diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 00000000..899a0ed3
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,10 @@
+name: "CodeQL config"
+
+queries:
+  - uses: security-and-quality
+
+query-filters:
+  - exclude:
+      id: cpp/include-non-header
+  - exclude:
+      id: cpp/undisciplined-multiple-inheritance
diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
index a89c06d4..ca61319a 100644
--- a/.github/workflows/analysis.yml
+++ b/.github/workflows/analysis.yml
@@ -7,7 +7,7 @@ jobs:
     name: core-guidelines-check
     runs-on: windows-2022
     # Disabled because of an internal compiler error in reference_lines.cpp
-    if: false
+    if: true
 
     defaults:
       run:
@@ -37,18 +37,18 @@ jobs:
 #############################################################################################################
 
   clang-analyzers:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     strategy:
       matrix:
         tool: [
-            { name: iwyu,       cmake-flag: CMAKE_CXX_INCLUDE_WHAT_YOU_USE="iwyu;-Xiwyu;--mapping_file=../.iwyu-mappings" },
+            #{ name: iwyu,       cmake-flag: CMAKE_CXX_INCLUDE_WHAT_YOU_USE="iwyu;-Xiwyu;--mapping_file=../.iwyu-mappings" },
             { name: clang-tidy, cmake-flag: CMAKE_CXX_CLANG_TIDY="clang-tidy" },
             { name: cppcheck,   cmake-flag: CMAKE_CXX_CPPCHECK="cppcheck;--version;--verbose;--report-progress;--enable=all;--error-exitcode=1;--std=c++20;--suppressions-list=../.cppcheck-supressions" }
         ]
         include:
-          - pkgs: clang-15 clang-tools-15 clang-tidy-15 iwyu cppcheck
-            cxx: clang++-15
+          - pkgs: clang-18 clang-tools-18 clang-tidy-18 iwyu cppcheck
+            cxx: clang++-18
 
     defaults:
       run:
@@ -79,13 +79,13 @@ jobs:
 #############################################################################################################
 
   codeql:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     strategy:
       matrix:
         include:
-          - pkgs: clang-15
-            cxx: clang++-15
+          - pkgs: clang-18
+            cxx: clang++-18
 
     name: codeql
 
@@ -104,7 +104,7 @@ jobs:
         uses: github/codeql-action/init@v3
         with:
           languages: cpp
-          queries: security-and-quality
+          config-file: ${{ github.workspace }}/.github/codeql/codeql-config.yml
 
       - name: setup-build
         env:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 5f09b76b..f8040fd4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -6,7 +6,7 @@ on:
   
 jobs:
   update-docs:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     defaults:
       run:
         working-directory: ${{ github.workspace }}
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 586036ea..9333bd8b 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -4,17 +4,23 @@ on: [push, pull_request]
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    container:
+      image: ubuntu:24.04
     strategy:
       fail-fast: false
       matrix:
+        common-pkgs: [ git cmake ]
         build-type: [ Release, RelWithDebInfo ]
         compiler: [
             { cxx: g++-11, pkgs: g++-11 },
             { cxx: g++-12, pkgs: g++-12 },
             { cxx: g++-13, pkgs: g++-13 },
-            { cxx: clang++-14, pkgs: clang-14 libstdc++6=12.3.0-1ubuntu1~22.04 libgcc-s1=12.3.0-1ubuntu1~22.04 },
+            { cxx: g++-14, pkgs: g++-14 },
             { cxx: clang++-15, pkgs: clang-15 },
+            { cxx: clang++-16, pkgs: clang-16 },
+            { cxx: clang++-17, pkgs: clang-17 },
+            { cxx: clang++-18, pkgs: clang-18 },
         ]
         
     defaults:
@@ -28,17 +34,17 @@ jobs:
       uses: actions/checkout@v4
 
     - name: setup-compiler
-      run: sudo apt update && sudo apt install --allow-downgrades -y ${{ matrix.compiler.pkgs }}
+      run: apt update && apt install --allow-downgrades -y ${{ matrix.common-pkgs }} ${{ matrix.compiler.pkgs }}
 
