diff --git a/.bazelrc b/.bazelrc
index a88b50fa..7860bd77 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -121,11 +121,33 @@ build --experimental_run_validations
 #
 ##############################################################################
 
+# Flags for systems with GNU linker or compatible.
+build --linkopt='-Wl,-z,noexecstack'
+
+build --host_linkopt='-Wl,-z,defs'
+build --host_linkopt='-Wl,-z,noexecstack'
+
+build:nix      --linkopt='-fPIE'
+build:nix --host_linkopt='-fPIE'
+build:nix      --linkopt='-Wl,--detect-odr-violations'
+build:nix --host_linkopt='-Wl,--detect-odr-violations'
+build:nix      --linkopt='-Wl,--fatal-warnings'
+build:nix --host_linkopt='-Wl,--fatal-warnings'
+build:nix      --linkopt='-Wl,--gc-sections'
+build:nix --host_linkopt='-Wl,--gc-sections'
+build:nix      --linkopt='-Wl,--rosegment'
+build:nix --host_linkopt='-Wl,--rosegment'
+build:nix      --linkopt='-Wl,--warn-common'
+build:nix --host_linkopt='-Wl,--warn-common'
+
+build:nix --host_linkopt='-Wl,--warn-execstack'
+
 # Always enable assert() in tests.
 build --per_file_copt='_test.cc?@-UNDEBUG'
-# Optimize libsodium even in debug mode. It's simply too slow (tests time out)
-# otherwise.
+# Optimize libsodium and opus even in debug mode.
+# They are simply too slow (tests time out) otherwise.
 build --per_file_copt='external/libsodium[:/]@-O3'
+build --per_file_copt='external/opus[:/]@-O3'
 
 # Debug mode.
 build:debug -c dbg
@@ -166,6 +188,7 @@ build:sanitizer --copt='-O3'
 build:sanitizer --copt='-fno-sanitize-ignorelist'
 build:sanitizer --per_file_copt='//c-toxcore[:/]@-O0'
 build:sanitizer --per_file_copt='//c-toxcore[:/]@-fno-inline,-fno-omit-frame-pointer'
+build:sanitizer --linkopt='-Wl,--no-fatal-warnings'
 build:sanitizer --flaky_test_attempts=1
 build:sanitizer --build_tag_filters=-no-san,-haskell,-windows,-macos
 build:sanitizer --test_tag_filters=-no-san,-haskell,-windows,-macos
@@ -218,31 +241,27 @@ build:android --host_crosstool_top=@bazel_tools//tools/cpp:toolchain
 build:android --verbose_failures
 build:android --copt='-Wno-unused-macros'
 
-build:gnulike      --per_file_copt='external/.*[-_]avx\\.c$@-mavx,-w'
-build:gnulike --host_per_file_copt='external/.*[-_]avx\\.c$@-mavx,-w'
-build:gnulike      --per_file_copt='external/.*[-_]avx2\\.c$@-mavx2,-w'
-build:gnulike --host_per_file_copt='external/.*[-_]avx2\\.c$@-mavx2,-w'
-build:gnulike      --per_file_copt='external/.*[-_]avx512f\\.c$@-mavx512f,-w'
-build:gnulike --host_per_file_copt='external/.*[-_]avx512f\\.c$@-mavx512f,-w'
-build:gnulike      --per_file_copt='external/.*[-_]sse\\.c$@-mssse3,-msse4,-w'
-build:gnulike --host_per_file_copt='external/.*[-_]sse\\.c$@-mssse3,-msse4,-w'
-build:gnulike      --per_file_copt='external/.*[-_]sse4\\.c$@-msse4,-msse4.1,-w'
-build:gnulike --host_per_file_copt='external/.*[-_]sse4\\.c$@-msse4,-msse4.1,-w'
-build:gnulike      --per_file_copt='external/.*[-_]sse41\\.c$@-msse4.1,-w'
-build:gnulike --host_per_file_copt='external/.*[-_]sse41\\.c$@-msse4.1,-w'
-build:gnulike      --per_file_copt='external/.*[-_]sse4_1\\.c$@-msse4.1,-w'
-build:gnulike --host_per_file_copt='external/.*[-_]sse4_1\\.c$@-msse4.1,-w'
-build:gnulike      --per_file_copt='external/.*[-_]ssse3\\.c$@-mssse3,-w'
-build:gnulike --host_per_file_copt='external/.*[-_]ssse3\\.c$@-mssse3,-w'
+build --per_file_copt='external/.*[-_]neon_dotprod\\.c$@-march=generic+dotprod'
+build --per_file_copt='external/.*[-_]neon_i8mm\\.c$@-march=generic+dotprod+i8mm'
+build --per_file_copt='external/.*[-_]sve\\.c$@-march=generic+dotprod+i8mm+sve'
+
+build --per_file_copt='external/.*[-_]avx\\.c$@-mavx'
+build --per_file_copt='external/.*[-_]avx2\\.c$@-mavx2'
+build --per_file_copt='external/.*[-_]avx512f\\.c$@-mavx512f'
+build --per_file_copt='external/.*[-_]sse\\.c$@-mssse3,-msse4'
+build --per_file_copt='external/.*[-_]sse4\\.c$@-msse4,-msse4.1'
+build --per_file_copt='external/.*[-_]sse41\\.c$@-msse4.1'
+build --per_file_copt='external/.*[-_]sse4_1\\.c$@-msse4.1'
+build --per_file_copt='external/.*[-_]ssse3\\.c$@-mssse3'
 
 # Colour diagnostics, even though bazel uses non-tty pipes.
-build:gnulike --copt='-fdiagnostics-color=always'
+build --copt='-fdiagnostics-color=always'
 
 # ABI and source behaviour options.
-build:gnulike --copt='-funsigned-char'
-build:gnulike --cxxopt='-fno-exceptions'
-build:gnulike --cxxopt='-fno-rtti'
-build:gnulike --cxxopt='-DGOOGLE_PROTOBUF_NO_RTTI'
+build --copt='-funsigned-char'
+build --cxxopt='-fno-exceptions'
+build --cxxopt='-fno-rtti'
+build --cxxopt='-DGOOGLE_PROTOBUF_NO_RTTI'
 
 # Enable trace logging for toxcore.
 build --per_file_copt='//c-toxcore/@-DMIN_LOGGER_LEVEL=LOGGER_LEVEL_TRACE'
@@ -266,12 +285,8 @@ build:mallocfail --test_env=MALLOCFAIL_TIMEOUT=5
 build:mallocfail --run_under="mallocfail"
 build:mallocfail --config=ubsan
 
-# Use this config to put tox into a test network that speaks an incompatible
-# protocol (all packet ids are shifted).
-build:testnet --per_file_copt='//c-toxcore[:/]@-DUSE_TEST_NETWORK=1'
-
 # Always build debugging tools with debug info.
-build:gnulike --per_file_copt='//tools/debug[:/]@-g'
+build --per_file_copt='//tools/debug[:/]@-g'
 
 test --test_output=errors
 test --test_verbose_timeout_warnings=true
@@ -282,270 +297,330 @@ test --test_verbose_timeout_warnings=true
 #
 ##############################################################################
 
-build:clang --config=gnulike
-build:gcc --config=gnulike
-
 # Use GNU versions of the C standard, because runtime/cgo doesn't set feature
 # flags correctly. We then override it in *all* per-file flags, which ends up
 # not matching runtime/cgo/gcc_setenv.c for some reason.
-build:gnulike --cxxopt='-std=c++20'
-build:gnulike --host_cxxopt='-std=c++20'
-build:gnulike --conlyopt='-std=gnu17'
-build:gnulike --per_file_copt='\\.c$@-std=c17'
-
-build:gnulike --copt='-Wall'
-build:gnulike --copt='-Werror'
-build:gnulike --copt='-Wformat'
-build:gnulike --copt='-Wformat-security'
-
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Weverything'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-c++98-compat'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-c++98-compat-pedantic'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-conversion'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-covered-switch-default'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-disabled-macro-expansion'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-documentation-deprecated-sync'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-missing-field-initializers'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-missing-noreturn'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-padded'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-reserved-id-macro'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-unused-parameter'
-build:clang --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-Wno-vla'
-build:gnulike --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-ftrapv'
-build:gnulike --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins)@-pedantic'
+build --cxxopt='-std=c++20'
+build --host_cxxopt='-std=c++20'
+build --conlyopt='-std=gnu17'
+build --per_file_copt='\\.c$@-std=c17'
+
+build --per_file_copt='@-Wall'
+build --per_file_copt='@-Werror'
+build --per_file_copt='@-Weverything'
+build --per_file_copt='@-pedantic'
+build --copt='-Wno-c++98-compat'
+build --copt='-Wno-c++98-compat-pedantic'
+build --copt='-Wno-conversion'
+build --copt='-Wno-covered-switch-default'
+build --copt='-Wno-disabled-macro-expansion'
+build --copt='-Wno-documentation-deprecated-sync'
+build --copt='-Wno-missing-field-initializers'
+build --copt='-Wno-missing-noreturn'
+build --copt='-Wno-padded'
+build --copt='-Wno-reserved-id-macro'
+build --copt='-Wno-unused-parameter'
+build --copt='-Wno-vla'
+build --copt='-ftrapv'
+
+# This isn't a useful warning and makes code uglier.
+build --per_file_copt='@-Wno-missing-braces'
+# __attribute__((nonnull)) warns about defensive null checks.
+build --per_file_copt='@-Wno-tautological-pointer-compare'
+
+# This warning triggers when system header macros introduce reserved
+# identifiers, which is exactly the point of them being reserved.
+build --copt='-Wno-reserved-identifier'
+# This is a C89 requirement, we use C99.
+build --copt='-Wno-declaration-after-statement'
+# Useless warning, see https://stackoverflow.com/questions/77017567.
+build --copt='-Wno-unsafe-buffer-usage'
+# Used in absl, for some reason doesn't work with per_file_copt.
+# TODO(iphydf): Find out why.
+build --copt='-Wno-deprecated-builtins'
 
 # NO_FRAME_POINTER is set when compiling fuzzers (for some reason), causing absl to use the
 # libunwind stack trace implementation, which is Google internal-only, so fails to compile in Open
 # Source software.
-build:gnulike --per_file_copt='external/com_google_absl[:/]@-UNO_FRAME_POINTER,-fno-omit-frame-pointer'
-
-# Hack to get absl to compile for arm64.
-build:linux-arm64-musl --per_file_copt='external/com_google_absl/absl/base/internal/low_level_alloc.cc@-Doff64_t=long'
+build --per_file_copt='external/com_google_absl[:/]@-UNO_FRAME_POINTER,-fno-omit-frame-pointer'
 
 # Compile toxcore as C++.
-build:c-as-cpp --per_file_copt='//c-toxcore/@-xc++,-std=c++20'
-build:c-as-cpp --per_file_copt='//c-toxcore/@-Wno-alloca'
-build:c-as-cpp --per_file_copt='//c-toxcore/@-Wno-c99-extensions'
-build:c-as-cpp --per_file_copt='//c-toxcore/@-Wno-old-style-cast'
-build:c-as-cpp --per_file_copt='//c-toxcore/@-Wno-unreachable-code-return'
-build:c-as-cpp --per_file_copt='//c-toxcore/@-Wno-unused-macros'
+build:c-as-cpp --per_file_copt='//c-toxcore[:/]@-xc++,-std=c++20'
+build:c-as-cpp --per_file_copt='//c-toxcore[:/]@-Wno-alloca'
+build:c-as-cpp --per_file_copt='//c-toxcore[:/]@-Wno-c99-extensions'
+build:c-as-cpp --per_file_copt='//c-toxcore[:/]@-Wno-old-style-cast'
+build:c-as-cpp --per_file_copt='//c-toxcore[:/]@-Wno-unreachable-code-return'
+build:c-as-cpp --per_file_copt='//c-toxcore[:/]@-Wno-unused-macros'
 
