diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
new file mode 100644
index 000000000..db84a2f3a
--- /dev/null
+++ b/.github/workflows/macos.yml
@@ -0,0 +1,18 @@
+name: macos-builder
+on:
+  workflow_dispatch:
+    branches: [ master, stable* ]
+  schedule:
+    - cron: '30 5 * * SUN'
+
+jobs:
+  build:
+    runs-on: macos-latest
+    name: "Run macos build on mac-latest"
+    steps:
+      - name: "Check out source"
+        uses: actions/checkout@v4
+
+      - name: "Run mingw [shared] build..."
+        run: |
+          ./scripts/mingw.sh
diff --git a/channels/rdpdr/client/rdpdr_main.c b/channels/rdpdr/client/rdpdr_main.c
index ebe5ad233..c5aa90b37 100644
--- a/channels/rdpdr/client/rdpdr_main.c
+++ b/channels/rdpdr/client/rdpdr_main.c
@@ -681,36 +681,30 @@ static void first_hotplug(rdpdrPlugin* rdpdr)
 
 static DWORD WINAPI drive_hotplug_thread_func(LPVOID arg)
 {
-	rdpdrPlugin* rdpdr;
-	FSEventStreamRef fsev;
-	rdpdr = (rdpdrPlugin*)arg;
+	rdpdrPlugin* rdpdr = (rdpdrPlugin*)arg;
+	WINPR_ASSERT(rdpdr);
+	WINPR_ASSERT(rdpdr->stopEvent);
+
 	CFStringRef path = CFSTR("/Volumes/");
 	CFArrayRef pathsToWatch = CFArrayCreate(kCFAllocatorMalloc, (const void**)&path, 1, NULL);
-	FSEventStreamContext ctx = { 0 };
-
-	ctx.info = arg;
-
-	WINPR_ASSERT(!rdpdr->stopEvent);
-	rdpdr->stopEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
-	if (!rdpdr->stopEvent)
-		goto out;
-
-	fsev =
+	FSEventStreamContext ctx = {
+		.copyDescription = NULL, .info = arg, .release = NULL, .retain = NULL, .version = 0
+	};
+	FSEventStreamRef fsev =
 	    FSEventStreamCreate(kCFAllocatorMalloc, drive_hotplug_fsevent_callback, &ctx, pathsToWatch,
 	                        kFSEventStreamEventIdSinceNow, 1, kFSEventStreamCreateFlagNone);
 
-	rdpdr->runLoop = CFRunLoopGetCurrent();
-	FSEventStreamScheduleWithRunLoop(fsev, rdpdr->runLoop, kCFRunLoopDefaultMode);
+	dispatch_queue_t queue = dispatch_queue_create(TAG, NULL);
+	FSEventStreamSetDispatchQueue(fsev, queue);
 	FSEventStreamStart(fsev);
-	CFRunLoopRun();
+	WLog_Print(rdpdr->log, WLOG_DEBUG, "Started hotplug watcher");
+	HANDLE handles[] = { rdpdr->stopEvent, freerdp_abort_event(rdpdr->rdpcontext) };
+	WaitForMultipleObjects(ARRAYSIZE(handles), handles, FALSE, INFINITE);
+	WLog_Print(rdpdr->log, WLOG_DEBUG, "Stopped hotplug watcher");
 	FSEventStreamStop(fsev);
 	FSEventStreamRelease(fsev);
+	dispatch_release(queue);
 out:
-	if (rdpdr->stopEvent)
-	{
-		(void)CloseHandle(rdpdr->stopEvent);
-		rdpdr->stopEvent = NULL;
-	}
 	ExitThread(CHANNEL_RC_OK);
 	return CHANNEL_RC_OK;
 }
@@ -1054,11 +1048,7 @@ static DWORD WINAPI drive_hotplug_thread_func(LPVOID arg)
 	rdpdr = (rdpdrPlugin*)arg;
 
 	WINPR_ASSERT(rdpdr);
-
-	WINPR_ASSERT(!rdpdr->stopEvent);
-	rdpdr->stopEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
-	if (!rdpdr->stopEvent)
-		goto out;
+	WINPR_ASSERT(rdpdr->stopEvent);
 
 	while (WaitForSingleObject(rdpdr->stopEvent, 1000) == WAIT_TIMEOUT)
 	{
@@ -1084,12 +1074,6 @@ out:
 	if (error && rdpdr->rdpcontext)
 		setChannelError(rdpdr->rdpcontext, error, "reported an error");
 