     - name: setup-catch
       env:
         CXX: ${{ matrix.compiler.cxx }}
-      run: sudo bash ../tools/install_catch.sh
+      run: bash ../tools/install_catch.sh
 
     - name: setup-build
       env:
         CXX: ${{ matrix.compiler.cxx }}
-      run: cmake .. -DCMAKE_BUILD_TYPE=${{ matrix.build-type }} -DGAPP_USE_WERROR=ON -DGAPP_USE_LTO=ON
+      run: cmake .. -DCMAKE_BUILD_TYPE=${{ matrix.build-type }} -DGAPP_USE_WERROR=ON -DGAPP_USE_LTO=ON -DGAPP_CXX_FLAGS="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -D_GLIBCXX_ASSERTIONS"
 
     - name: build
       run: cmake --build . --parallel 8
@@ -47,4 +53,4 @@ jobs:
       run: ctest --output-on-failure --schedule-random
 
     - name: install
-      run: sudo cmake --install .
+      run: cmake --install .
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index d3f21f2b..01958e3b 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -4,7 +4,7 @@ on: [push, pull_request]
 
 jobs:
   build:
-    runs-on: macos-13
+    runs-on: macos-14
     strategy:
       fail-fast: false
       matrix:
@@ -12,18 +12,37 @@ jobs:
         compiler: [
             { cxx: g++-11, pkgs: gcc@11, extra-flags: "-undefined dynamic_lookup" },
             { cxx: g++-12, pkgs: gcc@12, extra-flags: "-undefined dynamic_lookup" },
-            { cxx: g++-13, pkgs: gcc@13, extra-flags: "-undefined dynamic_lookup -Wno-array-bounds -Wno-stringop-overflow -Wno-stringop-overread" },
+            { cxx: g++-13, pkgs: gcc@13, extra-flags: "-undefined dynamic_lookup" },
+            { cxx: g++-14, pkgs: gcc@14, extra-flags: "-undefined dynamic_lookup" },
             {
               cxx: $(brew --prefix llvm@14)/bin/clang++,
               pkgs: llvm@14 gcc@11,
-              extra-flags: "-femulated-tls -stdlib=libstdc++ -stdlib++-isystem $(brew --prefix gcc@11)/include/c++/11 -cxx-isystem $(brew --prefix gcc@11)/include/c++/11/x86_64-apple-darwin22",
+              extra-flags: "-femulated-tls -stdlib=libstdc++ -stdlib++-isystem $(brew --prefix gcc@11)/include/c++/11 -cxx-isystem $(brew --prefix gcc@11)/include/c++/11/aarch64-apple-darwin23",
               linker-flags: "-L$(brew --prefix gcc@11)/lib/gcc/11"
             },
             {
               cxx: $(brew --prefix llvm@15)/bin/clang++,
               pkgs: llvm@15 gcc@12,
-              extra-flags: "-femulated-tls -stdlib=libstdc++ -stdlib++-isystem $(brew --prefix gcc@12)/include/c++/12 -cxx-isystem $(brew --prefix gcc@12)/include/c++/12/x86_64-apple-darwin22",
+              extra-flags: "-femulated-tls -stdlib=libstdc++ -stdlib++-isystem $(brew --prefix gcc@12)/include/c++/12 -cxx-isystem $(brew --prefix gcc@12)/include/c++/12/aarch64-apple-darwin23",
               linker-flags: "-L$(brew --prefix gcc@12)/lib/gcc/12"
+            },
+            {
+              cxx: $(brew --prefix llvm@16)/bin/clang++,
+              pkgs: llvm@16 gcc@13,
+              extra-flags: "-femulated-tls -stdlib=libstdc++ -stdlib++-isystem $(brew --prefix gcc@13)/include/c++/13 -cxx-isystem $(brew --prefix gcc@13)/include/c++/13/aarch64-apple-darwin23",
+              linker-flags: "-L$(brew --prefix gcc@13)/lib/gcc/13"
+            },
+            {
+              cxx: $(brew --prefix llvm@17)/bin/clang++,
+              pkgs: llvm@17 gcc@14,
+              extra-flags: "-femulated-tls -stdlib=libstdc++ -stdlib++-isystem $(brew --prefix gcc@14)/include/c++/14 -cxx-isystem $(brew --prefix gcc@14)/include/c++/14/aarch64-apple-darwin23",
+              linker-flags: "-L$(brew --prefix gcc@14)/lib/gcc/14"
+            },
+            {
+              cxx: $(brew --prefix llvm@18)/bin/clang++,
+              pkgs: llvm@18 gcc@14,
+              extra-flags: "-femulated-tls -stdlib=libstdc++ -stdlib++-isystem $(brew --prefix gcc@14)/include/c++/14 -cxx-isystem $(brew --prefix gcc@14)/include/c++/14/aarch64-apple-darwin23",
+              linker-flags: "-L$(brew --prefix gcc@14)/lib/gcc/14"
             }
         ]
 
