diff --git a/CMakeLists.txt b/CMakeLists.txt
index a2148605..cbbb7356 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -330,8 +330,8 @@ print_var(CMAKE_HOST_SYSTEM_NAME CMAKE_HOST_SYSTEM_VERSION)
 print_var(CMAKE_SYSTEM_NAME CMAKE_SYSTEM_VERSION CMAKE_CROSSCOMPILING)
 print_var(CMAKE_C_COMPILER_ID CMAKE_C_COMPILER_VERSION CMAKE_C_COMPILER_ARCHITECTURE_ID CMAKE_C_PLATFORM_ID CMAKE_C_COMPILER_ABI)
 print_var(CMAKE_CXX_COMPILER_ID CMAKE_CXX_COMPILER_VERSION CMAKE_CXX_COMPILER_ARCHITECTURE_ID CMAKE_CXX_PLATFORM_ID CMAKE_CXX_COMPILER_ABI)
-print_var(CMAKE_INSTALL_PREFIX CMAKE_CONFIGURATION_TYPES CMAKE_BUILD_TYPE)
 endif() # UPX_CONFIG_CMAKE_DISABLE_PRINT_INFO
+print_var(CMAKE_INSTALL_PREFIX CMAKE_CONFIGURATION_TYPES CMAKE_BUILD_TYPE)
 if (CMAKE_BUILD_TYPE AND NOT CMAKE_BUILD_TYPE MATCHES "^(Debug|Release)$")
     message(WARNING "WARNING: unsupported CMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}; please use \"Debug\" or \"Release\"")
 endif()
diff --git a/Makefile b/Makefile
index 18b57bed..eaaaf8b9 100644
--- a/Makefile
+++ b/Makefile
@@ -102,6 +102,13 @@ build/extra/gcc-m64/release: PHONY; $(call run_config_and_build,$@,Release)
 build/extra/gcc-m64/%: export CC  = gcc -m64
 build/extra/gcc-m64/%: export CXX = g++ -m64
 
+# force building with clang Static Analyzer (scan-build)
+build/extra/scan-build/debug:   PHONY; $(call run_config_and_build,$@,Debug)
+build/extra/scan-build/release: PHONY; $(call run_config_and_build,$@,Release)
+build/extra/scan-build/%: CMAKE := scan-build $(CMAKE)
+build/extra/scan-build/%: export CCC_CC  ?= clang
+build/extra/scan-build/%: export CCC_CXX ?= clang++
+
 # cross compiler: Linux glibc aarch64-linux-gnu
 build/extra/cross-linux-aarch64/debug:   PHONY; $(call run_config_and_build,$@,Debug)
 build/extra/cross-linux-aarch64/release: PHONY; $(call run_config_and_build,$@,Release)
@@ -119,16 +126,28 @@ build/extra/cross-windows-mingw32/debug:   PHONY; $(call run_config_and_build,$@
 build/extra/cross-windows-mingw32/release: PHONY; $(call run_config_and_build,$@,Release)
 build/extra/cross-windows-mingw32/%: export CC  = i686-w64-mingw32-gcc
 build/extra/cross-windows-mingw32/%: export CXX = i686-w64-mingw32-g++
-# disable sanitize to avoid link errors with current MinGW-w64 versions
-build/extra/cross-windows-mingw32/%: UPX_CMAKE_CONFIG_FLAGS += -DUPX_CONFIG_DISABLE_SANITIZE=1
 
 # cross compiler: Windows x64 win64 MinGW
 build/extra/cross-windows-mingw64/debug:   PHONY; $(call run_config_and_build,$@,Debug)
 build/extra/cross-windows-mingw64/release: PHONY; $(call run_config_and_build,$@,Release)
 build/extra/cross-windows-mingw64/%: export CC  = x86_64-w64-mingw32-gcc
 build/extra/cross-windows-mingw64/%: export CXX = x86_64-w64-mingw32-g++
-# disable sanitize to avoid link errors with current MinGW-w64 versions
-build/extra/cross-windows-mingw64/%: UPX_CMAKE_CONFIG_FLAGS += -DUPX_CONFIG_DISABLE_SANITIZE=1
+
+# advanced: generic eXtra target; usage:
+#   make UPX_XTARGET=mytarget CC="my-cc -flags" CXX="my-cxx -flags"
+#   make UPX_XTARGET=mytarget CC="my-cc -flags" CXX="my-cxx -flags" build/xtarget/mytarget/debug
+ifneq ($(UPX_XTARGET),)
+ifneq ($(CC),)
+ifneq ($(CXX),)
+UPX_XTARGET := $(UPX_XTARGET)
+$(eval .DEFAULT_GOAL = build/xtarget/$(UPX_XTARGET)/release)
+build/xtarget/$(UPX_XTARGET)/debug:   PHONY; $(call run_config_and_build,$@,Debug)
+build/xtarget/$(UPX_XTARGET)/release: PHONY; $(call run_config_and_build,$@,Release)
+build/xtarget/$(UPX_XTARGET)/%: export CC
+build/xtarget/$(UPX_XTARGET)/%: export CXX
+endif
+endif
+endif
 