-	if (rdpdr->stopEvent)
-	{
-		(void)CloseHandle(rdpdr->stopEvent);
-		rdpdr->stopEvent = NULL;
-	}
-
 	ExitThread(error);
 	return error;
 }
@@ -1114,9 +1098,6 @@ static UINT drive_hotplug_thread_terminate(rdpdrPlugin* rdpdr)
 		if (rdpdr->stopEvent)
 			(void)SetEvent(rdpdr->stopEvent);
 #endif
-#ifdef __MACOSX__
-		CFRunLoopStop(rdpdr->runLoop);
-#endif
 
 		if (WaitForSingleObject(rdpdr->hotplugThread, INFINITE) == WAIT_FAILED)
 		{
@@ -2239,6 +2220,13 @@ static UINT rdpdr_virtual_channel_event_disconnected(rdpdrPlugin* rdpdr)
 static void rdpdr_virtual_channel_event_terminated(rdpdrPlugin* rdpdr)
 {
 	WINPR_ASSERT(rdpdr);
+#if !defined(_WIN32)
+	if (rdpdr->stopEvent)
+	{
+		(void)CloseHandle(rdpdr->stopEvent);
+		rdpdr->stopEvent = NULL;
+	}
+#endif
 	rdpdr->InitHandle = 0;
 	StreamPool_Free(rdpdr->pool);
 	free(rdpdr);
@@ -2261,6 +2249,11 @@ static VOID VCAPITYPE rdpdr_virtual_channel_init_event_ex(LPVOID lpUserParam, LP
 	switch (event)
 	{
 		case CHANNEL_EVENT_INITIALIZED:
+#if !defined(_WIN32)
+			WINPR_ASSERT(!rdpdr->stopEvent);
+			rdpdr->stopEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
+			WINPR_ASSERT(rdpdr->stopEvent);
+#endif
 			break;
 
 		case CHANNEL_EVENT_CONNECTED:
diff --git a/channels/rdpdr/client/rdpdr_main.h b/channels/rdpdr/client/rdpdr_main.h
index 4604732a0..b0fa1c9f3 100644
--- a/channels/rdpdr/client/rdpdr_main.h
+++ b/channels/rdpdr/client/rdpdr_main.h
@@ -103,9 +103,6 @@ typedef struct
 #ifdef _WIN32
 	HWND hotplug_wnd;
 #endif
-#ifdef __MACOSX__
-	CFRunLoopRef runLoop;
-#endif
 #ifndef _WIN32
 	HANDLE stopEvent;
 #endif
diff --git a/libfreerdp/core/capabilities.c b/libfreerdp/core/capabilities.c
index c1f33eb60..0cf8489a3 100644
--- a/libfreerdp/core/capabilities.c
+++ b/libfreerdp/core/capabilities.c
@@ -31,8 +31,6 @@
 
 #include <freerdp/log.h>
 
-#define CAPS_TAG FREERDP_TAG("core.capabilities")
-
 static const char* const CAPSET_TYPE_STRINGS[] = { "Unknown",
 	                                               "General",
 	                                               "Bitmap",
diff --git a/libfreerdp/core/gcc.c b/libfreerdp/core/gcc.c
index 043e9862f..8e48926b0 100644
--- a/libfreerdp/core/gcc.c
+++ b/libfreerdp/core/gcc.c
@@ -1638,8 +1638,6 @@ BOOL gcc_write_client_security_data(wStream* s, const rdpMcs* mcs)
 
 BOOL gcc_read_server_security_data(wStream* s, rdpMcs* mcs)
 {
-	const BYTE* data = NULL;
-	UINT32 length = 0;
 	BOOL validCryptoConfig = FALSE;
 	UINT32 EncryptionMethod = 0;
 	UINT32 EncryptionLevel = 0;
@@ -1779,18 +1777,16 @@ BOOL gcc_read_server_security_data(wStream* s, rdpMcs* mcs)
 
 	Stream_Read(s, settings->ServerCertificate, settings->ServerCertificateLength);
 