@@ -40,6 +59,9 @@ jobs:
     - name: setup-compiler
       run: brew update && brew install ${{ matrix.compiler.pkgs }}
 
+    - name: dummy step
+      run: ls /Applications/
+
     - name: setup-xcode
       run: sudo xcode-select -switch /Applications/Xcode_15.1.app
 
diff --git a/.github/workflows/sanitizers.yml b/.github/workflows/sanitizers.yml
index 81321b9d..247069a4 100644
--- a/.github/workflows/sanitizers.yml
+++ b/.github/workflows/sanitizers.yml
@@ -4,14 +4,14 @@ on: [push, pull_request]
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
         sanitizer: [ address, undefined, thread ]
         include:
-          - cxx: clang++-15
-            pkgs: clang-15 llvm-15
+          - cxx: clang++-18
+            pkgs: clang-18 llvm-18
             
     env:
       ASAN_OPTIONS: check_initialization_order=1:strict_init_order=1:detect_stack_use_after_return=1:detect_leaks=1
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 71bb122d..76231d0b 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -11,7 +11,10 @@ jobs:
         build-type: [ Release, RelWithDebInfo ]
         platform: [ x64, Win32 ]
         generator: [ "Visual Studio 17 2022" ]
-        compiler: [ v143, ClangCL ]
+        compiler: [ 
+            { name: msvc, toolset: v143 }, 
+            { name: clang, toolset: ClangCL }
+        ]
         build-shared: [ "ON", "OFF" ]
         exclude:
           - platform: Win32
@@ -23,7 +26,7 @@ jobs:
       run:
         working-directory: ${{ github.workspace }}/build
 
-    name: ${{ matrix.compiler }}-${{ matrix.platform }}, ${{ matrix.build-type }}, Shared=${{ matrix.build-shared }}
+    name: ${{ matrix.compiler.name }}-${{ matrix.platform }}, ${{ matrix.build-type }}, Shared=${{ matrix.build-shared }}
 
 
     steps:
@@ -36,14 +39,14 @@ jobs:
     - name: setup-catch
       env:
         CMAKE_GENERATOR: ${{ matrix.generator }}
-        CMAKE_GENERATOR_TOOLSET: ${{ matrix.compiler }}
+        CMAKE_GENERATOR_TOOLSET: ${{ matrix.compiler.toolset }}
         CMAKE_GENERATOR_PLATFORM: ${{ matrix.platform }}
       run: bash ../tools/install_catch.sh
 
     - name: setup-build
       env:
         CMAKE_GENERATOR: ${{ matrix.generator }}
-        CMAKE_GENERATOR_TOOLSET: ${{ matrix.compiler }}
+        CMAKE_GENERATOR_TOOLSET: ${{ matrix.compiler.toolset }}
         CMAKE_GENERATOR_PLATFORM: ${{ matrix.platform }}
       run: cmake .. -DCMAKE_BUILD_TYPE=${{ matrix.build-type }} -DBUILD_SHARED_LIBS=${{ matrix.build-shared }} -DGAPP_USE_WERROR=ON -DGAPP_USE_LTO=ON
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index d6e7242f..23f095fe 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -100,7 +100,8 @@ else() # GNU style compiler interface
 
