diff --git a/CHANGES b/CHANGES
index 59442de6f6..6273a52362 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,32 @@
 
+3.1.0-dev.372 | 2020-01-13 12:10:42 +0000
+
+  * Fix method returning a reference to a temporary. Found by
+    cppcheck, via by Arthur Wong. (Robin Sommer, Corelight)
+
+3.1.0-dev.370 | 2020-01-09 19:04:59 -0800
+
+  * Update timeouts for a btest (Jon Siwek, Corelight)
+
+3.1.0-dev.368 | 2020-01-09 13:39:38 -0800
+
+  * Extend ASAN_OPTIONS in btests instead of overwrite (Jon Siwek, Corelight)
+
+3.1.0-dev.366 | 2020-01-09 12:28:32 -0800
+
+  * Update external test repo commit hash (Jon Siwek, Corelight)
+
+3.1.0-dev.365 | 2020-01-09 11:38:06 -0800
+
+  * Enable LeakSanitizer for unit tests run via doctest (Jon Siwek, Corelight)
+
+3.1.0-dev.363 | 2020-01-09 10:25:24 -0800
+
+  * fix NTLM field value access
+
+    The fields being checked for existence were not the same as the fields
+    being accessed. (Justin Azoff, Corelight)
+
 3.1.0-dev.361 | 2020-01-08 10:29:59 -0800
 
   * Increase timeout for a few btests (Jon Siwek, Corelight)
diff --git a/VERSION b/VERSION
index d4171fb1fe..366ac4a582 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.1.0-dev.361
+3.1.0-dev.372
diff --git a/aux/paraglob b/aux/paraglob
index ee7932525f..ad61dd7f40 160000
--- a/aux/paraglob
+++ b/aux/paraglob
@@ -1 +1 @@
-Subproject commit ee7932525ff198f1270b3d941f449da5f939f29c
+Subproject commit ad61dd7f402a831c299f688f20ba23f50b1b5c8e
diff --git a/aux/zeekctl b/aux/zeekctl
index 17f3b239f5..6933b86e60 160000
--- a/aux/zeekctl
+++ b/aux/zeekctl
@@ -1 +1 @@
-Subproject commit 17f3b239f5551d8a9050a8d26a254e516db5c393
+Subproject commit 6933b86e60f22f7a39ac1a8adbee4867902ce02e
diff --git a/doc b/doc
index 3bd1c12b9e..7192dbedf3 160000
--- a/doc
+++ b/doc
@@ -1 +1 @@
-Subproject commit 3bd1c12b9e2810b2cbe5e05629ddc59dd83d9d36
+Subproject commit 7192dbedf3ca9ce49294057262074f0e888177f3
diff --git a/scripts/base/protocols/ntlm/main.zeek b/scripts/base/protocols/ntlm/main.zeek
index fb10a9868f..81bfa633dd 100644
--- a/scripts/base/protocols/ntlm/main.zeek
+++ b/scripts/base/protocols/ntlm/main.zeek
@@ -65,9 +65,9 @@ event ntlm_challenge(c: connection, challenge: NTLM::Challenge) &priority=5
 	if ( challenge?$target_info )
 		{
 		local ti = challenge$target_info;
-		if ( ti?$nb_domain_name )
+		if ( ti?$nb_computer_name )
 			c$ntlm$server_nb_computer_name = ti$nb_computer_name;
-		if ( ti?$dns_domain_name )
+		if ( ti?$dns_computer_name )
 			c$ntlm$server_dns_computer_name = ti$dns_computer_name;
 		if ( ti?$dns_tree_name )
 			c$ntlm$server_tree_name = ti$dns_tree_name;
diff --git a/src/main.cc b/src/main.cc
index 81c138ee11..9b7a15ca8d 100644
--- a/src/main.cc
+++ b/src/main.cc
@@ -886,6 +886,7 @@ int main(int argc, char** argv)
 		doctest::Context context;
 		auto dargs = to_cargs(options.doctest_args);
 		context.applyCommandLine(dargs.size(), dargs.data());
+		ZEEK_LSAN_ENABLE();
 		return context.run();
 		}
 
