diff --git a/deps/lest/default.nix b/deps/lest/default.nix
index 0fb4b01716..37ad42d8dc 100644
--- a/deps/lest/default.nix
+++ b/deps/lest/default.nix
@@ -4,7 +4,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "lest";
-  version = "1.35.2";
+  version = "1.36.0";
 
   meta = {
     description = "A tiny C++11 test framework – lest errors escape testing.";
@@ -14,7 +14,8 @@ stdenv.mkDerivation rec {
 
   src = fetchGit {
     url = "https://github.com/martinmoene/lest.git";
-    rev = "1eda2f7c33941617fc368ce764b5fbeffccb59bc";
+    ref = "refs/tags/v${version}";
+    rev = "57197f32f2c7d3f3d3664a9010d3ff181a40f6ca";
   };
 
   cmakeBuildType = "Debug";
diff --git a/lib/LiveUpdate/src/update.cpp b/lib/LiveUpdate/src/update.cpp
index 9407fb8654..3f777fdb34 100644
--- a/lib/LiveUpdate/src/update.cpp
+++ b/lib/LiveUpdate/src/update.cpp
@@ -248,11 +248,14 @@ void LiveUpdate::exec(const buffer_t& blob, void* location)
 #ifdef PLATFORM_x86_solo5
   solo5_exec(blob.data(), blob.size());
   throw std::runtime_error("solo5_exec returned");
+  (void) found_kernel_start;
 # elif defined(PLATFORM_UNITTEST)
   throw liveupdate_exec_success();
+  (void) found_kernel_start;
 # elif defined(USERSPACE_KERNEL)
   hotswap(phys_base, bin_data, bin_len, (void*) (uintptr_t) start_offset, sr_data);
   throw liveupdate_exec_success();
+  (void) found_kernel_start;
 # elif defined(ARCH_x86_64)
     // change to simple pagetable
     __x86_init_paging((void*) 0x1000);
@@ -270,6 +273,8 @@ void LiveUpdate::exec(const buffer_t& blob, void* location)
     ((decltype(&hotswap64)) HOTSWAP_AREA)(phys_base, bin_data, bin_len, start_offset, sr_data, nullptr);
   }
   }
+#else
+  (void) found_kernel_start;
 # endif
   // copy hotswapping function to sweet spot
   memcpy(HOTSWAP_AREA, (void*) &hotswap, &__hotswap_length - (char*) &hotswap);
diff --git a/src/arch/i686/paging.cpp b/src/arch/i686/paging.cpp
index f014cdfc28..8779245939 100644
--- a/src/arch/i686/paging.cpp
+++ b/src/arch/i686/paging.cpp
@@ -28,7 +28,7 @@ void __arch_init_paging()
 namespace os {
 namespace mem {
   __attribute__((weak))
-  Map map(Map m, const char* name) {
+  Map map(Map m, const char* name) {  // FIXME: use params, remove or mark unused
     return {};
   }
 
diff --git a/src/crt/c_abi.c b/src/crt/c_abi.c
index 1edf8495a6..e887c6ef89 100644
--- a/src/crt/c_abi.c
+++ b/src/crt/c_abi.c
@@ -108,7 +108,7 @@ int __vsprintf_chk(char* s, int flag, size_t slen, const char* format, va_list a
   __assert ((size_t) res < slen);
   return res;
 }
-int __vsnprintf_chk (char *s, size_t maxlen, int flags, size_t slen,
+int __vsnprintf_chk (char *s, [[maybe_unused]] size_t maxlen, int flags, size_t slen,
 		                  const char *format, va_list args)
 {
   assert (slen < maxlen);
diff --git a/src/drivers/vmxnet3.cpp b/src/drivers/vmxnet3.cpp
index e739420174..829287a184 100644
--- a/src/drivers/vmxnet3.cpp
+++ b/src/drivers/vmxnet3.cpp
@@ -178,7 +178,7 @@ vmxnet3::vmxnet3(hw::PCI_Device& d, const uint16_t mtu) :
   assert(this->ptbase);
 
