml(cves, sa_items, affected_packages, fixed_version, dates, urls):
+    vid = str(uuid.uuid4())
+    valid_dates = sorted(dates)
+    discovery_date = valid_dates[0] if valid_dates else datetime.now().strftime("%Y-%m-%d")
+    entry_date = datetime.now().strftime("%Y-%m-%d")
+
+    sa_items.sort(key=lambda x: parse_sa_id(x[0]))
+
+    is_multiple = len(sa_items) > 1
+
+    topic_prefix = "gstreamer1"
+    if len(affected_packages) == 1:
+        topic_prefix = list(affected_packages)[0]
+
+    print(f'  <vuln vid="{vid}">')
+
+    if is_multiple:
+        print(f'    <topic>{topic_prefix} -- multiple vulnerabilities</topic>')
+    else:
+        single_summary = sa_items[0][1].replace('<', '&lt;').replace('>', '&gt;')
+        print(f'    <topic>{topic_prefix} -- {single_summary.lower()}</topic>')
+
+    print('    <affects>')
+    print('      <package>')
+
+    for pkg in sorted(affected_packages):
+        print(f'\t<name>{pkg}</name>')
+
+    print(f'\t<range><lt>{fixed_version}</lt></range>')
+    print('      </package>')
+    print('    </affects>')
+    print('    <description>')
+    print('      <body xmlns="http://www.w3.org/1999/xhtml">')
+    print('\t<p>The GStreamer project reports:</p>')
+    print(f'\t<blockquote cite="{GST_SECURITY_URL}">')
+
+    if is_multiple:
+        print('\t  <p>Multiple security issues were identified and fixed in the GStreamer framework.</p>')
+    else:
+        print('\t  <p>A security issue was identified and fixed in the GStreamer framework.</p>')
+
+    print('\t  <ul>')
+
+    for sa_id, summary in sa_items:
+        safe_summary = summary.replace('<', '&lt;').replace('>', '&gt;')
+        print(f'\t    <li>{sa_id}: {safe_summary}</li>')
+
+    print('\t  </ul>')
+    print('\t</blockquote>')
+    print('      </body>')
+    print('    </description>')
+    print('    <references>')
+
+    for cve in sorted(cves):
+        print(f'      <cvename>{cve}</cvename>')
+
+    if urls:
+        for u in sorted(urls):
+            print(f'      <url>{u}</url>')
+    else:
+        print(f'      <url>{GST_SECURITY_URL}</url>')
+
+    print('    </references>')
+    print('    <dates>')
+    print(f'      <discovery>{discovery_date}</discovery>')
+    print(f'      <entry>{entry_date}</entry>')
+    print('    </dates>')
+    print('  </vuln>\n')
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-1", "--sa1", help="First GStreamer SA ID boundary (with --auto, this is the ceiling)", required=False)
+    parser.add_argument("-2", "--sa2", help="Second GStreamer SA ID boundary (with --auto, this is the floor)", required=False)
+    parser.add_argument("-v", "--fixed-version", help="The version where these issues are fixed (e.g., 1.28.4)", required=True)
+    parser.add_argument("-a", "--auto", help="Automatically detect SA range based on fixed-version", action="store_true")
+
+    args = parser.parse_args()
+
+    if not args.fixed_version or not args.fixed_version.strip():
+        parser.error("The --fixed-version argument cannot be empty.")
+
+    if not re.match(r'^\d+(?:\.\d+)*$', args.fixed_version):
+        parser.error(f"Invalid --fixed-version format: '{args.fixed_version}'. Expected a valid numeric version (e.g., 1.28.4).")
+
+    if not args.auto and (not args.sa1 or not args.sa2):
+        parser.error("You must provide both --sa1 and --sa2 unless using --auto.")
+
+    fetch_and_parse_advisories(args.sa1, args.sa2, args.fixed_version, args.auto)
diff --git a/multimedia/py-gstreamer1/distinfo b/multimedia/py-gstreamer1/distinfo
index 83bcea86872c..aa95a4f37e4a 100644
--- a/multimedia/py-gstreamer1/distinfo
+++ b/multimedia/py-gstreamer1/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1779386148
-SHA256 (gst-python-1.28.3.tar.xz) = 810210f1ff6ddbd5f1d1d7585bff1fc0daa7e1d7e3b01e9e7166137341710af3
-SIZE (gst-python-1.28.3.tar.xz) = 145832
+TIMESTAMP = 1781903664
+SHA256 (gst-python-1.28.4.tar.xz) = c4eb382720b4443fb801a53418dff0bd4cd7478716d5ced493504a675b4d09fd
+SIZE (gst-python-1.28.4.tar.xz) = 148532