 #***********************************************************************
 # check git submodules
diff --git a/misc/cross-compile-upx-with-podman/10-create-image.sh b/misc/cross-compile-upx-with-podman/10-create-image.sh
index 0f24c91c..f9a275f9 100755
--- a/misc/cross-compile-upx-with-podman/10-create-image.sh
+++ b/misc/cross-compile-upx-with-podman/10-create-image.sh
@@ -6,10 +6,10 @@ argv0=$0; argv0abs="$(readlink -fn "$argv0")"; argv0dir="$(dirname "$argv0abs")"
 # create the image from Dockerfile
 # using a rootless Podman container
 
-# NOTE: this image is based on rebuild-stubs-with-upx/upx-stubtools-20221212-v3,
+# NOTE: this image is based on rebuild-stubs-with-upx/upx-stubtools-20221212-v4,
 #   so you have to create that image first
 # WARNING: we install many packages, so the resulting image needs A LOT of disk space!
-image=upx-cross-compile-20230115-v1
+image=upx-cross-compile-20230115-v2
 
 podman build -t "$image" -f "$argv0dir/Dockerfile" "$argv0dir"
 
diff --git a/misc/cross-compile-upx-with-podman/20-image-run-shell.sh b/misc/cross-compile-upx-with-podman/20-image-run-shell.sh
index e19c8bac..984e9766 100755
--- a/misc/cross-compile-upx-with-podman/20-image-run-shell.sh
+++ b/misc/cross-compile-upx-with-podman/20-image-run-shell.sh
@@ -6,7 +6,7 @@ argv0=$0; argv0abs="$(readlink -fn "$argv0")"; argv0dir="$(dirname "$argv0abs")"
 # run an interactive shell in the image
 # using a rootless Podman container
 
-image=upx-cross-compile-20230115-v1
+image=upx-cross-compile-20230115-v2
 
 flags=( -ti --read-only --rm )
 flags+=( --cap-drop=all )               # drop all capabilities
@@ -37,12 +37,17 @@ podman run "${flags[@]}" "$image" bash -l
 #   rm -rf ./build/extra/cross-windows-mingw64/release
 #   make build/extra/cross-windows-mingw64/release
 
-# lots of other cross-compilers are installed; see "ls /usr/bin/*g++*"
+# and we can run the clang Static Analyzer (scan-build)
+#   cd /home/upx/src/upx
+#   rm -rf ./build/extra/scan-build/release
+#   make build/extra/scan-build/release
 
-# and see misc/cross-compile-upx-with-podman/build-all-inside-container.sh; after
-# running that script we can do cool things like:
+# and lots of other cross-compilers are installed; see "ls /usr/bin/*g++*"
+
+# and finally see misc/cross-compile-upx-with-podman/build-all-inside-container.sh
+# after running that script we can do cool things like:
 #   cd /home/upx/src/upx/build/cross-compile-upx-with-podman/alpha-linux-gnu/debug
 #   qemu-alpha -L /usr/alpha-linux-gnu upx --version
 #   cd /home/upx/src/upx/build/cross-compile-upx-with-podman/hppa-linux-gnu/debug
 #   qemu-hppa -L /usr/hppa-linux-gnu upx --version
-# (similar for many other archs)
+# (similar for many other architectures/builds)
diff --git a/misc/cross-compile-upx-with-podman/Dockerfile b/misc/cross-compile-upx-with-podman/Dockerfile
index 7c2fd779..0fb5f35d 100644
--- a/misc/cross-compile-upx-with-podman/Dockerfile
+++ b/misc/cross-compile-upx-with-podman/Dockerfile
@@ -1,8 +1,8 @@
-# NOTE: this image is based on rebuild-stubs-with-upx/upx-stubtools-20221212-v3,
+# NOTE: this image is based on rebuild-stubs-with-upx/upx-stubtools-20221212-v4,
 #   so you have to create that image first
 # WARNING: we install many packages, so the resulting image needs A LOT of disk space!
-FROM localhost/upx-stubtools-20221212-v3
-ENV UPX_CONTAINER_IMAGE_NAME=upx-cross-compile-20230115-v1
+FROM localhost/upx-stubtools-20221212-v4
+ENV UPX_CONTAINER_IMAGE_NAME=upx-cross-compile-20230115-v2
 ARG DEBIAN_FRONTEND=noninteractive
 