diff --git a/src/plugin/ComponentManager.h b/src/plugin/ComponentManager.h
index 7ff9093dc8..88d04bb3f9 100644
--- a/src/plugin/ComponentManager.h
+++ b/src/plugin/ComponentManager.h
@@ -139,7 +139,7 @@ ComponentManager<T, C>::ComponentManager(const string& arg_module, const string&
 template <class T, class C>
 const std::string& ComponentManager<T, C>::GetModule() const
 	{
-	return module.c_str();
+	return module;
 	}
 
 template <class T, class C>
diff --git a/src/util.cc b/src/util.cc
index 2752c7c0d6..4e597de07f 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -167,6 +167,7 @@ TEST_CASE("util get_escaped_string")
 		{
 		ODesc* d = get_escaped_string(nullptr, "a bcd\n", 6, false);
 		CHECK(strcmp(d->Description(), "a\\x20bcd\\x0a") == 0);
+		delete d;
 		}
 
 	SUBCASE("provided ODesc")
diff --git a/testing/btest/core/div-by-zero.zeek b/testing/btest/core/div-by-zero.zeek
index 1d0f7013ca..56feb278d6 100644
--- a/testing/btest/core/div-by-zero.zeek
+++ b/testing/btest/core/div-by-zero.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b %INPUT >out 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >out 2>&1
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
 
 event div_int(a: int, b: int)
diff --git a/testing/btest/core/expr-exception.zeek b/testing/btest/core/expr-exception.zeek
index 4cbb4b1c47..27fcbad5a2 100644
--- a/testing/btest/core/expr-exception.zeek
+++ b/testing/btest/core/expr-exception.zeek
@@ -2,7 +2,7 @@
 # shouldn't abort Zeek entirely, but just return from the function body.
 #
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -r $TRACES/wikipedia.trace %INPUT >output
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -r $TRACES/wikipedia.trace %INPUT >output
 # @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff reporter.log
 # @TEST-EXEC: btest-diff output
 
diff --git a/testing/btest/core/reporter-error-in-handler.zeek b/testing/btest/core/reporter-error-in-handler.zeek
index 1b13c0ddbe..3ec9eac280 100644
--- a/testing/btest/core/reporter-error-in-handler.zeek
+++ b/testing/btest/core/reporter-error-in-handler.zeek
@@ -3,7 +3,7 @@
 # than looping indefinitly, the error inside the handler should reported to stderr.
 #
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek %INPUT >output 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek %INPUT >output 2>&1
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output
 
 global a: table[count] of count;
diff --git a/testing/btest/core/when-interpreter-exceptions.zeek b/testing/btest/core/when-interpreter-exceptions.zeek
index f70bb39ea4..fb6c0d1f3b 100644
--- a/testing/btest/core/when-interpreter-exceptions.zeek
+++ b/testing/btest/core/when-interpreter-exceptions.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" btest-bg-run zeek "zeek -b %INPUT >output 2>&1"
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" btest-bg-run zeek "zeek -b %INPUT >output 2>&1"
 # @TEST-EXEC: btest-bg-wait 30
 # @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps | $SCRIPTS/diff-sort" btest-diff zeek/output
 
diff --git a/testing/btest/language/common-mistakes.zeek b/testing/btest/language/common-mistakes.zeek
index 6b8701b877..694dbe3ad2 100644
--- a/testing/btest/language/common-mistakes.zeek
+++ b/testing/btest/language/common-mistakes.zeek
@@ -3,13 +3,13 @@
 # of the current event handler body.
 