 # Cython code isn't very clean.
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-cast-function-type-strict'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-conditional-uninitialized'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-cast-qual'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-extra-semi-stmt'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-missing-variable-declarations'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-old-style-cast'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-undef'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-unused-macros'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-unreachable-code'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-used-but-marked-unused'
-build:clang --per_file_copt='//py_toxcore_c[:/]@-Wno-zero-as-null-pointer-constant'
-build:gcc --per_file_copt='//py_toxcore_c[:/]@-Wno-pedantic'
-build:gnulike --per_file_copt='//py_toxcore_c[:/]@-Wno-cast-align'
-build:gnulike --per_file_copt='//py_toxcore_c[:/]@-Wno-shadow'
-
-# GCC warning flags.
-# __attribute__((nonnull)) causes this warning on defensive null checks.
-build:gcc --copt='-Wno-nonnull-compare'
-#build:gcc --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins).*\\.c$@-Wsuggest-attribute=const'
-#build:gcc --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins).*\\.c$@-Wsuggest-attribute=pure'
-build:gcc --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins).*\\.c$@-Wold-style-declaration,-Wold-style-definition'
-build:gcc --per_file_copt='//(c-|go-|hs-|jvm-|py_|qtox|toxic|toxins).*\\.(cc|cpp)$@-Wzero-as-null-pointer-constant'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-cast-align'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-cast-function-type-strict'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-cast-qual'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-conditional-uninitialized'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-extra-semi-stmt'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-missing-variable-declarations'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-old-style-cast'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-shadow'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-undef'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-unreachable-code'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-unused-macros'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-used-but-marked-unused'
+build --per_file_copt='//py_toxcore_c[:/]@-Wno-zero-as-null-pointer-constant'
 
 # X11/Xfuncproto.h does this.
-build:gnulike --per_file_copt='//qtox[:/].*x11@-Wno-variadic-macros'
+build --per_file_copt='//qtox[:/].*x11@-Wno-variadic-macros'
+
+# VPX macros cause this.
+build --per_file_copt='//c-toxcore/toxav:video.c@-Wno-used-but-marked-unused'
+
+# Ignore super donators stuff. It's verbatim. We compile it, but don't care about cleanliness.
+build --per_file_copt='//c-toxcore/super_donators@-Wno-comma,-Wno-extra-semi-stmt,-Wno-unreachable-code-return'
+
+# Tests
+build --per_file_copt='_bench\\.(cc|cpp)$@-Wno-weak-vtables,-Wno-zero-as-null-pointer-constant'
+build --per_file_copt='_(test|bench)\\.(cc|cpp)$@-Wno-global-constructors,-Wno-exit-time-destructors'
+build --per_file_copt='_test\\.(cc|cpp)$@-Wno-c99-extensions'
+build --per_file_copt='_test\\.(cc|cpp)$@-Wno-zero-as-null-pointer-constant'
+build --per_file_copt='_test\\.cpp$@-Wno-extra-semi-stmt'
+build --per_file_copt='_test\\.cpp$@-Wno-redundant-parens'
+build --per_file_copt='_test\\.cpp$@-Wno-undefined-reinterpret-cast'
+
+# Qt generated code.
+build --per_file_copt='rcc_.*\\.cpp$@-Wno-global-constructors,-Wno-exit-time-destructors'
+build --per_file_copt='moc_.*\\.cpp$@-Wno-deprecated'
+build --per_file_copt='moc_.*\\.cpp$@-Wno-extra-semi-stmt'
+build --per_file_copt='moc_.*\\.cpp$@-Wno-gnu-zero-variadic-macro-arguments'
+build --per_file_copt='moc_.*\\.cpp$@-Wno-redundant-parens'
+build --per_file_copt='moc_.*\\.cpp$@-Wno-undefined-reinterpret-cast'
 
 # TODO(iphydf): Fix these.
-build:gcc --per_file_copt='//toxins/tox_shell@-Wno-unused-result'
-build:gcc --per_file_copt='//toxins/toxvpn:import/src/listener.cpp@-Wno-stringop-truncation'
-build:gnulike --per_file_copt='//toxins/toxvpn:import/src/main.cpp@-Wno-unused-result'
-build:gnulike --per_file_copt='//toxins/toxvpn:import/src/toxvpn-remote.cpp@-Wno-unused-result'
+build --per_file_copt='//c-toxcore@-Wno-shadow-uncaptured-local'
+build --per_file_copt='//c-toxcore@-Wno-sign-compare'
+build --per_file_copt='//c-toxcore@-Wno-unused-but-set-variable'
+build --per_file_copt='//experimental@-Wno-switch-enum'
+build --per_file_copt='//experimental@-Wno-used-but-marked-unused'
+build --per_file_copt='//qtox@-Wno-comma'
+build --per_file_copt='//qtox@-Wno-deprecated'
+build --per_file_copt='//qtox@-Wno-documentation'
+build --per_file_copt='//qtox@-Wno-documentation-unknown-command'
+build --per_file_copt='//qtox@-Wno-double-promotion'
+build --per_file_copt='//qtox@-Wno-duplicate-enum'
+build --per_file_copt='//qtox@-Wno-float-equal'
+build --per_file_copt='//qtox@-Wno-global-constructors,-Wno-exit-time-destructors'
+build --per_file_copt='//qtox@-Wno-implicit-fallthrough'
+build --per_file_copt='//qtox@-Wno-inconsistent-missing-destructor-override'
+build --per_file_copt='//qtox@-Wno-missing-prototypes'
+build --per_file_copt='//qtox@-Wno-non-virtual-dtor'
+build --per_file_copt='//qtox@-Wno-error=range-loop-analysis'
+build --per_file_copt='//qtox@-Wno-shadow'
+build --per_file_copt='//qtox@-Wno-shadow-field'
+build --per_file_copt='//qtox@-Wno-suggest-destructor-override'
+build --per_file_copt='//qtox@-Wno-suggest-override'
+build --per_file_copt='//qtox@-Wno-switch-enum'
+build --per_file_copt='//qtox@-Wno-undef'
+build --per_file_copt='//qtox@-Wno-unreachable-code-break'
+build --per_file_copt='//qtox@-Wno-unreachable-code-return'
+build --per_file_copt='//qtox@-Wno-unused-but-set-variable'
+build --per_file_copt='//qtox@-Wno-unused-macros'
+build --per_file_copt='//qtox@-Wno-used-but-marked-unused'
+build --per_file_copt='//qtox@-Wno-weak-vtables'
+build --per_file_copt='//toxic@-Wno-implicit-fallthrough'
+build --per_file_copt='//toxic@-Wno-missing-prototypes'
+build --per_file_copt='//toxic@-Wno-missing-variable-declarations'
+build --per_file_copt='//toxic@-Wno-sign-compare'
+build --per_file_copt='//toxic@-Wno-switch-enum'
+build --per_file_copt='//toxic@-Wno-undef'
+build --per_file_copt='//toxic@-Wno-unused-macros'
+build --per_file_copt='//toxins@-Wno-cast-align'
+build --per_file_copt='//toxins@-Wno-global-constructors,-Wno-exit-time-destructors'
+build --per_file_copt='//toxins@-Wno-missing-prototypes'
+build --per_file_copt='//toxins@-Wno-missing-variable-declarations'
+build --per_file_copt='//toxins@-Wno-non-virtual-dtor'
+build --per_file_copt='//toxins@-Wno-old-style-cast'
+build --per_file_copt='//toxins@-Wno-sign-compare'
+build --per_file_copt='//toxins@-Wno-switch-enum'
+build --per_file_copt='//toxins@-Wno-unreachable-code'
+build --per_file_copt='//toxins@-Wno-unreachable-code-return'
 