 USER root
@@ -43,6 +43,12 @@ RUN apt-get install -y \
         # misc
         gdb lsb-release valgrind \
     && true
+RUN cd /usr/bin \
+    # create unversioned clang symlinks
+    && for f in clang*-14 llvm-*-14 scan-*-14; do ln -s -v ../../bin/$f /usr/local/bin/${f%-14}; done \
+    && ln -s -v ../../bin/obj2yaml-14 /usr/local/bin/llvm-obj2yaml \
+    && ln -s -v ../../bin/yaml2obj-14 /usr/local/bin/llvm-yaml2obj \
+    && true
 
 # switch back to default user upx 2000:2000
 USER upx
diff --git a/misc/cross-compile-upx-with-podman/build-all-inside-container.sh b/misc/cross-compile-upx-with-podman/build-all-inside-container.sh
index 5237694d..c1a1c938 100755
--- a/misc/cross-compile-upx-with-podman/build-all-inside-container.sh
+++ b/misc/cross-compile-upx-with-podman/build-all-inside-container.sh
@@ -33,6 +33,10 @@ function run_config_and_build {
         # avoid warnings about arm libstdc++ ABI change in gcc-7
         arm-linux-*) CXX="$CXX -Wno-psabi" ;;
     esac
+    if [[ 1 == 1 ]]; then
+        # prefer building with Ninja (ninja-build)
+        cmake_config_flags="$cmake_config_flags -G Ninja -DUPX_CONFIG_CMAKE_DISABLE_INSTALL=ON"
+    fi
     # for all build types
     for build_type in Debug Release; do
         bdir=build/cross-compile-upx-with-podman/$toolchain/${build_type,,}
diff --git a/misc/rebuild-stubs-with-podman/10-create-image.sh b/misc/rebuild-stubs-with-podman/10-create-image.sh
index 0c24cbb7..abe8e753 100755
--- a/misc/rebuild-stubs-with-podman/10-create-image.sh
+++ b/misc/rebuild-stubs-with-podman/10-create-image.sh
@@ -6,7 +6,7 @@ argv0=$0; argv0abs="$(readlink -fn "$argv0")"; argv0dir="$(dirname "$argv0abs")"
 # create the image from Dockerfile
 # using a rootless Podman container
 
-image=upx-stubtools-20221212-v3
+image=upx-stubtools-20221212-v4
 
 podman build -t "$image" -f "$argv0dir/Dockerfile" "$argv0dir"
 
diff --git a/misc/rebuild-stubs-with-podman/20-image-run-shell.sh b/misc/rebuild-stubs-with-podman/20-image-run-shell.sh
index e96fa38a..38dd8b88 100755
--- a/misc/rebuild-stubs-with-podman/20-image-run-shell.sh
+++ b/misc/rebuild-stubs-with-podman/20-image-run-shell.sh
@@ -6,7 +6,7 @@ argv0=$0; argv0abs="$(readlink -fn "$argv0")"; argv0dir="$(dirname "$argv0abs")"
 # run an interactive shell in the image
 # using a rootless Podman container
 
-image=upx-stubtools-20221212-v3
+image=upx-stubtools-20221212-v4
 
 flags=( -ti --read-only --rm )
 flags+=( --cap-drop=all )               # drop all capabilities
diff --git a/misc/rebuild-stubs-with-podman/Dockerfile b/misc/rebuild-stubs-with-podman/Dockerfile
index 5fa5265a..7b6b49c5 100644
--- a/misc/rebuild-stubs-with-podman/Dockerfile
+++ b/misc/rebuild-stubs-with-podman/Dockerfile
@@ -1,5 +1,5 @@
 FROM docker.io/library/ubuntu:22.04
-ENV UPX_CONTAINER_IMAGE_NAME=upx-stubtools-20221212-v3
+ENV UPX_CONTAINER_IMAGE_NAME=upx-stubtools-20221212-v4
 ARG DEBIAN_FRONTEND=noninteractive
 ENV LANG=C.UTF-8
 
@@ -13,9 +13,9 @@ RUN dpkg --add-architecture i386 \
         # the following packages are not required for rebuilding the stubs, but
         # they do make the image much more convenient and also allow building
         # the full UPX binary inside the container via CMake:
-        7zip bfs bzip2 cmake elfutils fd-find file fzf g++ gdb htop hyperfine \
-        libzstd-dev lzip lzop ninja-build p7zip patch patchelf pax-utils ripgrep \
-        rsync screen universal-ctags unzip vim zip zlib1g-dev zsh zstd \
+        7zip bfs bzip2 cmake curl elfutils fd-find file fzf g++ gdb gojq htop hyperfine \
+        jq libzstd-dev lsb-release lzip lzop ninja-build p7zip patch patchelf pax-utils \
+        ripgrep rsync screen universal-ctags unzip vim zip zlib1g-dev zsh zstd \
         # extra packages for compiling with "gcc -m32" and and "gcc -mx32":
         gcc-multilib g++-multilib \
     && true