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b 1.zeek >1.out 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b 1.zeek >1.out 2>&1
 # @TEST-EXEC: btest-diff 1.out
 
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b 2.zeek >2.out 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b 2.zeek >2.out 2>&1
 # @TEST-EXEC: btest-diff 2.out
 
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b 3.zeek >3.out 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b 3.zeek >3.out 2>&1
 # @TEST-EXEC: btest-diff 3.out
 
 @TEST-START-FILE 1.zeek
diff --git a/testing/btest/language/copy-cycle.zeek b/testing/btest/language/copy-cycle.zeek
index edda97547c..04dc5c3883 100644
--- a/testing/btest/language/copy-cycle.zeek
+++ b/testing/btest/language/copy-cycle.zeek
@@ -1,6 +1,6 @@
 # TODO: There's explicitly a reference cycle being created in this test that
 # causes a memory leak, so just disable leak checking.
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b %INPUT >out
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >out
 # @TEST-EXEC: btest-diff out
 
 type B: record {
diff --git a/testing/btest/language/expire-expr-error.zeek b/testing/btest/language/expire-expr-error.zeek
index 907d5b8460..ac47d37d41 100644
--- a/testing/btest/language/expire-expr-error.zeek
+++ b/testing/btest/language/expire-expr-error.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b %INPUT
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT
 # @TEST-EXEC: cp .stderr output
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output
 
diff --git a/testing/btest/language/expire-func-undef.zeek b/testing/btest/language/expire-func-undef.zeek
index dba8f6c873..9828fc886c 100644
--- a/testing/btest/language/expire-func-undef.zeek
+++ b/testing/btest/language/expire-func-undef.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -r $TRACES/rotation.trace -b %INPUT >output 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -r $TRACES/rotation.trace -b %INPUT >output 2>&1
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output
 
 module segfault; 
diff --git a/testing/btest/language/index-assignment-invalid.zeek b/testing/btest/language/index-assignment-invalid.zeek
index ad7bc38384..947168f64c 100644
--- a/testing/btest/language/index-assignment-invalid.zeek
+++ b/testing/btest/language/index-assignment-invalid.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b %INPUT >output 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >output 2>&1
 # @TEST-EXEC: grep "error" output >output2
 # @TEST-EXEC: for i in 1 2 3 4 5; do cat output2 | cut -d'|' -f$i >>out; done
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
diff --git a/testing/btest/language/invalid_index.zeek b/testing/btest/language/invalid_index.zeek
index e55d691520..a1cbe4c868 100644
--- a/testing/btest/language/invalid_index.zeek
+++ b/testing/btest/language/invalid_index.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b %INPUT >out 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >out 2>&1
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
 
 global foo: vector of count = { 42 };
diff --git a/testing/btest/language/subnet-errors.zeek b/testing/btest/language/subnet-errors.zeek
index 4968e381ec..d0c9fd6aa4 100644
--- a/testing/btest/language/subnet-errors.zeek
+++ b/testing/btest/language/subnet-errors.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b %INPUT >out 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >out 2>&1
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
 
 event zeek_init()
diff --git a/testing/btest/language/type-cast-error-dynamic.zeek b/testing/btest/language/type-cast-error-dynamic.zeek
index 3ae4cfcb6b..443cd1acc8 100644
--- a/testing/btest/language/type-cast-error-dynamic.zeek
+++ b/testing/btest/language/type-cast-error-dynamic.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b %INPUT >output 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >output 2>&1
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output
 
 type X: record  {
diff --git a/testing/btest/language/type-coerce-numerics.zeek b/testing/btest/language/type-coerce-numerics.zeek
index 3e7c919f16..2c1a2eb241 100644
--- a/testing/btest/language/type-coerce-numerics.zeek
+++ b/testing/btest/language/type-coerce-numerics.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b first_set.zeek >first_set.out 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b first_set.zeek >first_set.out 2>&1
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff first_set.out
 