-# This isn't a useful warning and makes code uglier.
-build:gnulike --copt='-Wno-missing-braces'
+# Disable some clang warnings on various third party dependencies.
+build --per_file_copt='external[:/]@-Wno-assign-enum'
+build --per_file_copt='external[:/]@-Wno-bad-function-cast'
+build --per_file_copt='external[:/]@-Wno-c++20-compat'
+build --per_file_copt='external[:/]@-Wno-cast-align'
+build --per_file_copt='external[:/]@-Wno-cast-qual'
+build --per_file_copt='external[:/]@-Wno-comma'
+build --per_file_copt='external[:/]@-Wno-conditional-uninitialized'
+build --per_file_copt='external[:/]@-Wno-deprecated'
+build --per_file_copt='external[:/]@-Wno-documentation'
+build --per_file_copt='external[:/]@-Wno-documentation-unknown-command'
+build --per_file_copt='external[:/]@-Wno-double-promotion'
+build --per_file_copt='external[:/]@-Wno-duplicate-enum'
+build --per_file_copt='external[:/]@-Wno-extra-semi-stmt'
+build --per_file_copt='external[:/]@-Wno-float-equal'
+build --per_file_copt='external[:/]@-Wno-format-nonliteral'
+build --per_file_copt='external[:/]@-Wno-gcc-compat'
+build --per_file_copt='external[:/]@-Wno-global-constructors,-Wno-exit-time-destructors'
+build --per_file_copt='external[:/]@-Wno-implicit-fallthrough'
+build --per_file_copt='external[:/]@-Wno-missing-prototypes'
+build --per_file_copt='external[:/]@-Wno-missing-variable-declarations'
+build --per_file_copt='external[:/]@-Wno-newline-eof'
+build --per_file_copt='external[:/]@-Wno-old-style-cast'
+build --per_file_copt='external[:/]@-Wno-shadow'
+build --per_file_copt='external[:/]@-Wno-strict-prototypes'
+build --per_file_copt='external[:/]@-Wno-switch-enum'
+build --per_file_copt='external[:/]@-Wno-thread-safety-negative'
+build --per_file_copt='external[:/]@-Wno-undef'
+build --per_file_copt='external[:/]@-Wno-unreachable-code'
+build --per_file_copt='external[:/]@-Wno-unreachable-code-break'
+build --per_file_copt='external[:/]@-Wno-unreachable-code-return'
+build --per_file_copt='external[:/]@-Wno-unused-macros'
+build --per_file_copt='external[:/]@-Wno-weak-vtables'
+build --per_file_copt='external[:/]@-Wno-zero-as-null-pointer-constant'
+build --per_file_copt='external/benchmark[:/]@-Wno-used-but-marked-unused'
+build --per_file_copt='external/boringssl[:/]@-Wno-c11-extensions'
+build --per_file_copt='external/boringssl[:/]@-Wno-cast-function-type'
+build --per_file_copt='external/boringssl[:/]@-Wno-extra-semi'
+build --per_file_copt='external/boringssl[:/]@-Wno-gnu-binary-literal'
+build --per_file_copt='external/boringssl[:/]@-Wno-overlength-strings'
+build --per_file_copt='external/boringssl[:/]@-Wno-redundant-parens'
+build --per_file_copt='external/boringssl[:/]@-Wno-tautological-value-range-compare'
+build --per_file_copt='external/boringssl[:/]@-Wno-used-but-marked-unused'
+build --per_file_copt='external/com_google_absl[:/]@-Wno-atomic-implicit-seq-cst'
+build --per_file_copt='external/com_google_absl[:/]@-Wno-tautological-type-limit-compare'
+build --per_file_copt='external/com_google_absl[:/]@-Wno-unused-template'
+build --per_file_copt='external/curl[:/]@-Wno-cast-function-type-strict'
+build --per_file_copt='external/curl[:/]@-Wno-used-but-marked-unused'
+build --per_file_copt='external/ev[:/]@-Wno-bitwise-op-parentheses'
+build --per_file_copt='external/ev[:/]@-Wno-comment'
+build --per_file_copt='external/ev[:/]@-Wno-extra-semi'
+build --per_file_copt='external/ev[:/]@-Wno-return-type'
+build --per_file_copt='external/ev[:/]@-Wno-sign-compare'
+build --per_file_copt='external/ev[:/]@-Wno-unused'
+build --per_file_copt='external/ev[:/]@-Wno-used-but-marked-unused'
+build --per_file_copt='external/ffmpeg/fftools[:/]@-Wno-single-bit-bitfield-constant-conversion'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-atomic-implicit-seq-cst'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-bool-operation'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-braced-scalar-init'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-cast-function-type'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-dangling-else'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-deprecated-pragma'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-format-pedantic'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-implicit-const-int-float-conversion'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-incompatible-function-pointer-types-strict'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-incompatible-pointer-types-discards-qualifiers'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-overlength-strings'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-parentheses'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-pedantic'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-pointer-bool-conversion'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-redundant-parens'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-shorten-64-to-32'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-sign-compare'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-sometimes-uninitialized'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-string-plus-int'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-switch'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-tautological-constant-out-of-range-compare'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-unneeded-internal-declaration'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-unused-but-set-variable'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-unused-const-variable'
+build --per_file_copt='external/ffmpeg[:/]@-Wno-used-but-marked-unused'
+build --per_file_copt='external/libcap[:/]@-Wno-gnu-zero-variadic-macro-arguments'
+build --per_file_copt='external/libcap[:/]@-Wno-sign-compare'
+build --per_file_copt='external/libcap[:/]@-Wno-tautological-unsigned-enum-zero-compare'
+build --per_file_copt='external/libcap[:/]@-Wno-variadic-macros'
+build --per_file_copt='external/libconfig[:/]@-Wno-deprecated-non-prototype'
+build --per_file_copt='external/libconfig[:/]@-Wno-unused-but-set-variable'
+build --per_file_copt='external/libidn2[:/]@-Wno-alloca'
+build --per_file_copt='external/libidn2[:/]@-Wno-cast-function-type-strict'
+build --per_file_copt='external/libidn2[:/]@-Wno-pedantic'
+build --per_file_copt='external/libidn2[:/]@-Wno-sign-compare'
+build --per_file_copt='external/libidn2[:/]@-Wno-unused-const-variable'
+build --per_file_copt='external/libqrencode[:/]@-Wno-tautological-unsigned-enum-zero-compare'
+build --per_file_copt='external/libsodium[:/]@-Wno-unknown-pragmas'
+build --per_file_copt='external/libsodium[:/]@-Wno-unused-but-set-variable'
+build --per_file_copt='external/libsodium[:/]@-Wno-unused-function'
+build --per_file_copt='external/libsodium[:/]@-Wno-unused-variable'
+build --per_file_copt='external/libvpx[:/]@-Wno-incompatible-pointer-types'
+build --per_file_copt='external/libvpx[:/]@-Wno-unused-but-set-variable'
+build --per_file_copt='external/libvpx[:/]@-Wno-unused-variable'
+build --per_file_copt='external/libxz[:/]@-Wno-cast-function-type-strict'
+build --per_file_copt='external/libxz[:/]@-Wno-unused-function'
+build --per_file_copt='external/libzmq[:/]@-Wno-abstract-vbase-init'
+build --per_file_copt='external/libzmq[:/]@-Wno-extra-semi'
+build --per_file_copt='external/libzmq[:/]@-Wno-suggest-destructor-override'
+build --per_file_copt='external/libzmq[:/]@-Wno-suggest-override'
+build --per_file_copt='external/libzmq[:/]@-Wno-tautological-type-limit-compare'
+build --per_file_copt='external/libzmq[:/]@-Wno-unused-variable'
+build --per_file_copt='external/ncurses[:/]@-Wno-tautological-value-range-compare'
+build --per_file_copt='external/ncurses[:/]@-Wno-unused-but-set-variable'
+build --per_file_copt='external/ncurses[:/]@-Wno-used-but-marked-unused'
+build --per_file_copt='external/openal[:/]@-std=c++17'
+build --per_file_copt='external/openal[:/]@-Wno-switch'
+build --per_file_copt='external/openal[:/]@-Wno-undefined-func-template'
+build --per_file_copt='external/openal[:/]@-Wno-unused-function'
+build --per_file_copt='external/openal[:/]@-Wno-unused-value'
+build --per_file_copt='external/pthread_w32[:/]@-Wno-cast-function-type'
+build --per_file_copt='external/pthread_w32[:/]@-Wno-gnu-statement-expression-from-macro-expansion'
+build --per_file_copt='external/pthread_w32[:/]@-Wno-pedantic'
+build --per_file_copt='external/pthread_w32[:/]@-Wno-tautological-unsigned-zero-compare'
+build --per_file_copt='external/sdl2[:/]@-Wno-alloca'
+build --per_file_copt='external/sdl2[:/]@-Wno-atomic-implicit-seq-cst'
+build --per_file_copt='external/sdl2[:/]@-Wno-cast-function-type'
+build --per_file_copt='external/sdl2[:/]@-Wno-invalid-utf8'
+build --per_file_copt='external/sdl2[:/]@-Wno-overlength-strings'
+build --per_file_copt='external/sdl2[:/]@-Wno-pedantic'
+build --per_file_copt='external/sdl2[:/]@-Wno-sign-compare'
+build --per_file_copt='external/sdl2[:/]@-Wno-tautological-value-range-compare'
+build --per_file_copt='external/sdl2[:/]@-Wno-unused-but-set-variable'
+build --per_file_copt='external/sqlcipher[:/]@-Wno-atomic-implicit-seq-cst'
+build --per_file_copt='external/sqlcipher[:/]@-Wno-cast-function-type-strict'
+build --per_file_copt='external/sqlcipher[:/]@-Wno-empty-translation-unit'
+build --per_file_copt='external/sqlcipher[:/]@-Wno-gnu-pointer-arith'
+build --per_file_copt='external/sqlcipher[:/]@-Wno-sign-compare'
+build --per_file_copt='external/sqlcipher[:/]@-Wno-unused'
+build --per_file_copt='external/tcl[:/]@-Wno-cast-function-type-strict'
+build --per_file_copt='external/tcl[:/]@-Wno-extra-semi'
+build --per_file_copt='external/tcl[:/]@-Wno-flexible-array-extensions'
+build --per_file_copt='external/tcl[:/]@-Wno-format-pedantic'
+build --per_file_copt='external/tcl[:/]@-Wno-gnu-statement-expression-from-macro-expansion'
+build --per_file_copt='external/tcl[:/]@-Wno-overlength-strings'
+build --per_file_copt='external/tcl[:/]@-Wno-tautological-type-limit-compare'
+build --per_file_copt='external/tcl[:/]@-Wno-tautological-value-range-compare'
+build --per_file_copt='external/tcl[:/]@-Wno-typedef-redefinition'
+build --per_file_copt='external/tox_extension_messages[:/]@-Wno-gnu-statement-expression-from-macro-expansion'
+build --per_file_copt='external/toxext[:/]@-Wno-gnu-statement-expression-from-macro-expansion'
+build --per_file_copt='external/xcb[:/]@-Wno-unused-but-set-variable'
+build --per_file_copt='external/yasm[:/]@-Wno-c2x-compat'
+build --per_file_copt='external/yasm[:/]@-Wno-cast-function-type'
+build --per_file_copt='external/yasm[:/]@-Wno-gnu-null-pointer-arithmetic'
+build --per_file_copt='external/yasm[:/]@-Wno-null-pointer-subtraction'
+build --per_file_copt='external/zlib[:/]@-std=gnu17'
+build --per_file_copt='external/zlib[:/]@-Wno-deprecated-non-prototype'
+build --per_file_copt='external/zlib[:/]@-Wno-implicit-function-declaration'
+build --per_file_copt='third_party/libidn2[:/]@-Wno-missing-prototypes'
+
+# Disable some default warnings also present in the host config.
+build      --per_file_copt='external/tcl[:/]@-Wno-unused'
+build --host_per_file_copt='external/tcl[:/]@-Wno-unused'
+build      --per_file_copt='external/yasm[:/]@-Wno-misleading-indentation'
+build --host_per_file_copt='external/yasm[:/]@-Wno-misleading-indentation'
+build      --per_file_copt='external/yasm[:/]@-Wno-unused-but-set-variable'
+build --host_per_file_copt='external/yasm[:/]@-Wno-unused-but-set-variable'
 
-# Clang warning flags.
-build:clang --copt='-Wthread-safety-analysis'
-build:clang --copt='-Wno-error=thread-safety-analysis'
-build:clang --copt='-Wno-error=inconsistent-missing-override'
-# This warning triggers when system header macros introduce reserved
-# identifiers, which is exactly the point of them being reserved.
-build:clang --copt='-Wno-reserved-identifier'
-# __attribute__((nonnull)) causes these warnings on defensive null checks.
-build:clang --copt='-Wno-pointer-bool-conversion'
-build:clang --copt='-Wno-tautological-pointer-compare'
-# This is a C89 requirement, we use C99.
-build:clang --copt='-Wno-declaration-after-statement'
-# Useless warning, see https://stackoverflow.com/questions/77017567.
-build:clang --copt='-Wno-unsafe-buffer-usage'
-# Used in absl, for some reason doesn't work with per_file_copt.
-# TODO(iphydf): Find out why.
-build:clang --copt='-Wno-deprecated-builtins'
+# Hack to get absl to compile for arm64.
+build:linux-arm64-musl --per_file_copt='external/com_google_absl/absl/base/internal/low_level_alloc.cc@-Doff64_t=long'
 
 # LPTSTR cast for WSAStringToAddress is necessary.
 build:windows-x86_64 --per_file_copt='//c-toxcore/toxcore:network.c@-Wno-cast-qual'
 
