diff --git a/.clang-tidy b/.clang-tidy
new file mode 100644
index 0000000..31bccee
--- /dev/null
+++ b/.clang-tidy
@@ -0,0 +1,24 @@
+---
+# clang-analyzer-cplusplus.NewDeleteLeaks reports QObjects owned by their parent as leaks
+Checks: >
+  -*,
+  bugprone-*,
+  -bugprone-easily-swappable-parameters,
+  -bugprone-narrowing-conversions,
+  -bugprone-exception-escape,
+  clang-analyzer-*,
+  -clang-analyzer-cplusplus.NewDeleteLeaks,
+  cppcoreguidelines-slicing,
+  cppcoreguidelines-virtual-class-destructor,
+  misc-redundant-expression,
+  misc-unused-using-decls,
+  modernize-use-nullptr,
+  modernize-use-override,
+  performance-*,
+  -performance-enum-size,
+  readability-misleading-indentation,
+  readability-redundant-smartptr-get
+WarningsAsErrors: ''
+HeaderFilterRegex: '/(app|modules)/'
+FormatStyle: file
+...
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d5216c1..c2e2a01 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,7 +18,7 @@ on:
     branches: [ "master" ]
 
 env:
-    QT_VERSION: '6.10.2'
+    QT_VERSION: '6.12.0'
     QT_MODULES: 'qtmultimedia qtwebsockets qtimageformats'
 
 jobs:
@@ -73,20 +73,17 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
+        build-mode: manual
+        # The default suite only runs high-precision security queries
+        queries: security-and-quality
 
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
     # If this step fails, then you should remove it and run the build manually (see below)
     # - name: Autobuild
-    #   uses: github/codeql-action/autobuild@v2
+    #   uses: github/codeql-action/autobuild@v4
 
     - name: Build the application
       run: |
@@ -108,6 +105,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 766955a..df4017a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -4,15 +4,18 @@ on:
   push:
     branches:
       - '**'
+    tags:
+      - 'v*'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ "master" ]
-  create:
 
 env:
-    QT_VERSION: '6.10.2'
+    QT_VERSION: '6.12.0'
     QT_MODULES: 'qtmultimedia qtwebsockets qtimageformats'
-    EM_VERSION: '4.0.7'
+    EM_VERSION: '5.0.5'
+    # Has to match the NDK the Qt for Android binaries are built with
+    ANDROID_NDK_VERSION: '27.2.12479018'
 
 permissions:
   contents: write
@@ -90,20 +93,20 @@ jobs:
         export CPM_SOURCE_CACHE=~/cpm-cache
         IMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} bash ./dist/ios/build.sh
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: Lith.ipa
         path: build_ios/Lith.ipa
     - name: Upload to GitHub
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         export VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
             ./dist/upload-github-release-asset.sh github_api_token="${{ secrets.GITHUB_TOKEN }}" tag="v${VERSION_NAME}" filename="build_ios/Lith.ipa" renameto="Lith-iOS-${VERSION_NAME}.ipa"
         fi
     - name: Upload to Testflight
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         export VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
@@ -136,11 +139,20 @@ jobs:
         modules: ${{env.QT_MODULES}}
         cache: true
         cache-key-prefix: ${{ github.job }}-qt-${{ env.QT_VERSION }}
+    - name: Install Qt for arm64-v8a
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{env.QT_VERSION}}
+        target: android
+        arch: android_arm64_v8a
+        set-env: false
+        modules: ${{env.QT_MODULES}}
+        cache: true
+        cache-key-prefix: ${{ github.job }}-qt-cross-arm64-${{ env.QT_VERSION }}
     - name: Install Qt
       uses: jurplel/install-qt-action@v4
       with:
         version: ${{env.QT_VERSION}}
-        host: linux
         target: android
         arch: android_armv7
         modules: ${{env.QT_MODULES}}
@@ -150,23 +162,31 @@ jobs:
     - name: Get OpenSSL
       run: |
         git clone https://github.com/KDAB/android_openssl.git --depth=1
+    - name: Install the Android NDK
+      run: |
+        yes | "${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager" --install "ndk;${ANDROID_NDK_VERSION}" > /dev/null
+    - name: Set up JDK
+      uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: '21'
     - name: Build the Android binary
       run: |
         export ANDROID_SDK=${ANDROID_SDK_ROOT}
         export CPM_SOURCE_CACHE=~/cpm-cache
         export ANDROID_OPENSSL_PATH="$PWD/android_openssl/ssl_3"
-        export ANDROID_NDK="${ANDROID_NDK_LATEST_HOME}"
-        export ANDROID_NDK_HOME="${ANDROID_NDK_LATEST_HOME}"
-        export ANDROID_NDK_ROOT="${ANDROID_NDK_LATEST_HOME}"
+        export ANDROID_NDK="${ANDROID_SDK_ROOT}/ndk/${ANDROID_NDK_VERSION}"
+        export ANDROID_NDK_HOME="${ANDROID_NDK}"
+        export ANDROID_NDK_ROOT="${ANDROID_NDK}"
         IMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} bash ./dist/android/build.sh
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: android-build-debug.apk
         path: build_android/app/android-build/Lith.apk
     - name: Upload to GitHub
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
@@ -198,6 +218,7 @@ jobs:
         cache-key-prefix: ${{ github.job }}-qt-${{ env.QT_VERSION }}
 