   // verify and select version
-  bool ok = check_version();
+  [[maybe_unused]] bool ok = check_version();
   assert(ok);
 
   // reset device
diff --git a/src/hw/ps2.cpp b/src/hw/ps2.cpp
index 3929cdb0a7..95acfa3cce 100644
--- a/src/hw/ps2.cpp
+++ b/src/hw/ps2.cpp
@@ -217,7 +217,7 @@ namespace hw
 
     // self-test (port1)
     write_port1(0xFF);
-    const uint8_t selftest = read_data();
+    [[maybe_unused]] const uint8_t selftest = read_data();
     assert(selftest == 0xAA && "PS/2 controller self-test");
 
     write_port1(DEV_IDENTIFY);
diff --git a/src/kernel/events.cpp b/src/kernel/events.cpp
index b091bc599e..e375faeec0 100644
--- a/src/kernel/events.cpp
+++ b/src/kernel/events.cpp
@@ -24,7 +24,9 @@
 //#define DEBUG_SMP
 
 static SMP::Array<Events> managers;
+#ifdef INCLUDEOS_SMP_ENABLE
 static Spinlock em_lock_;
+#endif
 
 Events& Events::get(int cpuid)
 {
@@ -39,7 +41,7 @@ Events& Events::get(int cpuid)
 Events& Events::get()
 {
 #ifdef INCLUDEOS_SMP_ENABLE
-  static Spinlock lock;
+  static Spinlock lock;  // FIXME: this seems unused.
   std::lock_guard<Spinlock> guard(em_lock_);
 #endif
   return PER_CPU(managers);
diff --git a/src/kernel/liveupdate.cpp b/src/kernel/liveupdate.cpp
index 03d4695dfb..0c9ba2e727 100644
--- a/src/kernel/liveupdate.cpp
+++ b/src/kernel/liveupdate.cpp
@@ -20,7 +20,7 @@ void kernel::setup_liveupdate()
   kernel::state().liveupdate_loc = kernel::state().liveupdate_phys;
 #endif
 
-  const size_t size = kernel::state().liveupdate_size;
+  [[maybe_unused]] const size_t size = kernel::state().liveupdate_size;
   PRATTLE("Setting up LiveUpdate from %p to %p, %zx\n",
           (void*) kernel::state().liveupdate_phys,
           (void*) kernel::state().liveupdate_loc, size);
diff --git a/src/musl/getrandom.cpp b/src/musl/getrandom.cpp
index 655b4d3f64..963b06bb31 100644
--- a/src/musl/getrandom.cpp
+++ b/src/musl/getrandom.cpp
@@ -1,7 +1,7 @@
 #include "common.hpp"
 #include <kernel/rng.hpp>
 