-	data = settings->ServerCertificate;
-	length = settings->ServerCertificateLength;
+	const BYTE* data = settings->ServerCertificate;
+	const uint32_t length = settings->ServerCertificateLength;
 
 	if (!freerdp_certificate_read_server_cert(settings->RdpServerCertificate, data, length))
 		goto fail;
 
 	return TRUE;
 fail:
-	free(settings->ServerRandom);
-	free(settings->ServerCertificate);
-	settings->ServerRandom = NULL;
-	settings->ServerCertificate = NULL;
+	(void)freerdp_settings_set_pointer_len(settings, FreeRDP_ServerRandom, NULL, 0);
+	(void)freerdp_settings_set_pointer_len(settings, FreeRDP_ServerCertificate, NULL, 0);
 	return FALSE;
 }
 
diff --git a/packaging/deb/freerdp-nightly/rules b/packaging/deb/freerdp-nightly/rules
index 754924836..97f23bb9c 100755
--- a/packaging/deb/freerdp-nightly/rules
+++ b/packaging/deb/freerdp-nightly/rules
@@ -49,7 +49,9 @@ DEB_CMAKE_EXTRA_FLAGS :=  -GNinja \
 						  -DUWAC_FORCE_STATIC_BUILD=ON \
 						  -DWITH_BINARY_VERSIONING=ON \
 						  -DWITH_RESOURCE_VERSIONING=ON \
-						  -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+						  -DCMAKE_BUILD_TYPE=Debug \
+						  -DCMAKE_C_FLAGS="-O1" \
+						  -DCMAKE_CXX_FLAGS="-O1" \
 						  -DCMAKE_INSTALL_PREFIX=/opt/freerdp-nightly/ \
 						  -DCMAKE_INSTALL_INCLUDEDIR=include \
 						  -DCMAKE_INSTALL_LIBDIR=lib \
diff --git a/packaging/rpm/freerdp-nightly.spec b/packaging/rpm/freerdp-nightly.spec
index e2153a8a7..11afcfaf2 100644
--- a/packaging/rpm/freerdp-nightly.spec
+++ b/packaging/rpm/freerdp-nightly.spec
@@ -216,7 +216,9 @@ cp %{_topdir}/SOURCES/source_version freerdp-nightly-%{version}/.source_version
     -DBUILD_TESTING=ON \
     -DBUILD_TESTING_NO_H264=ON \
     -DCMAKE_CTEST_ARGUMENTS="-DExperimentalTest;--output-on-failure;--no-compress-output" \
-    -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+    -DCMAKE_BUILD_TYPE=Debug \
+    -DCMAKE_C_FLAGS="-O1" \
+    -DCMAKE_CXX_FLAGS="-O1" \
     -DCMAKE_INSTALL_PREFIX=%{INSTALL_PREFIX} \
     -DCMAKE_INSTALL_LIBDIR=%{_lib}
 
diff --git a/scripts/bundle-mac-os.sh b/scripts/bundle-mac-os.sh
index 2e0722094..776c92555 100755
--- a/scripts/bundle-mac-os.sh
+++ b/scripts/bundle-mac-os.sh
@@ -133,20 +133,20 @@ CMAKE_ARGS="-DCMAKE_SKIP_INSTALL_ALL_DEPENDENCY=ON \
 if [ ! -d $SRC ]; then
   mkdir -p $SRC
   cd $SRC
-  git clone --depth 1 -b openssl-3.3.1 https://github.com/openssl/openssl.git
+  git clone --depth 1 -b openssl-3.4.1 https://github.com/openssl/openssl.git
   git clone --depth 1 -b v1.3.1 https://github.com/madler/zlib.git
   git clone --depth 1 -b uriparser-0.9.8 https://github.com/uriparser/uriparser.git
   git clone --depth 1 -b v1.7.18 https://github.com/DaveGamble/cJSON.git
-  git clone --depth 1 -b release-2.30.4 https://github.com/libsdl-org/SDL.git
-  git clone --depth 1 --shallow-submodules --recurse-submodules -b release-2.22.0 https://github.com/libsdl-org/SDL_ttf.git
-  git clone --depth 1 --shallow-submodules --recurse-submodules -b release-2.8.2 https://github.com/libsdl-org/SDL_image.git
-  git clone --depth 1 --shallow-submodules --recurse-submodules -b v1.0.27-1 https://github.com/libusb/libusb-cmake.git
-  git clone --depth 1 -b n7.0.1 https://github.com/FFmpeg/FFmpeg.git
+  git clone --depth 1 -b release-3.2.8 https://github.com/libsdl-org/SDL.git
+  git clone --depth 1 --shallow-submodules --recurse-submodules -b release-3.2.0 https://github.com/libsdl-org/SDL_ttf.git
+  git clone --depth 1 --shallow-submodules --recurse-submodules -b release-3.2.4 https://github.com/libsdl-org/SDL_image.git
+  git clone --depth 1 --shallow-submodules --recurse-submodules -b v1.0.28-0 https://github.com/libusb/libusb-cmake.git
+  git clone --depth 1 -b n7.1.1 https://github.com/FFmpeg/FFmpeg.git
   git clone --depth 1 -b v2.4.1 https://github.com/cisco/openh264.git
   git clone --depth 1 -b v1.5.2 https://gitlab.xiph.org/xiph/opus.git
-  git clone --depth 1 -b 2.11.1 https://github.com/knik0/faad2.git
-  git clone --depth 1 -b 1.18.0 https://gitlab.freedesktop.org/cairo/cairo.git
-  git clone --depth 1 -b 1_30 https://github.com/knik0/faac.git
+  git clone --depth 1 -b 2.11.2 https://github.com/knik0/faad2.git
+  git clone --depth 1 -b 1.18.4 https://gitlab.freedesktop.org/cairo/cairo.git
+  git clone --depth 1 -b faac-1.31.1 https://github.com/knik0/faac.git
   cd faac
   ./bootstrap
 fi
@@ -187,12 +187,12 @@ cmake -GNinja -BSDL -S$SRC/SDL $CMAKE_ARGS -DSDL_TEST=OFF -DSDL_TESTS=OFF -DSDL_
 cmake --build SDL
 cmake --install SDL
 