     - name: Install Qt
+      id: install-qt-wasm
       uses: jurplel/install-qt-action@v4
       with:
         version: ${{env.QT_VERSION}}
@@ -215,8 +236,7 @@ jobs:
 
     - name: Build the Emscripten binary
       run: |
-        #hack
-        export QT_ROOT_DIR=${QT_ROOT_DIR}/../wasm_multithread
+        export QT_ROOT_DIR="${{ steps.install-qt-wasm.outputs.qt-root-dir }}"
         IMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} bash ./dist/wasm/build.sh
         # inject CORS handling into the main page
         sed s'/\(<\/title>\)/\0\n<script src="enable-threads.js"><\/script>/' -i'' build_wasm/app/Lith.html
@@ -227,17 +247,17 @@ jobs:
         cp dist/wasm/enable-threads.js installed/enable-threads.js
 
     - name: Setup Pages
-      if: github.event_name == 'create'
-      uses: actions/configure-pages@v3
+      if: github.ref_type == 'tag'
+      uses: actions/configure-pages@v6
     - name: Upload artifact
-      if: github.event_name == 'create'
-      uses: actions/upload-pages-artifact@v3
+      if: github.ref_type == 'tag'
+      uses: actions/upload-pages-artifact@v5
       with:
         path: 'installed/'
     - name: Deploy to GitHub Pages
       id: deployment
-      if: github.event_name == 'create'
-      uses: actions/deploy-pages@v4
+      if: github.ref_type == 'tag'
+      uses: actions/deploy-pages@v5
 
   Windows-MSVC:
     runs-on: windows-latest
@@ -254,17 +274,23 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-cpm-
 
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        # py7zr's compiled dependencies don't have Windows wheels for Python 3.15 yet
+        python-version: '3.14'
     - name: Install Qt
       uses: jurplel/install-qt-action@v4
       with:
         version: ${{env.QT_VERSION}}
         modules: ${{env.QT_MODULES}}
         arch: win64_msvc2022_64
+        setup-python: false
+        # Qt 6.11+ for Windows x64 needs aqtinstall newer than the latest release (3.3.0)
+        aqtsource: 'git+https://github.com/miurahr/aqtinstall.git@076e1659807d0b362a3ed684d54c2e9c775eb9c7'
         cache: true
         cache-key-prefix: ${{ github.job }}-qt
 