-// TODO Flags are ignored.
+// TODO: flags are ignored.
 static long sys_getrandom(void* buf, size_t len, unsigned int flags)
 {
   rng_absorb(buf, len);
diff --git a/src/net/dhcp/dh4client.cpp b/src/net/dhcp/dh4client.cpp
index 8694656e3c..0afbd3c271 100644
--- a/src/net/dhcp/dh4client.cpp
+++ b/src/net/dhcp/dh4client.cpp
@@ -42,7 +42,7 @@ namespace net {
   {
     // default timed out handler spams logs
     this->on_config(
-    [this] (bool timed_out)
+    [&] (bool timed_out)
     {
       if (timed_out)
         MYINFO("Negotiation timed out (%s)", this->stack.ifname().c_str());
diff --git a/src/net/https/openssl_server.cpp b/src/net/https/openssl_server.cpp
index cf2d0a90f5..cd0206f9db 100644
--- a/src/net/https/openssl_server.cpp
+++ b/src/net/https/openssl_server.cpp
@@ -10,7 +10,7 @@ namespace http
                                           const std::string& key)
   {
     fs::memdisk().init_fs(
-    [] (fs::error_t err, fs::File_system&) {
+    [] ([[maybe_unused]] fs::error_t err, fs::File_system&) {
       assert(!err);
     });
     /** INIT OPENSSL **/
diff --git a/src/net/ip6/slaac.cpp b/src/net/ip6/slaac.cpp
index 702e775de3..297f5b080c 100644
--- a/src/net/ip6/slaac.cpp
+++ b/src/net/ip6/slaac.cpp
@@ -45,7 +45,7 @@ namespace net
   {
     // default timed out handler spams logs
     this->on_config(
-    [this] (bool completed)
+    [&] (bool completed)
     {
       if (completed) {
         INFO("SLAAC", "Autoconf completed for (%s)",
diff --git a/src/net/openssl/client.cpp b/src/net/openssl/client.cpp
index a3b740b840..fd33e91aa7 100644
--- a/src/net/openssl/client.cpp
+++ b/src/net/openssl/client.cpp
@@ -29,7 +29,7 @@ tls_load_from_memory(X509_STORE* store,
   auto* cbio = BIO_new_mem_buf(cert_buffer.data(), cert_buffer.size());
   auto* cert = PEM_read_bio_X509(cbio, NULL, 0, NULL);
   assert(cert != NULL && "Invalid certificate");
-  int res = X509_STORE_add_cert(store, cert);
+  [[maybe_unused]] int res = X509_STORE_add_cert(store, cert);
   assert(res == 1 && "The X509 store did not accept the certificate");
   BIO_free(cbio);
 }
@@ -46,7 +46,7 @@ tls_private_key_for_ctx(SSL_CTX* ctx, int bits = 2048)
   RSA* rsa = RSA_new();
 
   // TODO: -Wdeprecated-declarations
-  int ret = RSA_generate_key_ex(rsa, bits, bne, NULL);
+  [[maybe_unused]] int ret = RSA_generate_key_ex(rsa, bits, bne, NULL);
   assert(ret == 1);
 
   // TODO: -Wdeprecated-declarations
@@ -63,7 +63,7 @@ tls_init_client(fs::List ents)
   auto* ctx = SSL_CTX_new(meth);
   if (!ctx) throw std::runtime_error("SSL_CTX_new()");
 
-  int res = SSL_CTX_set_cipher_list(ctx, "AES256-SHA");
+  [[maybe_unused]] int res = SSL_CTX_set_cipher_list(ctx, "AES256-SHA");
   assert(res == 1);
 
   X509_STORE* store = X509_STORE_new();
diff --git a/src/net/openssl/init.cpp b/src/net/openssl/init.cpp
index a92e675c73..bf00b21a5b 100644
--- a/src/net/openssl/init.cpp
+++ b/src/net/openssl/init.cpp
@@ -58,7 +58,7 @@ namespace openssl
   void verify_rng()
   {
     int random_value = 0;
-    int rc = RAND_bytes((uint8_t*) &random_value, sizeof(random_value));
+    [[maybe_unused]] int rc = RAND_bytes((uint8_t*) &random_value, sizeof(random_value));
     assert(rc == 0 || rc == 1);
   }
 
diff --git a/src/net/openssl/server.cpp b/src/net/openssl/server.cpp
index 3813ef6ea4..528141d3e4 100644
--- a/src/net/openssl/server.cpp
+++ b/src/net/openssl/server.cpp
@@ -43,7 +43,7 @@ namespace openssl
     auto* ctx = SSL_CTX_new(TLSv1_2_method());
     if (!ctx) throw std::runtime_error("SSL_CTX_new()");
 
-    int res = SSL_CTX_set_cipher_list(ctx, "AES256-SHA");
+    [[maybe_unused]] int res = SSL_CTX_set_cipher_list(ctx, "AES256-SHA");
     assert(res == 1);
 