-build:clang --per_file_copt='//c-toxcore/toxav:video.c@-Wno-used-but-marked-unused'
-build:clang --per_file_copt='//c-toxcore/super_donators@-w'
-build:clang --per_file_copt='_bench\\.(cc|cpp)$@-Wno-weak-vtables,-Wno-zero-as-null-pointer-constant'
-build:clang --per_file_copt='_(test|bench)\\.(cc|cpp)$@-Wno-global-constructors,-Wno-exit-time-destructors'
-build:clang --per_file_copt='_test\\.(cc|cpp)$@-Wno-c99-extensions'
-build:clang --per_file_copt='_test\\.(cc|cpp)$@-Wno-zero-as-null-pointer-constant'
-build:clang --per_file_copt='_test\\.cpp$@-Wno-extra-semi-stmt'
-build:clang --per_file_copt='_test\\.cpp$@-Wno-redundant-parens'
-build:clang --per_file_copt='_test\\.cpp$@-Wno-undefined-reinterpret-cast'
-build:clang --per_file_copt='rcc_.*\\.cpp$@-Wno-global-constructors,-Wno-exit-time-destructors'
-build:clang --per_file_copt='moc_.*\\.cpp$@-Wno-deprecated'
-build:clang --per_file_copt='moc_.*\\.cpp$@-Wno-extra-semi-stmt'
-build:clang --per_file_copt='moc_.*\\.cpp$@-Wno-gnu-zero-variadic-macro-arguments'
-build:clang --per_file_copt='moc_.*\\.cpp$@-Wno-redundant-parens'
-build:clang --per_file_copt='moc_.*\\.cpp$@-Wno-undefined-reinterpret-cast'
-
-build:gnulike --per_file_copt='//jvm-toxcore-c@-Wno-error=switch'
-build:gnulike --per_file_copt='//jvm-toxcore-c@-Wno-parentheses'
-
-# TODO(iphydf): Fix these.
-build:clang --per_file_copt='//c-toxcore@-Wno-shadow-uncaptured-local'
-build:clang --per_file_copt='//c-toxcore@-Wno-sign-compare'
-build:clang --per_file_copt='//c-toxcore@-Wno-unused-but-set-variable'
-build:clang --per_file_copt='//jvm-toxcore-c@-Wno-global-constructors,-Wno-exit-time-destructors'
-build:clang --per_file_copt='//qtox@-Wno-comma'
-build:clang --per_file_copt='//qtox@-Wno-deprecated'
-build:clang --per_file_copt='//qtox@-Wno-documentation'
-build:clang --per_file_copt='//qtox@-Wno-documentation-unknown-command'
-build:clang --per_file_copt='//qtox@-Wno-double-promotion'
-build:clang --per_file_copt='//qtox@-Wno-duplicate-enum'
-build:clang --per_file_copt='//qtox@-Wno-float-equal'
-build:clang --per_file_copt='//qtox@-Wno-global-constructors,-Wno-exit-time-destructors'
-build:clang --per_file_copt='//qtox@-Wno-implicit-fallthrough'
-build:clang --per_file_copt='//qtox@-Wno-inconsistent-missing-destructor-override'
-build:clang --per_file_copt='//qtox@-Wno-missing-prototypes'
-build:clang --per_file_copt='//qtox@-Wno-non-virtual-dtor'
-build:clang --per_file_copt='//qtox@-Wno-error=range-loop-analysis'
-build:clang --per_file_copt='//qtox@-Wno-shadow'
-build:clang --per_file_copt='//qtox@-Wno-shadow-field'
-build:clang --per_file_copt='//qtox@-Wno-suggest-destructor-override'
-build:clang --per_file_copt='//qtox@-Wno-suggest-override'
-build:clang --per_file_copt='//qtox@-Wno-switch-enum'
-build:clang --per_file_copt='//qtox@-Wno-undef'
-build:clang --per_file_copt='//qtox@-Wno-unreachable-code-break'
-build:clang --per_file_copt='//qtox@-Wno-unreachable-code-return'
-build:clang --per_file_copt='//qtox@-Wno-unused-but-set-variable'
-build:clang --per_file_copt='//qtox@-Wno-unused-macros'
-build:clang --per_file_copt='//qtox@-Wno-used-but-marked-unused'
-build:clang --per_file_copt='//qtox@-Wno-weak-vtables'
-build:clang --per_file_copt='//toxic@-Wno-cast-align'
-build:clang --per_file_copt='//toxic@-Wno-cast-qual'
-build:clang --per_file_copt='//toxic@-Wno-format-nonliteral'
-build:clang --per_file_copt='//toxic@-Wno-implicit-fallthrough'
-build:clang --per_file_copt='//toxic@-Wno-missing-prototypes'
-build:clang --per_file_copt='//toxic@-Wno-missing-variable-declarations'
-build:clang --per_file_copt='//toxic@-Wno-shadow'
-build:clang --per_file_copt='//toxic@-Wno-sign-compare'
-build:clang --per_file_copt='//toxic@-Wno-switch-enum'
-build:clang --per_file_copt='//toxic@-Wno-undef'
-build:clang --per_file_copt='//toxic@-Wno-unreachable-code-return'
-build:clang --per_file_copt='//toxic@-Wno-unused-macros'
-build:clang --per_file_copt='//toxins@-Wno-cast-align'
-build:clang --per_file_copt='//toxins@-Wno-global-constructors,-Wno-exit-time-destructors'
-build:clang --per_file_copt='//toxins@-Wno-missing-prototypes'
-build:clang --per_file_copt='//toxins@-Wno-missing-variable-declarations'
-build:clang --per_file_copt='//toxins@-Wno-non-virtual-dtor'
-build:clang --per_file_copt='//toxins@-Wno-old-style-cast'
-build:clang --per_file_copt='//toxins@-Wno-sign-compare'
-build:clang --per_file_copt='//toxins@-Wno-switch-enum'
-build:clang --per_file_copt='//toxins@-Wno-unreachable-code'
-build:clang --per_file_copt='//toxins@-Wno-unreachable-code-return'
-build:gcc --per_file_copt='//c-toxcore@-Wno-error=pedantic'
-build:gcc --per_file_copt='//toxic@-Wno-format-overflow'
-build:gcc --per_file_copt='//toxic@-Wno-format-truncation'
-build:gcc --per_file_copt='//toxic@-Wno-nonnull'
-build:gcc --per_file_copt='//toxic@-Wno-overflow'
-build:gcc --per_file_copt='//toxins@-Wno-format-overflow'
-
-# Ignore warnings for Go generated internal files and external libraries.
-build:gnulike --per_file_copt='/go_default_library%@-w'
-
-# Ignore warnings for protobuf generated files.
-build:gnulike --per_file_copt='\\.pb\\.cc$@-w'
-
-# Disable some clang warnings on various third party dependencies.
-build:clang --per_file_copt='external/benchmark[:/]@-Wno-weak-vtables'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-bool-operation'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-braced-scalar-init'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-dangling-else'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-deprecated-pragma'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-implicit-const-int-float-conversion'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-incompatible-pointer-types-discards-qualifiers'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-parentheses'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-pointer-bool-conversion'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-shorten-64-to-32'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-sometimes-uninitialized'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-string-plus-int'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-switch'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-tautological-constant-out-of-range-compare'
-build:clang --per_file_copt='external/ffmpeg[:/]@-Wno-unneeded-internal-declaration'
-build:clang --per_file_copt='external/ffmpeg/fftools[:/]@-Wno-single-bit-bitfield-constant-conversion'
-build:clang --per_file_copt='external/libconfig[:/]@-Wno-deprecated-non-prototype'
-build:clang --per_file_copt='external/libconfig[:/]@-Wno-unused-but-set-variable'
-build:clang --per_file_copt='external/libsodium[:/]@-Wno-unknown-pragmas'
-build:clang --per_file_copt='external/libsodium[:/]@-Wno-unused-function'
-build:clang --per_file_copt='external/libsodium[:/]@-Wno-unused-variable'
-build:clang --per_file_copt='external/libvpx[:/]@-Wno-unused-but-set-variable'
-build:clang --per_file_copt='external/libzmq[:/]@-Wno-unused-variable'
-build:clang --per_file_copt='external/sdl2[:/]@-Wno-unused-but-set-variable'
-build:clang --per_file_copt='external/xcb[:/]@-Wno-unused-but-set-variable'
-build:clang --per_file_copt='external/zlib[:/]@-Wno-deprecated-non-prototype'
-build:clang --host_per_file_copt='external/zlib[:/]@-Wno-deprecated-non-prototype'
-build:gcc --per_file_copt='external/ffmpeg[:/]@-Wno-array-parameter'
-build:gcc --per_file_copt='external/ffmpeg[:/]@-Wno-bool-operation'
-build:gcc --per_file_copt='external/ffmpeg[:/]@-Wno-discarded-qualifiers'
-build:gcc --per_file_copt='external/ffmpeg[:/]@-Wno-format-truncation'
-build:gcc --per_file_copt='external/ffmpeg[:/]@-Wno-int-in-bool-context'
-build:gcc --per_file_copt='external/ffmpeg[:/]@-Wno-maybe-uninitialized'
-build:gcc --per_file_copt='external/ffmpeg[:/]@-Wno-stringop-overread'
-build:gcc --per_file_copt='external/ffmpeg[:/]@-Wno-stringop-truncation'
-build:gcc --per_file_copt='external/libidn2[:/]@-Wno-unused-const-variable'
-build:gcc --per_file_copt='external/opus[:/]@-Wno-maybe-uninitialized'
-
-build:clang --per_file_copt='external/openal[:/]@-std=c++17'
-build:clang --per_file_copt='external/openal[:/]@-Wno-unused-value'
-build:gcc --host_per_file_copt='external/openal[:/]@-Wno-use-after-free'
-
-build:clang --per_file_copt='external/tcl[:/]@-Wno-typedef-redefinition'
-build:gnulike      --per_file_copt='external/tcl[:/]@-Wno-unused'
-build:gnulike --host_per_file_copt='external/tcl[:/]@-Wno-unused'
-
-build:gcc      --per_file_copt='external/yasm[:/]@-Wno-format-overflow'
-build:gcc --host_per_file_copt='external/yasm[:/]@-Wno-format-overflow'
-build:gcc      --per_file_copt='external/yasm[:/]@-Wno-stringop-truncation'
-build:gcc --host_per_file_copt='external/yasm[:/]@-Wno-stringop-truncation'
-build:gcc      --per_file_copt='external/yasm[:/]@-Wno-tautological-compare'
-build:gcc --host_per_file_copt='external/yasm[:/]@-Wno-tautological-compare'
-build:gnulike      --per_file_copt='external/yasm[:/]@-Wno-misleading-indentation'
-build:gnulike --host_per_file_copt='external/yasm[:/]@-Wno-misleading-indentation'
-build:gnulike      --per_file_copt='external/yasm[:/]@-Wno-unused-but-set-variable'
-build:gnulike --host_per_file_copt='external/yasm[:/]@-Wno-unused-but-set-variable'
+# snprintf is marked unused.
+build:windows-x86_64 --per_file_copt='//c-toxcore/toxcore:network.c@-Wno-used-but-marked-unused'
 
 ##############################################################################
 #
-# :: System/compiler-specific optional flags.
+# :: Continuous Integration and docker build flags
 #
 ##############################################################################
 
-build --config=clang
-
-# Flags for systems with GNU linker or compatible.
-build --host_linkopt='-Wl,-z,noexecstack'
-#build --host_linkopt='-Wl,--fatal-warnings'
-#build --host_linkopt='-Wl,--warn-common'
-build --host_linkopt='-fPIE'
-# Not enabled, because (at least - I gave up when trying to fix libvpx)
-# libsodium and libvpx assembly code doesn't define noexecstack.
-#build --host_linkopt='-Wl,--warn-execstack'
-
 # Continuous Integration platforms tend to not have IPv6.
 build:ci --per_file_copt='//c-toxcore/auto_tests@-DUSE_IPV6=0'
 build:ci --curses=no
@@ -589,11 +664,11 @@ build:windows-x86_64 --build_tag_filters=-no-cross,-macos
 
 # Pick *one* of these for the target platform. "nix" is the default Linux target.
 # TODO(iphydf): Move to .bazelrc.local.
-#build --config=linux-arm64-musl
+build --config=linux-arm64-musl
 #build --config=linux-x86_64-musl
 #build --config=windows-x86_64
 #build --config=remote-exec
-build --config=nix
+#build --config=nix
 
 try-import %workspace%/.bazelrc.local
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44d7b007..33341aa0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,6 +61,9 @@ jobs:
       - name: Build toxchat/toktok-stack:latest-arm64
         run: docker build -t toxchat/toktok-stack:latest-arm64 -f tools/built/src/Dockerfile.arm64 .
 