-    - name: Add msbuild to PATH
-      uses: microsoft/setup-msbuild@v2
     - name: Build the application
       shell: bash
       run: |
@@ -274,7 +300,7 @@ jobs:
         cd build_win
         export CPM_SOURCE_CACHE=~/cpm-cache
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
-        "/c/Program Files/CMake/bin/cmake.exe" .. -GNinja -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME
+        "/c/Program Files/CMake/bin/cmake.exe" .. -GNinja -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DLITH_VERSION=$VERSION_NAME
         "/c/Program Files/CMake/bin/cmake.exe" --build . --config Release
         "/c/Program Files/CMake/bin/cmake.exe" --install . --config Release
     - name: Windeployqt + zip
@@ -287,14 +313,14 @@ jobs:
         "$QT_ROOT_DIR"/bin/windeployqt.exe Lith.exe LithCore.dll LithStyle.dll LithUI.dll --verbose 2 --release --compiler-runtime --qmldir ../..
         7z a ../../Lith.zip *
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: Lith.zip
         path: Lith.zip
     - name: Upload to GitHub
       shell: bash
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
@@ -316,6 +342,11 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-cpm-
 
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        # py7zr's compiled dependencies don't have Windows wheels for Python 3.15 yet
+        python-version: '3.14'
     - name: Install Qt
       uses: jurplel/install-qt-action@v4
       with:
@@ -324,11 +355,10 @@ jobs:
         host: windows_arm64
         target: desktop
         arch: win64_msvc2022_arm64
+        setup-python: false
         cache: true
         cache-key-prefix: ${{ github.job }}-qt
 
-    - name: Add msbuild to PATH
-      uses: microsoft/setup-msbuild@v2
     - name: Build the application
       shell: bash
       run: |
@@ -338,7 +368,7 @@ jobs:
         cd build_win
         export CPM_SOURCE_CACHE=~/cpm-cache
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
-        "/c/Program Files/CMake/bin/cmake.exe" .. -GNinja -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME
+        "/c/Program Files/CMake/bin/cmake.exe" .. -GNinja -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DLITH_VERSION=$VERSION_NAME
         "/c/Program Files/CMake/bin/cmake.exe" --build . --config Release
         "/c/Program Files/CMake/bin/cmake.exe" --install . --config Release
     - name: Windeployqt + zip
@@ -351,14 +381,14 @@ jobs:
         "$QT_ROOT_DIR"/bin/windeployqt.exe Lith.exe LithCore.dll LithStyle.dll LithUI.dll --verbose 2 --release --compiler-runtime --qmldir ../..
         7z a ../../Lith-ARM.zip *
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: Lith-ARM.zip
         path: Lith-ARM.zip
     - name: Upload to GitHub
       shell: bash
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
@@ -396,12 +426,12 @@ jobs:
 
     - name: Build the application
       run: |
+        export VERSION_NAME=$(./dist/get-version-name.sh)
         mkdir build
         cd build
         export CPM_SOURCE_CACHE=~/cpm-cache
-        export VERSION_NAME=$(./dist/get-version-name.sh)
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
-        cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
+        cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DLITH_VERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
         make -j5
 
   Linux-ARM:
@@ -437,45 +467,14 @@ jobs:
 
     - name: Build the application
       run: |
+        export VERSION_NAME=$(./dist/get-version-name.sh)
         mkdir build
         cd build
         export CPM_SOURCE_CACHE=~/cpm-cache
-        export VERSION_NAME=$(./dist/get-version-name.sh)
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
-        cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
+        cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DLITH_VERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
         make -j5
 