 # @TEST-EXEC-FAIL: zeek -b double_convert_failure1.zeek >double_convert_failure1.out 2>&1
diff --git a/testing/btest/language/uninitialized-local2.zeek b/testing/btest/language/uninitialized-local2.zeek
index 8d270cc041..d5f8eb7cec 100644
--- a/testing/btest/language/uninitialized-local2.zeek
+++ b/testing/btest/language/uninitialized-local2.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek -b %INPUT >out 2>&1
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >out 2>&1
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
 
 event test()
diff --git a/testing/btest/plugins/reporter-hook.zeek b/testing/btest/plugins/reporter-hook.zeek
index 7d1f2b1093..6619d98224 100644
--- a/testing/btest/plugins/reporter-hook.zeek
+++ b/testing/btest/plugins/reporter-hook.zeek
@@ -2,7 +2,7 @@
 # @TEST-EXEC: cp -r %DIR/reporter-hook-plugin/* .
 # @TEST-EXEC: ./configure --zeek-dist=${DIST} && make
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" ZEEK_PLUGIN_ACTIVATE="Reporter::Hook" ZEEK_PLUGIN_PATH=`pwd` zeek -b %INPUT 2>&1 | $SCRIPTS/diff-remove-abspath | sort | uniq  >output
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" ZEEK_PLUGIN_ACTIVATE="Reporter::Hook" ZEEK_PLUGIN_PATH=`pwd` zeek -b %INPUT 2>&1 | $SCRIPTS/diff-remove-abspath | sort | uniq  >output
 # @TEST-EXEC: btest-diff output
 # @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff reporter.log
 
diff --git a/testing/btest/scripts/base/frameworks/input/missing-file-initially.zeek b/testing/btest/scripts/base/frameworks/input/missing-file-initially.zeek
index 5d87c6d786..d4898ef60f 100644
--- a/testing/btest/scripts/base/frameworks/input/missing-file-initially.zeek
+++ b/testing/btest/scripts/base/frameworks/input/missing-file-initially.zeek
@@ -4,12 +4,12 @@
 # failing behavior.
 
 # @TEST-EXEC: btest-bg-run zeek zeek %INPUT
-# @TEST-EXEC: $SCRIPTS/wait-for-file zeek/init 5 || (btest-bg-wait -k 1 && false)
+# @TEST-EXEC: $SCRIPTS/wait-for-file zeek/init 10 || (btest-bg-wait -k 1 && false)
 # @TEST-EXEC: mv does-exist.dat does-not-exist.dat
-# @TEST-EXEC: $SCRIPTS/wait-for-file zeek/next 5 || (btest-bg-wait -k 1 && false)
+# @TEST-EXEC: $SCRIPTS/wait-for-file zeek/next 10 || (btest-bg-wait -k 1 && false)
 # @TEST-EXEC: mv does-not-exist.dat does-not-exist-again.dat
 # @TEST-EXEC: echo "3 streaming still works" >> does-not-exist-again.dat
-# @TEST-EXEC: btest-bg-wait 5
+# @TEST-EXEC: btest-bg-wait 10
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff zeek/.stdout
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff zeek/.stderr
 
diff --git a/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek b/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek
index 0f1b48bab7..803308dbb6 100644
--- a/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek
+++ b/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek %INPUT
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek %INPUT
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr
 # @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff reporter.log
 
diff --git a/testing/btest/scripts/base/frameworks/reporter/stderr.zeek b/testing/btest/scripts/base/frameworks/reporter/stderr.zeek
index bfbecc206f..c1af87d9ad 100644
--- a/testing/btest/scripts/base/frameworks/reporter/stderr.zeek
+++ b/testing/btest/scripts/base/frameworks/reporter/stderr.zeek
@@ -1,5 +1,5 @@
 # TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks
-# @TEST-EXEC: ASAN_OPTIONS="detect_leaks=0" zeek %INPUT
+# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek %INPUT
 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr
 # @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff reporter.log
 
diff --git a/testing/external/commit-hash.zeek-testing-private b/testing/external/commit-hash.zeek-testing-private
index 4c0cb92860..edb5b9badb 100644
--- a/testing/external/commit-hash.zeek-testing-private
+++ b/testing/external/commit-hash.zeek-testing-private
@@ -1 +1 @@
-931f49917a86a260c69e091c2f66b693e74b33bf
+f6b4374ade1603e0731488bea5fe9d8087c6288f