diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f3aeb71..f733bf0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,11 +9,11 @@ jobs:
   scan_build:
     runs-on: ubuntu-latest
     container:
-      image: debian:bullseye
+      image: debian:trixie
     steps:
       - name: install deps
         run: |
-          apt-get update && apt-get install -yq build-essential autotools-dev lsb-release pkg-config automake autoconf libtool-bin clang-tools-11
+          apt-get update && apt-get install -yq build-essential autotools-dev lsb-release pkg-config automake autoconf libtool-bin clang-tools
           apt-get install -yq cmake uuid-dev libssl-dev nlohmann-json3-dev git
       - name: Checkout
         uses: actions/checkout@v4
@@ -59,7 +59,7 @@ jobs:
   run_tests:
     runs-on: ubuntu-latest
     container:
-      image: debian:bullseye
+      image: debian:trixie
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/run_tests.sh b/run_tests.sh
index fd53a61..ad94586 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -1,11 +1,11 @@
 #!/bin/bash
-apt-get update && apt-get install -yq build-essential autotools-dev lsb-release pkg-config automake autoconf libtool-bin clang-tools-11
+apt-get update && apt-get install -yq build-essential autotools-dev lsb-release pkg-config automake autoconf libtool-bin clang-tools
 apt-get install -yq cmake uuid-dev libssl-dev colorized-logs git
 ./build_dependencies.sh
 git config --global --add safe.directory `pwd`
 sed -i '/cotire/d' ./CMakeLists.txt
 mkdir -p scan-build
-scan-build-11 -o ./scan-build/ cmake . -DWITH_JSON_VALIDATION=on -DWITH_PACKAGING=off
+scan-build -o ./scan-build/ cmake . -DWITH_JSON_VALIDATION=on -DWITH_PACKAGING=off
 mkdir -p tests/unit/logs
 make -j`nproc --all` |& tee ./unit-tests-build-result.txt
 exitstatus=${PIPESTATUS[0]}
diff --git a/scan_build.sh b/scan_build.sh
index 2c69556..e983436 100755
--- a/scan_build.sh
+++ b/scan_build.sh
@@ -1,8 +1,8 @@
 #!/bin/bash
 sed -i '/cotire/d' ./CMakeLists.txt
 mkdir -p scan-build
-scan-build-11 -o ./scan-build/ cmake . -DWITH_JSON_VALIDATION=on -DWITH_PACKAGING=off
-scan-build-11 -o ./scan-build/ make -j`nproc --all` |& tee ./scan-build-result.txt
+scan-build -o ./scan-build/ cmake . -DWITH_JSON_VALIDATION=on -DWITH_PACKAGING=off
+scan-build -o ./scan-build/ make -j`nproc --all` |& tee ./scan-build-result.txt
 exitstatus=${PIPESTATUS[0]}
 echo "*** Exit status is $exitstatus";
 export SubString="scan-build: No bugs found";
diff --git a/src/ks_log.c b/src/ks_log.c
index d9e376c..07e9ee5 100644
--- a/src/ks_log.c
+++ b/src/ks_log.c
@@ -324,6 +324,7 @@ static void default_logger(const char *file, const char *func, int line, int lev
 		if (len > 0) {
 			ks_mutex_lock(g_log_mutex);
 			ks_size_t total = len;
+			if (total > sizeof(buf)) total = sizeof(buf); /* len is capped in ks_log_format_output; prove it for the static analyzer */
 		
 			//fprintf(stdout, "[%s] %s:%d %s() %s", LEVEL_NAMES[level], fp, line, func, data);
 #if KS_PLAT_WIN
diff --git a/src/kws.c b/src/kws.c
index e5d28a7..2c386b2 100644
--- a/src/kws.c
+++ b/src/kws.c
@@ -1713,7 +1713,6 @@ KS_DECLARE(ks_status_t) kws_connect_ex(kws_t **kwsP, ks_json_t *params, kws_flag
 	ks_sockaddr_t addr = { 0 };
 	ks_socket_t cl_sock = KS_SOCK_INVALID;
 	int family = AF_INET;
-	const char *ip = "127.0.0.1";
 	ks_port_t port = 443;
 	// char buf[50] = "";
 	const char *url = ks_json_get_object_string(params, "url", NULL);
diff --git a/tests/testhttp.c b/tests/testhttp.c
index 5583911..7f13b2a 100644
--- a/tests/testhttp.c
+++ b/tests/testhttp.c
@@ -47,7 +47,7 @@ typedef struct ssl_profile_s {
 
 static int init_ssl(ssl_profile_t *profile)
 {
-	const char *err = "";
+	const char *err;
 
 	profile->ssl_ctx = SSL_CTX_new(profile->ssl_method);         /* create context */
 	assert(profile->ssl_ctx);
diff --git a/tests/testwebsock.c b/tests/testwebsock.c
index 6b8a697..e09c697 100644
--- a/tests/testwebsock.c
+++ b/tests/testwebsock.c
@@ -47,7 +47,7 @@ typedef struct ssl_profile_s {
 
 static int init_ssl(ssl_profile_t *profile)
 {
-	const char *err = "";
+	const char *err;
 
 	profile->ssl_ctx = SSL_CTX_new(profile->ssl_method);         /* create context */
 	assert(profile->ssl_ctx);