-
-
-  Flatpak:
-    runs-on: ubuntu-latest
-    if: false
-    container:
-      image: docker.io/bilelmoussaoui/flatpak-github-actions
-      options: --privileged
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 1
-    - uses: bilelmoussaoui/flatpak-github-actions@v2
-      with:
-        bundle: "app.Lith.Lith.flatpak"
-        manifest-path: "dist/linux/flatpak/app.Lith.Lith.json"
-    - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
-      uses: actions/upload-artifact@v4
-      with:
-        name: app.Lith.Lith.flatpak
-        path: app.Lith.Lith.flatpak
-    - name: Upload to GitHub
-      if: github.event_name == 'create'
-      run: |
-        VERSION_NAME=$(./dist/get-version-name.sh)
-        if [[ "$VERSION_NAME" != "" ]]; then
-            ./dist/upload-github-release-asset.sh github_api_token=${{ secrets.GITHUB_TOKEN }} tag="v${VERSION_NAME}" filename="app.Lith.Lith.flatpak" renameto="Lith-linux-${VERSION_NAME}.flatpak"
-        fi
-
-
   macOS:
     runs-on: macos-26
     steps:
@@ -551,9 +550,6 @@ jobs:
         IMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} ./dist/macos/build.sh
     - name: Generate .dmg
       run: |
-        # A workaround mentioned here https://github.com/actions/runner-images/issues/7522
-        echo killing...; sudo pkill -9 XProtect >/dev/null || true;
-        echo waiting...; while pgrep XProtect; do sleep 3; done;
         "$QT_ROOT_DIR"/bin/macdeployqt build_macos/app/Lith.app -hardened-runtime -qmldir=modules -appstore-compliant -codesign="Developer ID Application: Martin Briza (Z52EFCPL6D)"
         # No idea why but macdeployqt deploys debug libs too, just remove them, maybe fix this sometimes
         for i in `find build_macos/app/Lith.app/ -name '*.dSYM'`; do rm -fr "$i"; done
@@ -566,13 +562,13 @@ jobs:
             xcrun stapler staple build_macos/app/Lith.dmg
         fi
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: Lith.dmg
         path: build_macos/app/Lith.dmg
     - name: Upload to GitHub
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
new file mode 100644
index 0000000..4894293
--- /dev/null
+++ b/.github/workflows/static-analysis.yml
@@ -0,0 +1,87 @@
+name: Static analysis
+
+on:
+  pull_request:
+    branches: [ "master" ]
+
+env:
+    QT_VERSION: '6.12.0'
+    QT_MODULES: 'qtmultimedia qtwebsockets qtimageformats'
+    # clazy is built against this LLVM version in the runner's Ubuntu release
+    LLVM_VERSION: '21'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  clang-tidy-clazy:
+    name: clang-tidy and clazy on changed code
+    runs-on: ubuntu-26.04
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Find the base commit
+      id: base
+      env:
+        PR_BASE: ${{ github.event.pull_request.base.sha }}
+        PUSH_BEFORE: ${{ github.event.before }}
+        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      run: |
+        if [[ -n "$PR_BASE" ]]; then
+            BASE="$PR_BASE"
+        elif [[ -n "$PUSH_BEFORE" && ! "$PUSH_BEFORE" =~ ^0+$ ]] && git cat-file -e "$PUSH_BEFORE^{commit}" 2>/dev/null; then
+            BASE="$PUSH_BEFORE"
+        else
+            # New branches and force pushes are compared to where they forked off
+            BASE="$(git merge-base HEAD "origin/$DEFAULT_BRANCH")"
+        fi
+        echo "Comparing to $BASE"
+        echo "sha=$BASE" >> "$GITHUB_OUTPUT"
+        if git diff --quiet "$BASE" -- '*.cpp' '*.cc' '*.cxx' '*.mm' '*.h' '*.hpp'; then
+            echo "No C++ changes, nothing to analyze"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Install dependencies
+      if: steps.base.outputs.skip != 'true'
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y clang-${LLVM_VERSION} clang-tidy-${LLVM_VERSION} clazy ninja-build libxkbcommon-dev libsecret-1-dev
+
+    - name: Set up CPM cache
+      if: steps.base.outputs.skip != 'true'
+      uses: actions/cache@v4
+      with:
+        path: ~/cpm-cache
+        key: ${{ runner.os }}-cpm-${{ hashFiles('CMakeLists.txt') }}
+        restore-keys: |
+          ${{ runner.os }}-cpm-
+
+    - name: Install Qt
+      if: steps.base.outputs.skip != 'true'
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{env.QT_VERSION}}
+        modules: ${{env.QT_MODULES}}
+        cache: true
+        cache-key-prefix: ${{ github.job }}-qt
+
+    # The analysis needs the compilation database and the sources generated during the build
+    - name: Build with Clang
+      if: steps.base.outputs.skip != 'true'
+      run: |
+        export CPM_SOURCE_CACHE=~/cpm-cache
+        export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
+        cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang-${LLVM_VERSION} -DCMAKE_CXX_COMPILER=clang++-${LLVM_VERSION} -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DLITH_BUILD_TESTS=ON -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
+        cmake --build build
+
+    - name: Run clang-tidy and clazy
+      if: steps.base.outputs.skip != 'true'
+      run: |
+        ./dist/ci/static-analysis.py --build-dir build --base "${{ steps.base.outputs.sha }}" --clang-tidy clang-tidy-${LLVM_VERSION} --clazy clazy-standalone
diff --git a/CMakeLists.txt b/CMakeLists.txt
index c6aa2d9..20a5197 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -44,6 +44,8 @@ endif()
 