+      - name: Build toxchat/toktok-stack:latest-windows
+        run: docker build -t toxchat/toktok-stack:latest-windows -f tools/built/src/Dockerfile.windows .
+
       - name: Build toxchat/toktok-stack:latest-dev
         run: |
           sed -i -e 's/ --remote_download_outputs=all//' tools/built/src/setup-dev.sh
diff --git a/WORKSPACE b/WORKSPACE
index 9291ebf9..6507d525 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -3,6 +3,7 @@ workspace(name = "toktok")
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("//tools/workspace:github.bzl", "github_archive", "new_github_archive")
 
+# https://github.com/bazelbuild/bazel-skylib
 github_archive(
     name = "bazel_skylib",
     repo = "bazelbuild/bazel-skylib",
@@ -17,8 +18,8 @@ github_archive(
 github_archive(
     name = "hermetic_cc_toolchain",
     repo = "uber/hermetic_cc_toolchain",
-    sha256 = "c35f6e2110cdb147964fabe94fad6d30749d7b9d853cc8cb24890a9269d4153b",
-    version = "v2.1.3",
+    sha256 = "be4f8151f773d03b2a19a9705ef9bd7fe2bf343b7502abb42445ea2fe3f5a7e3",
+    version = "v2.2.1",
 )
 
 # hermetic_cc_toolchain
@@ -35,11 +36,12 @@ register_toolchains(
     "//third_party/zig:x86_64-linux-nix_toolchain",
 )
 
+# https://github.com/aherrmann/rules_zig
 github_archive(
     name = "rules_zig",
     repo = "aherrmann/rules_zig",
-    sha256 = "c89162afd5d78591d9ffd1e22a386feeb9e26f185b982f619d5c7b0aaf3f15ad",
-    version = "0363e3f65dae45cb29c76d457cb8a4bd4654604c",
+    sha256 = "0a7da1ea28abd2dcb09f01917c49f1036861a8a17366793455fdd9e723600bf1",
+    version = "766a11afd418c181babbf01b121748ded37938d1",
 )
 
 load(
@@ -58,6 +60,7 @@ zig_register_toolchains(
 # Fuzzing
 # =========================================================
 
+# https://github.com/bazelbuild/rules_fuzzing
 github_archive(
     name = "rules_fuzzing",
     repo = "bazelbuild/rules_fuzzing",
@@ -80,6 +83,7 @@ install_deps()
 # Go
 # =========================================================
 
+# https://github.com/bazelbuild/rules_go
 github_archive(
     name = "io_bazel_rules_go",
     repo = "bazelbuild/rules_go",
@@ -90,6 +94,7 @@ github_archive(
     # version = "v0.45.1",
 )
 
+# https://github.com/bazelbuild/bazel-gazelle
 github_archive(
     name = "bazel_gazelle",
     repo = "bazelbuild/bazel-gazelle",
@@ -104,11 +109,12 @@ go_rules_dependencies()
 # Nixpkgs
 # =========================================================
 
+# https://github.com/tweag/rules_haskell
 github_archive(
     name = "rules_haskell",
     repo = "tweag/rules_haskell",
-    sha256 = "955e2fcd758babac3742d3d4775788692bd54366460754bc33bc928185fcae4c",
-    version = "ff51c3652a07d0c413cbc7bbf8967825c49f3b40",
+    sha256 = "6c38d06e58d7c4d95985e7c3923c84c1341a32a9e26446c72b2efea5290d3da6",
+    version = "3a2cad09c20dcd728d9a136cd8d60abe11378915",
 )
 
 load(
@@ -215,6 +221,7 @@ nixpkgs_java_configure(
     toolchain_version = "11",
 )
 
+# https://github.com/bazelbuild/rules_proto
 github_archive(
     name = "rules_proto",
     repo = "bazelbuild/rules_proto",
@@ -222,6 +229,7 @@ github_archive(
     version = "6.0.0-rc1",
 )
 
+# https://github.com/bazelbuild/rules_pkg
 github_archive(
     name = "rules_pkg",
     repo = "bazelbuild/rules_pkg",
@@ -254,6 +262,7 @@ http_archive(
     ],
 )
 
+# https://github.com/bazelbuild/rules_jvm_external
 github_archive(
     name = "rules_jvm_external",
     repo = "bazelbuild/rules_jvm_external",
@@ -261,6 +270,7 @@ github_archive(
     version = "5.3",
 )
 
+# https://github.com/bazelbuild/stardoc
 github_archive(
     name = "io_bazel_stardoc",
     repo = "bazelbuild/stardoc",
@@ -268,6 +278,7 @@ github_archive(
     version = "0.6.2",
 )
 
+# https://github.com/bazelbuild/rules_kotlin
 github_archive(
     name = "rules_kotlin",
     repo = "bazelbuild/rules_kotlin",
@@ -411,11 +422,12 @@ http_archive(
     urls = ["http://dist.schmorp.de/libev/libev-4.33.tar.gz"],
 )
 
+# https://github.com/google/boringssl
 github_archive(
     name = "boringssl",
     repo = "google/boringssl",
-    sha256 = "9a1a9db5d0f6c1add527cccbd86a1bb75659afb4f9e1c26f44c97c3517db2400",
-    version = "bf221ee64323dcebd2c64bd4c4a3269fc231d2bf",
+    sha256 = "383fd3e5ac59ab15b372d2e39efdfaf507ed480b9e0e92bb218128d96bc3d611",
+    version = "311e6f6d8e77da1f64c3256b30bd1992a555ce6c",
 )
 
 http_archive(
@@ -426,13 +438,15 @@ http_archive(
     urls = ["http://http.debian.net/debian/pool/main/b/bzip2/bzip2_1.0.8.orig.tar.gz"],
 )
 
+# https://github.com/google/googletest
 github_archive(
     name = "com_google_googletest",
     repo = "google/googletest",
-    sha256 = "93b52882cff4e8fb344070106facee0df5e61be91b1948a69c8581b3bcbe0c61",
-    version = "b3a9ba2b8e975550799838332803d468797ae2e1",
+    sha256 = "1f357c27ca988c3f7c6b4bf68a9395005ac6761f034046e9dde0896e3aba00e4",
+    version = "v1.14.0",
 )
 
+# https://github.com/google/benchmark
 github_archive(
     name = "benchmark",
     repo = "google/benchmark",
@@ -440,18 +454,20 @@ github_archive(
     version = "v1.8.3",
 )
 
+# https://github.com/curl/curl
 new_github_archive(
     name = "curl",
     repo = "curl/curl",
-    sha256 = "a5850615a9f4a1fdf55dc6023cf9b10c8b320eb6cc17ed77dc7edb7603e06684",
-    version = "curl-8_2_1",
+    sha256 = "36dc348e94666f297039b7cd954532db44f59039167b4c654bf417bcb1e584b3",
+    version = "curl-8_5_0",
 )
 
+# https://github.com/FFmpeg/nv-codec-headers
 new_github_archive(
     name = "ffnvcodec",
     repo = "FFmpeg/nv-codec-headers",
-    sha256 = "f1fd5adb2ed6815e7debff30cb44b21188dc65da42b7a67537f28256e8e71c29",
-    version = "250292dd20af60edc6e0d07f1d6e489a2f8e1c44",
+    sha256 = "c4d1a7c624cb6f107c276c5218eeb0e60f65548d3f600d6abc68260edaae765a",
+    version = "75f032b24263c2b684b9921755cafc1c08e41b9d",
 )
 
 http_archive(
@@ -465,9 +481,9 @@ http_archive(
 http_archive(
     name = "gettext",
     build_file = "@toktok//third_party:BUILD.gettext",
-    sha256 = "839a260b2314ba66274dae7d245ec19fce190a3aa67869bf31354cb558df42c7",
-    strip_prefix = "gettext-0.22.3",
-    urls = ["https://ftp.gnu.org/pub/gnu/gettext/gettext-0.22.3.tar.gz"],
+    sha256 = "c1e0bb2a4427a9024390c662cd532d664c4b36b8ff444ed5e54b115fdb7a1aea",
+    strip_prefix = "gettext-0.22.4",
+    urls = ["https://ftp.gnu.org/pub/gnu/gettext/gettext-0.22.4.tar.gz"],
 )
 
 nixpkgs_package(
@@ -512,18 +528,20 @@ http_archive(
     urls = ["https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/libcap-2.33.tar.gz"],
 )
 
+# https://github.com/hyperrealm/libconfig
 new_github_archive(
     name = "libconfig",
     repo = "hyperrealm/libconfig",
-    sha256 = "a3ae202153fafb40558c26831429ce39845b2395ad8d30269a50e309a7585a8c",
-    version = "v1.7.2",
+    sha256 = "6552f0872929a90c25d161a817e701f149a78ddc2d74a5256ffd575c4765cc0d",
+    version = "v1.7.3",
 )
 
+# https://github.com/libexif/libexif
 new_github_archive(
     name = "libexif",
     repo = "libexif/libexif",
-    sha256 = "7f283fee7c949944eb3e0066cd5763355dc5591ad15ea96910cb2f24adca43f3",
-    version = "154189b77491191e00e1204083ab51c4ad5a60ff",
+    sha256 = "34bbe47d4ae7fbb98d56def87f3afb187364396039a608667222be8d414a2317",
+    version = "0477ce1f39565332d0bb6d26c04324259f172809",
 )
 
 http_archive(
@@ -534,6 +552,7 @@ http_archive(
     urls = ["https://ftp.gnu.org/gnu/libidn/libidn2-2.3.0.tar.gz"],
 )
 
+# https://github.com/fukuchi/libqrencode
 new_github_archive(
     name = "libqrencode",
     repo = "fukuchi/libqrencode",
@@ -541,6 +560,7 @@ new_github_archive(
     version = "715e29fd4cd71b6e452ae0f4e36d917b43122ce8",
 )
 
+# https://github.com/jedisct1/libsodium
 new_github_archive(
     name = "libsodium",
     patches = ["@toktok//third_party/patches:libsodium.patch"],
@@ -549,13 +569,15 @@ new_github_archive(
     version = "1.0.19",
 )
 
+# https://github.com/webmproject/libvpx
 new_github_archive(
     name = "libvpx",
     repo = "webmproject/libvpx",
-    sha256 = "24ab597b3598503e9af89262bcacda2185e7865ddcb2cf004355833bc33fcf1b",
-    version = "v1.13.1",
+    sha256 = "946835f055f8c9604d503557b7b581db93f580dac876dddf8ef4f28e51dd9f3b",
+    version = "v1.14.0",
 )
 
+# https://github.com/zeromq/libzmq
 new_github_archive(
     name = "libzmq",
     repo = "zeromq/libzmq",
@@ -563,6 +585,7 @@ new_github_archive(
     version = "v4.3.5",
 )
 
+# https://github.com/kcat/openal-soft
 new_github_archive(
     name = "openal",
     repo = "kcat/openal-soft",
@@ -572,6 +595,7 @@ new_github_archive(
     version = "openal-soft-1.20.1",
 )
 
+# https://github.com/xiph/opus
 new_github_archive(
     name = "opus",
     repo = "xiph/opus",
@@ -619,18 +643,20 @@ http_archive(
     # urls = ["https://www.libsdl.org/release/SDL2-2.28.5.tar.gz"],
 )
 