     # gcc specific options
     if(CMAKE_CXX_COMPILER_ID MATCHES "GNU")
-	    set(GAPP_WARN_FLAGS "${GAPP_WARN_FLAGS} -Wlogical-op")
+        # -Warray-bounds, -Wstringop-overflow, -Wstringop-overread are regular false positives since g++-12
+	    set(GAPP_WARN_FLAGS "${GAPP_WARN_FLAGS} -Wlogical-op -Wno-array-bounds -Wno-stringop-overflow -Wno-stringop-overread")
     endif()
     # clang specific options
     if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
@@ -108,7 +109,7 @@ else() # GNU style compiler interface
     endif()
 
     set(CMAKE_CXX_FLAGS "${GAPP_CXX_FLAGS} ${GAPP_WARN_FLAGS}")
-    set(CMAKE_CXX_FLAGS_DEBUG "-Og")
+    set(CMAKE_CXX_FLAGS_DEBUG "-Og -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS")
     set(CMAKE_CXX_FLAGS_RELEASE "-g -DNDEBUG ${GAPP_OPT_FLAGS}")
     set(CMAKE_CXX_FLAGS_RELWITHDEBINFO "-g ${GAPP_OPT_FLAGS}")
 endif()
diff --git a/CMakeSettings.json b/CMakeSettings.json
index 753dee08..e58d6afd 100644
--- a/CMakeSettings.json
+++ b/CMakeSettings.json
@@ -103,7 +103,8 @@
       "variables": [
         {
           "name": "CMAKE_CXX_CLANG_TIDY",
-          "value": "clang-tidy"
+          "value": "clang-tidy",
+          "type": "STRING"
         }
       ]
     },
diff --git a/README.md b/README.md
index 9dc027cc..5d916d23 100644
--- a/README.md
+++ b/README.md
@@ -49,7 +49,7 @@ The maximum of sin(x) in [0.0, 3.14] is at x = 1.57079
 
 The following are needed for building and using the library:
 
-- C++20 compiler (gcc 11.0, clang 14.0, msvc 14.30 or later)
+- C++20 compiler (gcc 11.0, clang 15.0, msvc 14.30 or later)
 - CMake 3.21 or later
 - Catch2 3.3 or later (optional, only needed for the tests)
 
diff --git a/docs/install-guide.md b/docs/install-guide.md
index 16412195..599eabe3 100644
--- a/docs/install-guide.md
+++ b/docs/install-guide.md
@@ -16,7 +16,7 @@ is needed to build the tests.
 
 The full list of requirements are:
 
-- C++20 compiler (gcc 11.0, clang 14.0, msvc 14.30 or later)
+- C++20 compiler (gcc 11.0, clang 15.0, msvc 14.30 or later)
 - CMake 3.21 or later
 - Catch2 3.3 or later (optional, only needed for the tests)
 
diff --git a/src/algorithm/soga_selection.cpp b/src/algorithm/soga_selection.cpp
index a0dbc3ab..61caa5cc 100644
--- a/src/algorithm/soga_selection.cpp
+++ b/src/algorithm/soga_selection.cpp
@@ -152,9 +152,9 @@ namespace gapp::selection
         const double temperature = temperature_(ga.generation_cntr(), ga.max_gen());
 
         // can't capture the iterators by ref or value here
-        std::transform(fvec.begin(), fvec.end(), fvec.begin(), [&, fmin = *fmin](double f) noexcept
+        std::transform(fvec.begin(), fvec.end(), fvec.begin(), [&, f_min = *fmin](double f) noexcept
         {
-            const double fnorm = f / df - fmin / df; // normalize the fitness values to prevent overflows with std::exp
+            const double fnorm = f / df - f_min / df; // normalize the fitness values to prevent overflows with std::exp
 
             return std::min(math::large<double>, std::exp(fnorm / temperature));
         });