 if(CMAKE_SYSTEM_NAME STREQUAL "Android")
     set(ANDROID_OPENSSL_PATH "${ANDROID_SDK_ROOT}/android_openssl/ssl_3" CACHE STRING "Path to the folder with https://github.com/KDAB/android_openssl.git")
+    # The subprojects building the other ABIs with QT_ANDROID_BUILD_ALL_ABIS don't inherit the cache
+    list(APPEND QT_ANDROID_MULTI_ABI_FORWARD_VARS ANDROID_OPENSSL_PATH IMGUR_API_KEY LITH_VERSION LITH_VERSION_RELEASEDATE LITH_FEATURE_KEYCHAIN LITH_FORCE_DOWNLOAD_DEPENDENCIES LITH_FORCE_LOCAL_PACKAGES_ONLY)
 endif()
 
 set(LITH_VERSION "0.0.0" CACHE STRING "This is where we start working with the version string as passed from the build script")
diff --git a/dist/android/build.sh b/dist/android/build.sh
index 82d4fc1..1e68ce4 100644
--- a/dist/android/build.sh
+++ b/dist/android/build.sh
@@ -10,9 +10,9 @@ if [ -z "${ANDROID_OPENSSL_PATH}" ]; then
     ANDROID_OPENSSL_PATH="${ANDROID_SDK_ROOT}/android_openssl/ssl_3"
 fi
 
-export QT_HOST_PATH="${QT_ROOT_DIR}/../gcc_64"
+export QT_HOST_PATH="${QT_HOST_PATH:-${QT_ROOT_DIR}/../gcc_64}"
 export CMAKE_PREFIX_PATH=${QT_ROOT_DIR}/lib/cmake
-cmake .. -DQT_DEBUG_FIND_PACKAGE=ON -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_TOOLCHAIN_FILE=$QT_ROOT_DIR/lib/cmake/Qt6/qt.toolchain.cmake -DANDROID_OPENSSL_PATH="${ANDROID_OPENSSL_PATH}" -DQT_ANDROID_BUILD_ALL_ABIS=ON
+cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_TOOLCHAIN_FILE=$QT_ROOT_DIR/lib/cmake/Qt6/qt.toolchain.cmake -DANDROID_OPENSSL_PATH="${ANDROID_OPENSSL_PATH}" -DQT_ANDROID_BUILD_ALL_ABIS=ON
 