+# https://github.com/sqlcipher/sqlcipher
 new_github_archive(
     name = "sqlcipher",
     repo = "sqlcipher/sqlcipher",
-    sha256 = "a35364ce8ecbcf4f3ef21d5e4139cea0f6bec3aaaeb749bae3c2988fcc2b1b6a",
-    version = "v4.5.5",
+    sha256 = "5d269166c33c39c4dc6fc14be4ac8cd78b022f8bd59b0775becf0c896331a539",
+    version = "v4.5.6",
 )
 
+# https://github.com/tcltk/tcl
 new_github_archive(
     name = "tcl",
     repo = "tcltk/tcl",
-    sha256 = "a2a8789d6fbe8dcbb17ed5c19d71539045f818cf657128bcef8740f6a40436f7",
-    version = "149b0e616bdf5f74071665caf6bf4f59d80ea0fc",
+    sha256 = "f9e6cdf634320673daaf2b7ad5d466c796f4dc161600eb1552bd861e0a0b0b89",
+    version = "83d99eabcf81170811c5e493c6d3626bc07414a8",
 )
 
 nixpkgs_package(
@@ -699,16 +725,18 @@ nixpkgs_package(
     repository = "@nixpkgs",
 )
 
+# https://github.com/yasm/yasm
 new_github_archive(
     name = "yasm",
     repo = "yasm/yasm",
-    sha256 = "3d0938894e065b10a1a14b6e29e67208125dab18f6061bc6b73713cd75dd265d",
-    version = "2cd3bb50e256f5ed5f611ac611d25fe673f2cec3",
+    sha256 = "3cdcef621265b50d2db6ca8ee9a498411999a9584cad857b1cc20314b03c7664",
+    version = "9defefae9fbcb6958cddbfa778c1ea8605da8b8b",
 )
 
 # Apple frameworks
 # =========================================================
 
+# https://github.com/bazelbuild/rules_apple
 github_archive(
     name = "build_bazel_rules_apple",
     repo = "bazelbuild/rules_apple",
@@ -716,6 +744,7 @@ github_archive(
     version = "07f5f2dd14f56e54eaca176630450c2abcc52eb9",
 )
 
+# https://github.com/bazelbuild/rules_swift
 github_archive(
     name = "build_bazel_rules_swift",
     repo = "bazelbuild/rules_swift",
@@ -723,6 +752,7 @@ github_archive(
     version = "7b8558cab8e402eb21e2fc655989bae378171486",
 )
 
+# https://github.com/bazelbuild/apple_support
 github_archive(
     name = "build_bazel_apple_support",
     repo = "bazelbuild/apple_support",
@@ -783,20 +813,23 @@ python_repository(
     name = "python3",
 )
 
+# https://github.com/cython/cython
 github_archive(
     name = "cython",
     repo = "cython/cython",
-    sha256 = "6fac075cab5fed1e20a284b1caba3ac09b31867daef480f0149eec1a1c981c61",
-    version = "3.0.7",
+    sha256 = "ca1d767ebd1296f4dc93da397595f9ea3cd5f7d3347748b12c19cfd9eee6fee7",
+    version = "3.0.8",
 )
 
+# https://github.com/python/mypy
 new_github_archive(
     name = "mypy",
     repo = "python/mypy",
-    sha256 = "57788ce99c6e7e6f41ac9e5f514a08ee4b2121847e3dcaa16a1aec941d025d27",
-    version = "v1.6.0",
+    sha256 = "9fa0ac71f11162280e54768381614d1ad0b1648e4198633a9033bbad7574ce67",
+    version = "v1.8.0",
 )
 
+# https://github.com/python/mypy_extensions
 new_github_archive(
     name = "mypy_extensions",
     repo = "python/mypy_extensions",
@@ -804,6 +837,7 @@ new_github_archive(
     version = "1.0.0",
 )
 
+# https://github.com/python/typing_extensions
 new_github_archive(
     name = "typing_extensions",
     repo = "python/typing_extensions",
@@ -815,6 +849,7 @@ new_github_archive(
 # Node.js
 # =========================================================
 
+# https://github.com/bazelbuild/rules_nodejs
 github_archive(
     name = "build_bazel_rules_nodejs",
     repo = "bazelbuild/rules_nodejs",
@@ -840,108 +875,10 @@ npm_install(
     package_lock_json = "//js-toxcore-c:package-lock.json",
 )
 
-## Node.js
-## =========================================================
-#
-##github_archive(
-##    name = "rules_codeowners",
-##    repo = "zegl/rules_codeowners",
-##    #sha256 = "06910242c6d47c5719efd5789cf34dac393034dc0fe4c73f1ed3aac739ffabdc",
-##    version = "bdc2f987cd0e15ebfa9b76689a4c9a472730a6f0",
-##)
-##
-##github_archive(
-##    name = "build_bazel_rules_nodejs",
-##    repo = "bazelbuild/rules_nodejs",
-##    sha256 = "171bdbd8386576ed2f6a3f8aff87eeb048f963981870a3a8432be7d12cf5b2cc",
-##    version = "1.3.0",
-##)
-##
-##load("@build_bazel_rules_nodejs//:index.bzl", "yarn_install")
-##
-##yarn_install(
-##    name = "npm",
-##    package_json = "//js-toxcore-c:package.json",
-##    yarn_lock = "//js-toxcore-c:yarn.lock",
-##)
-#
-##load("@npm//:install_bazel_dependencies.bzl", "install_bazel_dependencies")
-##install_bazel_dependencies()
-#
-##load("@org_pubref_rules_node//node:rules.bzl", "node_repositories", "yarn_modules")
-##
-##node_repositories()
-##
-##yarn_modules(
-##    name = "yarn_modules",
-##    install_tools = [
-##        "sh",
-##        "dirname",
-##    ],
-##    deps = {
-##        "ansi-to-html": "0.6.4",
-##        "async": "2.6.0",
-##        "buffertools": "2.1.6",
-##        "ffi": "2.2.0",
-##        "firebase": "3.9.0",
-##        "firepad": "1.4.0",
-##        "grunt": "1.0.1",
-##        "grunt-jsdoc": "2.2.1",
-##        "grunt-shell": "2.1.0",
-##        "ink-docstrap": "1.3.2",
-##        "jsdoc": "3.5.5",
-##        "mktemp": "0.4.0",
-##        "mocha": "3.5.3",
-##        "ref": "1.3.5",
-##        "ref-array": "1.2.0",
-##        "ref-struct": "1.1.0",
-##        "should": "13.2.1",
-##        "underscore": "1.8.3",
-##    },
-##)
-##
-##yarn_modules(
-##    name = "mocha_modules",
-##    deps = {"mocha": "3.5.3"},
-##)
-#
-## Compilation database
-## =========================================================
-#
-## Tool used for creating a compilation database.
-#github_archive(
-#    name = "io_kythe",
-#    repo = "kythe/kythe",
-#    sha256 = "6e4358e780768cae8a98ddf7059e588228bfd3319b24a4ab03cedc84231b14b4",
-#    version = "v0.0.63",
-#)
-#
-#http_archive(
-#    name = "com_github_tencent_rapidjson",
-#    build_file = "@io_kythe//third_party:rapidjson.BUILD",
-#    sha256 = "e6fc99c7df7f29995838a764dd68df87b71db360f7727ace467b21b82c85efda",
-#    strip_prefix = "rapidjson-8f4c021fa2f1e001d2376095928fc0532adf2ae6",
-#    url = "https://github.com/Tencent/rapidjson/archive/8f4c021fa2f1e001d2376095928fc0532adf2ae6.zip",
-#)
-#
-#new_github_archive(
-#    name = "com_github_google_glog",
-#    build_file_content = "\n".join([
-#        "load(\"//:bazel/glog.bzl\", \"glog_library\")",
-#        "glog_library(with_gflags=0)",
-#    ]),
-#    repo = "google/glog",
-#    sha256 = "feca3c7e29a693cab7887409756d89d342d4a992d54d7c5599bebeae8f7b50be",
-#    version = "3ba8976592274bc1f907c402ce22558011d6fc5e",
-#)
-#
-#load("@io_kythe//:setup.bzl", "kythe_rule_repositories")
-#
-#kythe_rule_repositories()
-
 # Tox Extension modules
 # =========================================================
 
+# https://github.com/toxext/toxext
 new_github_archive(
     name = "toxext",
     repo = "toxext/toxext",
@@ -949,6 +886,7 @@ new_github_archive(
     version = "v0.0.3",
 )
 
+# https://github.com/toxext/tox_extension_messages
 new_github_archive(
     name = "tox_extension_messages",
     repo = "toxext/tox_extension_messages",
diff --git a/c-toxcore b/c-toxcore
index 5bdaaaed..ca4606d4 160000
--- a/c-toxcore
+++ b/c-toxcore
@@ -1 +1 @@
-Subproject commit 5bdaaaedb60b69f60a9c3174bb41fc3ca626dc8a
+Subproject commit ca4606d49da66fc4e553f95910c233704b811b7d
diff --git a/experimental b/experimental
index f225bb73..55d91448 160000
--- a/experimental
+++ b/experimental
@@ -1 +1 @@
-Subproject commit f225bb73f1cb3736dcfe99ca06ad74b184f7f3e9
+Subproject commit 55d91448bdce48ca515e40499103596fee044e32
diff --git a/third_party/BUILD.libidn2 b/third_party/BUILD.libidn2
index 0116508e..cb4e2ec9 100644
--- a/third_party/BUILD.libidn2
+++ b/third_party/BUILD.libidn2
@@ -61,6 +61,7 @@ cc_library(
         "unistring/uniconv/u8-conv-from-enc.c",
         "unistring/uniconv/u8-strconv-from-enc.c",
         "unistring/uniconv/u8-strconv-from-locale.c",
+        "unistring/uniconv/u8-strconv-to-enc.c",
         "unistring/unictype/bidi_of.c",
         "unistring/unictype/bidi_of.h",
         "unistring/unictype/bitmap.h",
@@ -92,8 +93,10 @@ cc_library(
         "unistring/uninorm/u-normalize-internal.h",
         "unistring/uninorm/u32-normalize.c",
         "unistring/unistr/u-cpy.h",
+        "unistring/unistr/u-cpy-alloc.h",
         "unistring/unistr/u-strlen.h",
         "unistring/unistr/u32-cpy.c",
+        "unistring/unistr/u32-cpy-alloc.c",
         "unistring/unistr/u32-strlen.c",
         "unistring/unistr/u32-to-u8.c",
         "unistring/unistr/u8-check.c",
@@ -167,6 +170,7 @@ cc_library(
         "lib/context.h",
         "lib/data.c",
         "lib/data.h",
+        "lib/decode.c",
         "lib/error.c",
         "lib/free.c",
         "lib/idna.c",
diff --git a/third_party/BUILD.libvpx b/third_party/BUILD.libvpx
index 918264b9..a64b841b 100644
--- a/third_party/BUILD.libvpx
+++ b/third_party/BUILD.libvpx
@@ -50,6 +50,7 @@ export PATH="$$PATH:$$PWD/gcc-wrapper"
     --disable-webm-io \
     --enable-pic \
     --enable-shared \
+    --enable-postproc \
     --enable-vp9-temporal-denoising \
     --enable-vp9-highbitdepth \
     --enable-error-concealment \
@@ -173,7 +174,8 @@ cc_library(
             "**/ppc/**",
             "**/x86/**",
             "vp8/encoder/mr_dissim.c",
-            "vpx_ports/arm_cpudetect.c",
+            "vpx_ports/aarch32_cpudetect.c",
+            "vpx_ports/aarch64_cpudetect.c",
             "vpx_ports/loongarch_cpudetect.c",
             "vpx_ports/mips_cpudetect.c",
             "vpx_ports/ppc_cpudetect.c",
@@ -182,10 +184,8 @@ cc_library(
     ) + select({
         "@toktok//tools/config:arm64": glob(
             ["vp*/**/arm/**/*.c"],
-            exclude = [
-                "vpx_dsp/arm/vpx_convolve8_neon.c",
-            ],
-        ) + ["vpx_ports/arm_cpudetect.c"],
+            exclude = ["vpx_dsp/arm/vpx_convolve8_neon_asm.c"],
+        ) + ["vpx_ports/aarch64_cpudetect.c"],
         "@toktok//tools/config:x86_64": glob(
             ["vp*/**/x86/**/*.c"],
             exclude = ["**/*_avx512.c"],
diff --git a/third_party/libvpx/linux-arm64/libs-arm64-linux-gcc.mk b/third_party/libvpx/linux-arm64/libs-arm64-linux-gcc.mk
old mode 100755
new mode 100644
index ca799f72..67e422bf
--- a/third_party/libvpx/linux-arm64/libs-arm64-linux-gcc.mk
+++ b/third_party/libvpx/linux-arm64/libs-arm64-linux-gcc.mk
@@ -6,24 +6,24 @@
 ## in the file PATENTS.  All contributing project authors may
 ## be found in the AUTHORS file in the root of the source tree.
 # This file automatically generated by configure. Do not edit!
-SRC_PATH="/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/408/execroot/toktok/external/libvpx"
-SRC_PATH_BARE=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/408/execroot/toktok/external/libvpx
+SRC_PATH="/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/12111/execroot/toktok/external/libvpx"
+SRC_PATH_BARE=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/12111/execroot/toktok/external/libvpx
 BUILD_PFX=
 TOOLCHAIN=arm64-linux-gcc
-ASM_CONVERSION=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/408/execroot/toktok/external/libvpx/build/make/ads2gas.pl
+ASM_CONVERSION=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/12111/execroot/toktok/external/libvpx/build/make/ads2gas.pl
 GEN_VCPROJ=
 MSVS_ARCH_DIR=
 