   #ifdef LOAD_FROM_MEMDISK
diff --git a/src/platform/x86_nano/platform.cpp b/src/platform/x86_nano/platform.cpp
index 1c3030375c..0a4516fd8c 100644
--- a/src/platform/x86_nano/platform.cpp
+++ b/src/platform/x86_nano/platform.cpp
@@ -28,7 +28,7 @@ static void platform_init()
   x86::idt_initialize_for_cpu(0);
 }
 
-void kernel::start(uint32_t boot_magic, uint32_t boot_addr)
+void kernel::start([[maybe_unused]] uint32_t boot_magic, uint32_t boot_addr)
 {
   assert(boot_magic == MULTIBOOT_BOOTLOADER_MAGIC);
   kernel::multiboot(boot_addr);
diff --git a/src/platform/x86_pc/acpi.cpp b/src/platform/x86_pc/acpi.cpp
index c5bbce7e8c..5ea85789c6 100644
--- a/src/platform/x86_pc/acpi.cpp
+++ b/src/platform/x86_pc/acpi.cpp
@@ -271,7 +271,7 @@ namespace x86 {
 
     auto  dsdt_addr = (uintptr_t) facp->DSDT;
     // verify DSDT
-    constexpr uint32_t DSDT_t = bake('D', 'S', 'D', 'T');
+    [[maybe_unused]] constexpr uint32_t DSDT_t = bake('D', 'S', 'D', 'T');
     assert(*(uint32_t*) dsdt_addr == DSDT_t);
 
     /// big thanks to kaworu from OSdev.org forums for algo
diff --git a/src/platform/x86_pc/apic_revenant.cpp b/src/platform/x86_pc/apic_revenant.cpp
index f3354ca719..f9736a2639 100644
--- a/src/platform/x86_pc/apic_revenant.cpp
+++ b/src/platform/x86_pc/apic_revenant.cpp
@@ -76,20 +76,20 @@ static void revenant_task_handler()
 void revenant_main(int cpu)
 {
   uintptr_t this_stack = smp_main.stack_base + cpu * smp_main.stack_size;
-  uintptr_t this_stack_end = this_stack - smp_main.stack_size;
+  [[maybe_unused]] uintptr_t this_stack_end = this_stack - smp_main.stack_size;
   // enable Local APIC
   x86::APIC::get().smp_enable();
   // setup GDT & per-cpu feature
   x86::initialize_cpu_tables_for_cpu(cpu);
   // show we are online, and verify CPU ID is correct
   SMP::global_lock();
-  auto stack = (uintptr_t) get_cpu_esp();
+  [[maybe_unused]] auto stack = (uintptr_t) get_cpu_esp();
   INFO2("AP %d started at %p", SMP::cpu_id(), (void*) this_stack);
   SMP::global_unlock();
   // initialize exceptions before asserts
   x86::idt_initialize_for_cpu(cpu);
   assert(cpu == SMP::cpu_id());
-  assert(stack >= this_stack_end && stack < this_stack);
+  assert(stack >= this_stack_end && stack < this_stack);  // relates to [[maybe_unused]]
 
   static Spinlock lock;
   {
diff --git a/vmbuild/elf_syms.cpp b/vmbuild/elf_syms.cpp
index ec0e5b12b8..c58f2a3d1f 100644
--- a/vmbuild/elf_syms.cpp
+++ b/vmbuild/elf_syms.cpp
@@ -18,9 +18,11 @@ static const char* syms_file = "_elf_symbols.bin";
 
 static int prune_elf_symbols(char*);
 
-int main(int argc, const char** args)
+int main(int argc, const char* args[])
 {
-  assert(argc > 1);
+  if (!(argc > 1)) {
+    return -1;
+  };
   FILE* f = fopen(args[1], "r");
   assert(f);
 
@@ -32,8 +34,7 @@ int main(int argc, const char** args)
 
   rewind(f);
 
-  [[ maybe_unused ]]
-  int res = fread(fdata, sizeof(char), size, f);
+  [[maybe_unused]] int res = fread(fdata, sizeof(char), size, f);
   assert(res == size);
   fclose(f);