 cmake --build . --target Lith -- -j2
 cmake --build . --target apk -- -j2
diff --git a/dist/ci/static-analysis.py b/dist/ci/static-analysis.py
new file mode 100755
index 0000000..b785e96
--- /dev/null
+++ b/dist/ci/static-analysis.py
@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+"""Runs clang-tidy and clazy on the C++ code changed since a base commit.
+
+Only diagnostics on lines added or modified since the base commit are reported, so
+warnings already present in the code base don't hide the ones a change introduces.
+Requires a compilation database (CMAKE_EXPORT_COMPILE_COMMANDS) of a build in which the
+generated sources already exist. In GitHub Actions, findings are emitted as annotations.
+
+Example: dist/ci/static-analysis.py --build-dir build --base origin/master
+"""
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass
+from pathlib import Path
+
+SOURCE_SUFFIXES = (".cpp", ".cc", ".cxx", ".mm")
+HEADER_SUFFIXES = (".h", ".hpp")
+DIAGNOSTIC = re.compile(
+    r"^(?P<file>[^\n:]+):(?P<line>\d+):(?P<col>\d+): (?P<level>warning|error): (?P<message>.*?)(?: \[(?P<check>[^\]\s]+)\])?$"
+)
+
+
+@dataclass(frozen=True)
+class Finding:
+    tool: str
+    file: str
+    line: int
+    col: int
+    check: str
+    message: str
+
+
+def git(*args: str) -> str:
+    return subprocess.run(["git", *args], check=True, capture_output=True, text=True).stdout
+
+
+def changed_lines(base: str) -> dict[str, set[int]]:
+    """Lines added or modified in the working tree since base, keyed by repository-relative path."""
+    pathspecs = [f"*{suffix}" for suffix in SOURCE_SUFFIXES + HEADER_SUFFIXES]
+    diff = git("diff", "--unified=0", "--no-color", "--no-ext-diff", "--diff-filter=AM", base, "--", *pathspecs)
+    result: dict[str, set[int]] = {}
+    current = None
+    for line in diff.splitlines():
+        if line.startswith("+++ "):
+            current = line[len("+++ b/") :] if line.startswith("+++ b/") else None
+        elif line.startswith("@@") and current:
+            match = re.match(r"@@ -\S+ \+(\d+)(?:,(\d+))? @@", line)
+            start, count = int(match[1]), int(match[2] if match[2] is not None else 1)
+            if count:
+                result.setdefault(current, set()).update(range(start, start + count))
+    return result
+
+
+def translation_units(build_dir: Path, root: Path, changed: dict[str, set[int]]) -> list[Path]:
+    """Sources to analyze: the changed ones, and for changed headers the sources including them."""
+    database = json.loads((build_dir / "compile_commands.json").read_text())
+    sources = set()
+    for entry in database:
+        path = Path(entry["directory"], entry["file"]).resolve()
+        if path.is_relative_to(root) and not path.is_relative_to(build_dir) and "_deps" not in path.parts:
+            sources.add(path)
+
+    units = set()
+    for relative in changed:
+        path = root / relative
+        if path.suffix in SOURCE_SUFFIXES:
+            if path in sources:
+                units.add(path)
+            continue
+        siblings = {source for source in sources if source.parent == path.parent and source.stem == path.stem}
+        if siblings:
+            units |= siblings
+            continue
+        include = re.compile(rf'#\s*include\s*["<](?:[^">]*/)?{re.escape(path.name)}[">]')
+        units |= {source for source in sources if include.search(source.read_text(errors="replace"))}
+    return sorted(units)
+
+
+def run_tool(tool: str, command: list[str], root: Path) -> tuple[set[Finding], str]:
+    process = subprocess.run(command, capture_output=True, text=True, cwd=root)
+    findings = set()
+    for line in (process.stdout + process.stderr).splitlines():
+        match = DIAGNOSTIC.match(line)
+        if not match:
+            continue
+        check = match["check"] or ""