-CC=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/408/execroot/toktok/external/zig_sdk/tools/aarch64-linux-musl/c++
-CXX=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/408/execroot/toktok/external/zig_sdk/tools/aarch64-linux-musl/c++
+CC=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/12111/execroot/toktok/external/zig_sdk/tools/aarch64-linux-musl/c++
+CXX=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/12111/execroot/toktok/external/zig_sdk/tools/aarch64-linux-musl/c++
 AR=ar
 LD=gcc
 AS=as
 STRIP=strip
 NM=nm
 
-CFLAGS  =  -DNDEBUG -O3 -fPIC -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wdeclaration-after-statement -Wdisabled-optimization -Wextra-semi -Wextra-semi-stmt -Wfloat-conversion -Wformat=2 -Wparentheses-equality -Wpointer-arith -Wtype-limits -Wcast-qual -Wvla -Wimplicit-function-declaration -Wmissing-declarations -Wmissing-prototypes -Wuninitialized -Wunreachable-code-loop-increment -Wunused -Wextra -Wundef -Wframe-larger-than=52000 -std=gnu89 -Wshorten-64-to-32
-CXXFLAGS  =  -DNDEBUG -O3 -fPIC -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wdeclaration-after-statement -Wdisabled-optimization -Wextra-semi -Wextra-semi-stmt -Wfloat-conversion -Wformat=2 -Wparentheses-equality -Wpointer-arith -Wtype-limits -Wcast-qual -Wvla -Wimplicit-function-declaration -Wmissing-declarations -Wmissing-prototypes -Wuninitialized -Wunreachable-code-loop-increment -Wunused -Wextra -Wno-psabi -Wc++14-extensions -Wc++17-extensions -Wc++20-extensions -std=gnu++11 -std=gnu++11
+CFLAGS  =  -DNDEBUG -O3 -fPIC -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wdisabled-optimization -Wextra-semi -Wextra-semi-stmt -Wfloat-conversion -Wformat=2 -Wparentheses-equality -Wpointer-arith -Wtype-limits -Wcast-qual -Wvla -Wimplicit-function-declaration -Wmissing-declarations -Wmissing-prototypes -Wshadow -Wuninitialized -Wunreachable-code-aggressive -Wunused -Wextra -Wundef -Wframe-larger-than=52000 -std=gnu99 -Wshorten-64-to-32
+CXXFLAGS  =  -DNDEBUG -O3 -fPIC -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wdisabled-optimization -Wextra-semi -Wextra-semi-stmt -Wfloat-conversion -Wformat=2 -Wparentheses-equality -Wpointer-arith -Wtype-limits -Wcast-qual -Wvla -Wimplicit-function-declaration -Wmissing-declarations -Wmissing-prototypes -Wshadow -Wuninitialized -Wunreachable-code-aggressive -Wunused -Wextra -Wno-psabi -Wc++14-extensions -Wc++17-extensions -Wc++20-extensions -Wnon-virtual-dtor -std=gnu++11 -std=gnu++11
 ARFLAGS = -crs$(if $(quiet),,v)
 LDFLAGS = 
 ASFLAGS =  -march=armv8-a
@@ -32,10 +32,15 @@ AS_SFX    = .S
 EXE_SFX   = 
 VCPROJ_SFX = 
 RTCD_OPTIONS = --disable-avx512 
-LIBYUV_CXXFLAGS =  -Wno-missing-declarations -Wno-missing-prototypes -Wno-pass-failed -Wno-unused-parameter
+LIBWEBM_CXXFLAGS =  -Wno-shadow
+LIBYUV_CXXFLAGS =  -Wno-missing-declarations -Wno-missing-prototypes -Wno-pass-failed -Wno-shadow -Wno-unused-parameter
 fmt_deps = sed -e 's;^\([a-zA-Z0-9_]*\)\.o;${@:.d=.o} $@;'
 VPX_ARCH_ARM=yes
+VPX_ARCH_AARCH64=yes
 HAVE_NEON=yes
+HAVE_NEON_DOTPROD=yes
+HAVE_NEON_I8MM=yes
+HAVE_SVE=yes
 HAVE_VPX_PORTS=yes
 HAVE_PTHREAD_H=yes
 HAVE_UNISTD_H=yes
@@ -44,6 +49,7 @@ CONFIG_INSTALL_BINS=yes
 CONFIG_INSTALL_LIBS=yes
 CONFIG_GCC=yes
 CONFIG_PIC=yes
+CONFIG_RUNTIME_CPU_DETECT=yes
 CONFIG_POSTPROC=yes
 CONFIG_VP9_POSTPROC=yes
 CONFIG_MULTITHREAD=yes
diff --git a/third_party/libvpx/linux-arm64/vpx_config.h b/third_party/libvpx/linux-arm64/vpx_config.h
index 812f13a7..66b80f1d 100644
--- a/third_party/libvpx/linux-arm64/vpx_config.h
+++ b/third_party/libvpx/linux-arm64/vpx_config.h
@@ -11,13 +11,17 @@
 #define RESTRICT    
 #define INLINE      inline
 #define VPX_ARCH_ARM 1
+#define VPX_ARCH_AARCH64 1
 #define VPX_ARCH_MIPS 0
 #define VPX_ARCH_X86 0
 #define VPX_ARCH_X86_64 0
 #define VPX_ARCH_PPC 0
 #define VPX_ARCH_LOONGARCH 0
-#define HAVE_NEON 1
 #define HAVE_NEON_ASM 0
+#define HAVE_NEON 1
+#define HAVE_NEON_DOTPROD 1
+#define HAVE_NEON_I8MM 1
+#define HAVE_SVE 1
 #define HAVE_MIPS32 0
 #define HAVE_DSPR2 0
 #define HAVE_MSA 0
@@ -56,7 +60,7 @@
 #define CONFIG_DEBUG_LIBS 0
 #define CONFIG_DEQUANT_TOKENS 0
 #define CONFIG_DC_RECON 0
-#define CONFIG_RUNTIME_CPU_DETECT 0
+#define CONFIG_RUNTIME_CPU_DETECT 1
 #define CONFIG_POSTPROC 1
 #define CONFIG_VP9_POSTPROC 1
 #define CONFIG_MULTITHREAD 1
@@ -87,7 +91,6 @@
 #define CONFIG_MULTI_RES_ENCODING 0
 #define CONFIG_TEMPORAL_DENOISING 1
 #define CONFIG_VP9_TEMPORAL_DENOISING 1
-#define CONFIG_CONSISTENT_RECODE 0
 #define CONFIG_COEFFICIENT_RANGE_CHECKING 0
 #define CONFIG_VP9_HIGHBITDEPTH 1
 #define CONFIG_BETTER_HW_COMPATIBILITY 0
@@ -100,4 +103,5 @@
 #define CONFIG_EMULATE_HARDWARE 0
 #define CONFIG_NON_GREEDY_MV 0
 #define CONFIG_RATE_CTRL 0
+#define CONFIG_COLLECT_COMPONENT_TIMING 0
 #endif /* VPX_CONFIG_H */
diff --git a/third_party/libvpx/linux-x86_64/libs-x86_64-linux-gcc.mk b/third_party/libvpx/linux-x86_64/libs-x86_64-linux-gcc.mk
index d2ba863d..d4d676c7 100644
--- a/third_party/libvpx/linux-x86_64/libs-x86_64-linux-gcc.mk
+++ b/third_party/libvpx/linux-x86_64/libs-x86_64-linux-gcc.mk
@@ -6,24 +6,24 @@
 ## in the file PATENTS.  All contributing project authors may
 ## be found in the AUTHORS file in the root of the source tree.
 # This file automatically generated by configure. Do not edit!
-SRC_PATH="/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/587/execroot/toktok/external/libvpx"
-SRC_PATH_BARE=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/587/execroot/toktok/external/libvpx
+SRC_PATH="/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/12088/execroot/toktok/external/libvpx"
+SRC_PATH_BARE=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/12088/execroot/toktok/external/libvpx
 BUILD_PFX=
 TOOLCHAIN=x86_64-linux-gcc
-ASM_CONVERSION=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/587/execroot/toktok/external/libvpx/build/make/ads2gas.pl
+ASM_CONVERSION=/home/builder/.cache/bazel/_bazel_builder/a08c2e4811c846650b733c6fc815a920/sandbox/processwrapper-sandbox/12088/execroot/toktok/external/libvpx/build/make/ads2gas.pl
 GEN_VCPROJ=
 MSVS_ARCH_DIR=
 
-CC=/nix/store/9k6s3zmhj2pvkg8a5s8n7d2sbpffv8hv-clang-wrapper-16.0.1/bin/cc
-CXX=/nix/store/9k6s3zmhj2pvkg8a5s8n7d2sbpffv8hv-clang-wrapper-16.0.1/bin/cc
+CC=/nix/store/n37gxbg343hxin3wdryx092mz2dkafy8-clang-wrapper-16.0.6/bin/cc
+CXX=/nix/store/n37gxbg343hxin3wdryx092mz2dkafy8-clang-wrapper-16.0.6/bin/cc
 AR=ar
 LD=gcc
 AS=yasm
 STRIP=strip
 NM=nm
 