-cmake -GNinja -BSDL_ttf -S$SRC/SDL_ttf $CMAKE_ARGS -DSDL2TTF_HARFBUZZ=ON -DSDL2TTF_FREETYPE=ON -DSDL2TTF_VENDORED=ON \
-  -DFT_DISABLE_ZLIB=OFF -DSDL2TTF_SAMPLES=OFF
+cmake -GNinja -BSDL_ttf -S$SRC/SDL_ttf $CMAKE_ARGS -DSDLTTF_HARFBUZZ=ON -DSDLTTF_FREETYPE=ON -DSDLTTF_VENDORED=ON \
+  -DFT_DISABLE_ZLIB=OFF -DSDLTTF_SAMPLES=OFF
 cmake --build SDL_ttf
 cmake --install SDL_ttf
 
-cmake -GNinja -BSDL_image -S$SRC/SDL_image $CMAKE_ARGS -DSDL2IMAGE_SAMPLES=OFF -DSDL2IMAGE_DEPS_SHARED=OFF
+cmake -GNinja -BSDL_image -S$SRC/SDL_image $CMAKE_ARGS -DSDLIMAGE_SAMPLES=OFF -DSDLIMAGE_DEPS_SHARED=OFF
 cmake --build SDL_image
 cmake --install SDL_image
 
@@ -219,8 +219,8 @@ CFLAGS="$OSSL_FLAGS -U__SSE2__" LDFLAGS=$OSSL_FLAGS make -j install
 
 cd $BUILD
 
-meson setup --prefix="$INSTALL" -Doptimization=3 -Db_lto=true -Db_pie=true -Dc_args="$OSSL_FLAGS" -Dc_link_args="$OSSL_FLAGS" \
-  -Dcpp_args="$OSSL_FLAGS" -Dcpp_link_args="$OSSL_FLAGS" -Dpkgconfig.relocatable=true -Dtests=disabled \
+meson setup --prefix="$INSTALL" -Doptimization=3 -Db_lto=true -Db_pie=true -Dc_args="$OSSL_FLAGS -Wno-error" -Dc_link_args="$OSSL_FLAGS" \
+  -Dcpp_args="$OSSL_FLAGS -Wno-error" -Dcpp_link_args="$OSSL_FLAGS" -Dpkgconfig.relocatable=true -Dtests=disabled -Dwerror=false \
   -Dlibdir=lib openh264 $SRC/openh264
 ninja -C openh264 install
 
@@ -254,6 +254,7 @@ cd $BUILD
 cmake -GNinja -Bfreerdp -S"$SCRIPT_PATH/.." \
   $CMAKE_ARGS \
   -DWITH_PLATFORM_SERVER=OFF \
+  -DWITH_CLIENT_SDL2=OFF \
   -DWITH_SIMD=ON \
   -DWITH_FFMPEG=OFF \
   -DWITH_VERBOSE_WINPR_ASSERT=OFF \