+        # Plain compiler diagnostics aren't the job of either tool here
+        if tool == "clazy" and not check.startswith("-Wclazy-"):
+            continue
+        if tool == "clang-tidy" and (not check or check.startswith("clang-diagnostic-")):
+            continue
+        path = Path(root, match["file"]).resolve()
+        if not path.is_relative_to(root):
+            continue
+        findings.add(
+            Finding(tool, str(path.relative_to(root)), int(match["line"]), int(match["col"]), check.removeprefix("-W"), match["message"])
+        )
+    failed = process.returncode != 0 and not findings
+    return findings, (process.stderr.strip() if failed else "")
+
+
+def escape(value: str, is_property: bool = False) -> str:
+    value = value.replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
+    return value.replace(":", "%3A").replace(",", "%2C") if is_property else value
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--build-dir", required=True, type=Path, help="build directory with compile_commands.json")
+    parser.add_argument("--base", required=True, help="commit to compare the working tree to")
+    parser.add_argument("--clang-tidy", default="clang-tidy")
+    parser.add_argument("--clazy", default="clazy-standalone")
+    parser.add_argument("--clazy-checks", default="level1")
+    parser.add_argument("--jobs", type=int, default=os.cpu_count())
+    args = parser.parse_args()
+
+    root = Path(git("rev-parse", "--show-toplevel").strip()).resolve()
+    build_dir = args.build_dir.resolve()
+    changed = changed_lines(args.base)
+    units = translation_units(build_dir, root, changed)
+    print(f"{len(changed)} changed C++ files, analyzing {len(units)} translation units", flush=True)
+
+    commands = []
+    for unit in units:
+        commands.append(("clang-tidy", [args.clang_tidy, "-p", str(build_dir), "--quiet", str(unit)]))
+        commands.append(("clazy", [args.clazy, "-p", str(build_dir), f"-checks={args.clazy_checks}", str(unit)]))
+
+    findings: set[Finding] = set()
+    with ThreadPoolExecutor(max_workers=args.jobs) as pool:
+        for (tool, command), (result, error) in zip(commands, pool.map(lambda c: run_tool(c[0], c[1], root), commands)):
+            findings |= result
+            if error:
+                print(f"{tool} failed on {command[-1]}:\n{error}", file=sys.stderr)
+
+    new = sorted((f for f in findings if f.line in changed.get(f.file, ())), key=lambda f: (f.file, f.line, f.col, f.tool))
+    in_actions = os.environ.get("GITHUB_ACTIONS") == "true"
+    for f in new:
+        if in_actions:
+            title = escape(f"{f.tool}: {f.check}", True)
+            print(f"::warning file={escape(f.file, True)},line={f.line},col={f.col},title={title}::{escape(f.message)}")
+        else:
+            print(f"{f.file}:{f.line}:{f.col}: {f.message} [{f.tool}: {f.check}]")
+
+    summary = os.environ.get("GITHUB_STEP_SUMMARY")
+    if summary:
+        with open(summary, "a") as out:
+            out.write(f"### Static analysis of changed code\n\n{len(new)} new findings in {len(units)} analyzed translation units.\n")
+            if new:
+                out.write("\n| Location | Tool | Check | Message |\n|---|---|---|---|\n")
+                for f in new:
+                    message = f.message.replace("|", "\\|")
+                    out.write(f"| `{f.file}:{f.line}` | {f.tool} | `{f.check}` | {message} |\n")
+
+    print(f"{len(new)} new findings ({len(findings) - len(new)} more in unchanged lines of the analyzed files)")
+    return 1 if new else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/dist/ios/build.sh b/dist/ios/build.sh
index 6088a2f..5d29233 100644
--- a/dist/ios/build.sh
+++ b/dist/ios/build.sh
@@ -6,7 +6,7 @@ set -x
 mkdir -p build_ios
 cd build_ios
 