-CFLAGS  =  -m64 -DNDEBUG -O3 -fPIC -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wdeclaration-after-statement -Wdisabled-optimization -Wextra-semi -Wextra-semi-stmt -Wfloat-conversion -Wformat=2 -Wparentheses-equality -Wpointer-arith -Wtype-limits -Wcast-qual -Wvla -Wimplicit-function-declaration -Wmissing-declarations -Wmissing-prototypes -Wuninitialized -Wunreachable-code-loop-increment -Wunused -Wextra -Wundef -Wframe-larger-than=52000 -std=gnu89 -Wshorten-64-to-32
-CXXFLAGS  =  -m64 -DNDEBUG -O3 -fPIC -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wdeclaration-after-statement -Wdisabled-optimization -Wextra-semi -Wextra-semi-stmt -Wfloat-conversion -Wformat=2 -Wparentheses-equality -Wpointer-arith -Wtype-limits -Wcast-qual -Wvla -Wimplicit-function-declaration -Wmissing-declarations -Wmissing-prototypes -Wuninitialized -Wunreachable-code-loop-increment -Wunused -Wextra -Wc++14-extensions -Wc++17-extensions -Wc++20-extensions -std=gnu++11 -std=gnu++11
+CFLAGS  =  -m64 -DNDEBUG -O3 -fPIC -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wdisabled-optimization -Wextra-semi -Wextra-semi-stmt -Wfloat-conversion -Wformat=2 -Wparentheses-equality -Wpointer-arith -Wtype-limits -Wcast-qual -Wvla -Wimplicit-function-declaration -Wmissing-declarations -Wmissing-prototypes -Wshadow -Wuninitialized -Wunreachable-code-aggressive -Wunused -Wextra -Wundef -Wframe-larger-than=52000 -std=gnu99 -Wshorten-64-to-32
+CXXFLAGS  =  -m64 -DNDEBUG -O3 -fPIC -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wdisabled-optimization -Wextra-semi -Wextra-semi-stmt -Wfloat-conversion -Wformat=2 -Wparentheses-equality -Wpointer-arith -Wtype-limits -Wcast-qual -Wvla -Wimplicit-function-declaration -Wmissing-declarations -Wmissing-prototypes -Wshadow -Wuninitialized -Wunreachable-code-aggressive -Wunused -Wextra -Wc++14-extensions -Wc++17-extensions -Wc++20-extensions -Wnon-virtual-dtor -std=gnu++11 -std=gnu++11
 ARFLAGS = -crs$(if $(quiet),,v)
 LDFLAGS =  -m64
 ASFLAGS =  -f elf64
@@ -32,7 +32,8 @@ AS_SFX    = .asm
 EXE_SFX   = 
 VCPROJ_SFX = 
 RTCD_OPTIONS = --disable-avx512 
-LIBYUV_CXXFLAGS =  -Wno-missing-declarations -Wno-missing-prototypes -Wno-pass-failed -Wno-unused-parameter
+LIBWEBM_CXXFLAGS =  -Wno-shadow
+LIBYUV_CXXFLAGS =  -Wno-missing-declarations -Wno-missing-prototypes -Wno-pass-failed -Wno-shadow -Wno-unused-parameter
 fmt_deps = sed -e 's;^\([a-zA-Z0-9_]*\)\.o;${@:.d=.o} $@;'
 VPX_ARCH_X86_64=yes
 HAVE_MMX=yes
diff --git a/third_party/libvpx/linux-x86_64/vpx_config.asm b/third_party/libvpx/linux-x86_64/vpx_config.asm
index 4dd57b36..45fc56f9 100644
--- a/third_party/libvpx/linux-x86_64/vpx_config.asm
+++ b/third_party/libvpx/linux-x86_64/vpx_config.asm
@@ -1,11 +1,15 @@
 VPX_ARCH_ARM equ 0
+VPX_ARCH_AARCH64 equ 0
 VPX_ARCH_MIPS equ 0
 VPX_ARCH_X86 equ 0
 VPX_ARCH_X86_64 equ 1
 VPX_ARCH_PPC equ 0
 VPX_ARCH_LOONGARCH equ 0
-HAVE_NEON equ 0
 HAVE_NEON_ASM equ 0
+HAVE_NEON equ 0
+HAVE_NEON_DOTPROD equ 0
+HAVE_NEON_I8MM equ 0
+HAVE_SVE equ 0
 HAVE_MIPS32 equ 0
 HAVE_DSPR2 equ 0
 HAVE_MSA equ 0
@@ -75,7 +79,6 @@ CONFIG_ENCODE_PERF_TESTS equ 0
 CONFIG_MULTI_RES_ENCODING equ 0
 CONFIG_TEMPORAL_DENOISING equ 1
 CONFIG_VP9_TEMPORAL_DENOISING equ 1
-CONFIG_CONSISTENT_RECODE equ 0
 CONFIG_COEFFICIENT_RANGE_CHECKING equ 0
 CONFIG_VP9_HIGHBITDEPTH equ 1
 CONFIG_BETTER_HW_COMPATIBILITY equ 0
@@ -88,3 +91,4 @@ CONFIG_FP_MB_STATS equ 0
 CONFIG_EMULATE_HARDWARE equ 0
 CONFIG_NON_GREEDY_MV equ 0
 CONFIG_RATE_CTRL equ 0
+CONFIG_COLLECT_COMPONENT_TIMING equ 0
diff --git a/third_party/libvpx/linux-x86_64/vpx_config.h b/third_party/libvpx/linux-x86_64/vpx_config.h
index 5ac9cdd3..7724d7b1 100644
--- a/third_party/libvpx/linux-x86_64/vpx_config.h
+++ b/third_party/libvpx/linux-x86_64/vpx_config.h
@@ -11,13 +11,17 @@
 #define RESTRICT    
 #define INLINE      inline
 #define VPX_ARCH_ARM 0
+#define VPX_ARCH_AARCH64 0
 #define VPX_ARCH_MIPS 0
 #define VPX_ARCH_X86 0
 #define VPX_ARCH_X86_64 1
 #define VPX_ARCH_PPC 0
 #define VPX_ARCH_LOONGARCH 0
-#define HAVE_NEON 0
 #define HAVE_NEON_ASM 0
+#define HAVE_NEON 0
+#define HAVE_NEON_DOTPROD 0
+#define HAVE_NEON_I8MM 0
+#define HAVE_SVE 0
 #define HAVE_MIPS32 0
 #define HAVE_DSPR2 0
 #define HAVE_MSA 0
@@ -87,7 +91,6 @@
 #define CONFIG_MULTI_RES_ENCODING 0
 #define CONFIG_TEMPORAL_DENOISING 1
 #define CONFIG_VP9_TEMPORAL_DENOISING 1
-#define CONFIG_CONSISTENT_RECODE 0
 #define CONFIG_COEFFICIENT_RANGE_CHECKING 0
 #define CONFIG_VP9_HIGHBITDEPTH 1
 #define CONFIG_BETTER_HW_COMPATIBILITY 0
@@ -100,4 +103,5 @@
 #define CONFIG_EMULATE_HARDWARE 0
 #define CONFIG_NON_GREEDY_MV 0
 #define CONFIG_RATE_CTRL 0
+#define CONFIG_COLLECT_COMPONENT_TIMING 0
 #endif /* VPX_CONFIG_H */
diff --git a/third_party/libvpx/vpx_version.h b/third_party/libvpx/vpx_version.h
index 1f41572a..ed1736cc 100644
--- a/third_party/libvpx/vpx_version.h
+++ b/third_party/libvpx/vpx_version.h
@@ -1,8 +1,8 @@
 // This file is generated. Do not edit.
 #define VERSION_MAJOR  1
-#define VERSION_MINOR  13
-#define VERSION_PATCH  1
+#define VERSION_MINOR  14
+#define VERSION_PATCH  0
 #define VERSION_EXTRA  ""
 #define VERSION_PACKED ((VERSION_MAJOR<<16)|(VERSION_MINOR<<8)|(VERSION_PATCH))
-#define VERSION_STRING_NOSP "v1.13.1"
-#define VERSION_STRING      " v1.13.1"
+#define VERSION_STRING_NOSP "v1.14.0"
+#define VERSION_STRING      " v1.14.0"
diff --git a/third_party/zig/csource.c b/third_party/zig/csource.c
index 09d2a256..70191a0e 100644
--- a/third_party/zig/csource.c
+++ b/third_party/zig/csource.c
@@ -4,10 +4,10 @@
 #include <sodium.h>
 #include <string.h>
 
-static char answer_data[sizeof(int)];
+static char answer_data[sizeof(unsigned int)];
 
-int get_answer(int question) {
-  int previous_answer;
+unsigned int get_answer(unsigned int question) {
+  unsigned int previous_answer;
   memcpy(&previous_answer, answer_data, sizeof(int));
   // Not available in the default zig toolchain, so tests whether we have the
   // correct glibc.
diff --git a/third_party/zig/csource.h b/third_party/zig/csource.h
index b1b0762e..cf4fc4f5 100644
--- a/third_party/zig/csource.h
+++ b/third_party/zig/csource.h
@@ -1,3 +1,3 @@
 #pragma once
 
-int get_answer(int question);
+unsigned int get_answer(unsigned int question);
diff --git a/tools/built/src/Dockerfile.windows b/tools/built/src/Dockerfile.windows
new file mode 100644
index 00000000..1583c470
--- /dev/null
+++ b/tools/built/src/Dockerfile.windows
@@ -0,0 +1,12 @@
+FROM toxchat/toktok-stack:latest
+
+RUN \
+ if curl -s -m1 http://code.tox.chat/bazel/ \
+   | grep "resource name must be a SHA256 hash"; then \
+   echo 'build --config=remote' | tee -a .bazelrc.local; \
+ fi; \
+ sed -i -e 's/build --config=nix/build --config=windows-x86_64/' .bazelrc
+
+RUN sudo nix-daemon --daemon & bazel build -k //c-toxcore/toxcore
+
+# vim:ft=dockerfile
diff --git a/tools/debug/flakynet.c b/tools/debug/flakynet.c
index ac2b969f..762045a7 100644
--- a/tools/debug/flakynet.c
+++ b/tools/debug/flakynet.c
@@ -98,7 +98,8 @@ static bool can_send(void) {
     --headstart;
     return true;
   }
-  return (double)rand_r(&seed) / (double)RAND_MAX > flakiness;
+  const double rn = rand_r(&seed);
+  return rn / (double)RAND_MAX > flakiness;
 }
 
 ssize_t sendto(int sockfd, const void *buf, size_t len, int flags, const struct sockaddr *dest_addr,
diff --git a/tools/debug/oomer.c b/tools/debug/oomer.c
index aed2321b..c3650f85 100644
--- a/tools/debug/oomer.c
+++ b/tools/debug/oomer.c
@@ -60,7 +60,7 @@ typedef struct Oomer_Config {
 
 static Oomer_Config config = {INT32_MAX, 5, 0, 0, 123456789, false, false};
 
-uint32_t rand_u32(void) {
+static uint32_t rand_u32(void) {
   // Numerical Recipes in C. The Art of Scientific Computing, 2nd Edition, 1992
   config.seed = (1664525 * config.seed + 1013904223);
   return config.seed;
diff --git a/toxic b/toxic
index 5ad00f7f..0e4b7963 160000
--- a/toxic
+++ b/toxic
@@ -1 +1 @@
-Subproject commit 5ad00f7fd8b8d7ed9add2823f5c633fbeb323838
+Subproject commit 0e4b7963c9e3ea0a135f892e3fcac9d830a0966f