Dear Maintainer,

the packaged snapshot of libtgowt (upstream commit d067233, 2025-11-17)
is 11 commits behind the commit current Telegram Desktop pins
(d1cf250ea73de26c4c1f0a3c8173eb2648efbb04, 2026-10-07, see
Telegram/build/docker/centos_env/Dockerfile in tdesktop).

Several of the newer commits fix crashes and memory safety issues in
the WebRTC stack reachable from remote peers during calls:

  d1cf250 Clear channels before removing stopped transceivers.
  b857c26 Fix VP8 temporal layer bounds checking.
  e2d0e88 Fix possible use-after-free on GOOG_DELTA_ACK.
  09d55d6 Fix possible crash on DTLS/SCTP in unsupported media.
  328e647 Fix possible crash on zero-length GOOG_MISC_INFO.

The rest are build fixes, some of which Debian already carries as
patches:

  9826d0e Fix building with GCC 16
  19d51d3 Build with OpenSSL 4 (ASN1_STRING became opaque)
  3923b67 Check for GL/gl.h and EGL/egl.h instead of gl.pc and egl.pc
  89df288 Remove ABSL_ATTRIBUTE_LIFETIME_BOUND from void functions
  26068e2 Fixed missing include cstring.
  d888bc3 Fix building with Pipewire 1.5.81 and later. Resolves #167

Please consider updating to d1cf250. Given the use-after-free fix, it
may be worth checking with the security team whether the severity
should be raised.

Side note, in case it helps when telegram-desktop is updated as well:
because of Unbundle-libyuv.patch, current tdesktop master fails to
build against libtgowt-dev, since tgcalls includes
"third_party/libyuv/include/libyuv.h" (desktop_capturer/
DesktopCaptureSourceHelper.cpp and DesktopCaptureSourceManager.cpp).
Building tg_owt at d1cf250 from source works fine on arm64, and the
resulting Telegram Desktop runs on a 16K page size kernel (Asahi).