-export QT_HOST_PATH="${QT_ROOT_DIR}/../macos"
+export QT_HOST_PATH="${QT_HOST_PATH:-${QT_ROOT_DIR}/../macos}"
 cmake .. -GXcode -DCMAKE_PREFIX_PATH=$QT_ROOT_DIR -DCMAKE_OSX_SYSROOT=iphoneos -DCMAKE_OSX_ARCHITECTURES=arm64 -DCMAKE_TOOLCHAIN_FILE=$QT_ROOT_DIR/lib/cmake/Qt6/qt.toolchain.cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo -DLITH_VERSION=$VERSION_NAME -DIMGUR_API_KEY=$IMGUR_API_KEY -DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_STYLE="Manual"
 
 xcodebuild -project Lith.xcodeproj -scheme Lith -configuration RelWithDebInfo archive -archivePath Lith.xcarchive DEVELOPMENT_TEAM=Z52EFCPL6D
diff --git a/dist/macos/build.sh b/dist/macos/build.sh
index adfd7d3..d3ca601 100755
--- a/dist/macos/build.sh
+++ b/dist/macos/build.sh
@@ -5,5 +5,5 @@ set -e
 mkdir build_macos
 cd build_macos
 export CMAKE_PREFIX_PATH=$QT_ROOT_DIR/lib/cmake
-cmake .. -DCMAKE_OSX_DEPLOYMENT_TARGET="13.0" -DCMAKE_OSX_ARCHITECTURES="x86_64;arm64" -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DLITH_VERSION=$VERSION_NAME -DCMAKE_INSTALL_PREFIX=installed
+cmake .. -DCMAKE_OSX_DEPLOYMENT_TARGET="14.4" -DCMAKE_OSX_ARCHITECTURES="x86_64;arm64" -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DLITH_VERSION=$VERSION_NAME -DCMAKE_INSTALL_PREFIX=installed
 cmake --build . --parallel
diff --git a/dist/wasm/build.sh b/dist/wasm/build.sh
index 66e76d3..6f99db6 100644
--- a/dist/wasm/build.sh
+++ b/dist/wasm/build.sh
@@ -6,7 +6,7 @@ set -x
 mkdir -p build_wasm
 pushd build_wasm
 
-export QT_HOST_PATH="${QT_ROOT_DIR}/../gcc_64"
+export QT_HOST_PATH="${QT_HOST_PATH:-${QT_ROOT_DIR}/../gcc_64}"
 export CMAKE_PREFIX_PATH=$QT_ROOT_DIR/lib/cmake
 cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_TOOLCHAIN_FILE=$QT_ROOT_DIR/lib/cmake/Qt6/qt.toolchain.cmake
 cmake --build . --parallel
diff --git a/dist/win/make-vs2022-arm-env.bat b/dist/win/make-vs2022-arm-env.bat
index 42f1f73..95ced79 100644
--- a/dist/win/make-vs2022-arm-env.bat
+++ b/dist/win/make-vs2022-arm-env.bat
@@ -2,7 +2,8 @@
 
 set OLDPATH=%PATH%
 
-call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" arm64 > NUL:
+for /f "usebackq tokens=*" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.ARM64 -property installationPath`) do set VS_PATH=%%i
+call "%VS_PATH%\VC\Auxiliary\Build\vcvarsall.bat" arm64 > NUL:
 
 echo export INCLUDE='%INCLUDE%'
 echo export LIB='%LIB%'
diff --git a/dist/win/make-vs2022-env.bat b/dist/win/make-vs2022-env.bat
index c1048be..1e3bdf2 100644
--- a/dist/win/make-vs2022-env.bat
+++ b/dist/win/make-vs2022-env.bat
@@ -2,7 +2,8 @@
 
 set OLDPATH=%PATH%
 
-call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x64 > NUL:
+for /f "usebackq tokens=*" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath`) do set VS_PATH=%%i
+call "%VS_PATH%\VC\Auxiliary\Build\vcvarsall.bat" x64 > NUL:
 
 echo export INCLUDE='%INCLUDE%'
 echo export LIB='%LIB%'