diff --git a/CHANGES b/CHANGES
index de90abb305..11bc5a376d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,19 @@
+7.2.0-dev.72 | 2025-01-11 17:36:31 +0100
+
+  * Mark `swap` specialization `noexcept` (Benjamin Bannier, Corelight)
+
+  * Clean up some includes (Benjamin Bannier, Corelight)
+
+  * Prevent exception in `noexcept` function. (Benjamin Bannier, Corelight)
+
+  * Prevent exception escape. (Benjamin Bannier, Corelight)
+
+  * Prevent unnecessary copies in Spicy bindings (Benjamin Bannier, Corelight)
+
+  * Bump auxil/spicy to latest development snapshot (Benjamin Bannier, Corelight)
+
+  * Update doc submodule [nomail] [skip ci] (zeek-bot)
+
 7.2.0-dev.64 | 2025-01-10 11:15:24 -0800
 
   * GH-4102: Harden flaky test based on creating a file (Evan Typanski, Corelight)
diff --git a/VERSION b/VERSION
index e42e223600..cfca6b8e3c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-7.2.0-dev.64
+7.2.0-dev.72
diff --git a/auxil/spicy b/auxil/spicy
index 4c2cd8c3d7..5f1e39698d 160000
--- a/auxil/spicy
+++ b/auxil/spicy
@@ -1 +1 @@
-Subproject commit 4c2cd8c3d7dbff98c95bf69824ed642ae40b1ecd
+Subproject commit 5f1e39698d8b2e16ae860620e82adb281d500017
diff --git a/src/spicy/cookie.h b/src/spicy/cookie.h
index 6823dfc488..2739f0d026 100644
--- a/src/spicy/cookie.h
+++ b/src/spicy/cookie.h
@@ -7,18 +7,21 @@
 
 #pragma once
 
+#include <exception>
 #include <memory>
 #include <optional>
 #include <string>
 #include <utility>
-#include <variant>
 #include <vector>
 
+#include <hilti/rt/backtrace.h>
+
+#include "zeek/Reporter.h"
 #include "zeek/Val.h"
 #include "zeek/analyzer/Analyzer.h"
-#include "zeek/analyzer/protocol/tcp/TCP.h"
 #include "zeek/file_analysis/Analyzer.h"
 #include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/protocol/tcp/TCPSessionAdapter.h"
 
 namespace zeek::spicy::rt {
 
@@ -129,10 +132,25 @@ struct Cookie {
     Cookie(cookie::ProtocolAnalyzer&& c) : data(std::move(c)) { protocol = &data.protocol; }
     Cookie(cookie::FileAnalyzer&& c) : data(std::move(c)) { file = &data.file; }
     Cookie(cookie::PacketAnalyzer&& c) : data(std::move(c)) { packet = &data.packet; }
-    Cookie(Cookie&& other) noexcept : data(other.tag(), std::move(other.data)) { _initLike(other); }
+
+    Cookie(Cookie&& other) noexcept
+        : data(
+              [&]() {
+                  try {
+                      return other.tag();
+                  } catch ( const std::exception& e ) {
+                      auto type = hilti::rt::demangle(typeid(e).name());
+                      reporter->FatalError("terminating with uncaught exception of type %s: %s", type.c_str(),
+                                           e.what());
+                  }
+              }(),
+              std::move(other.data)) {
+        _initLike(other);
+    }
+
     ~Cookie() { _delete(); }
 
-    Cookie& operator=(Cookie&& other) noexcept {
+    Cookie& operator=(Cookie&& other) noexcept try {
         if ( this == &other )
             return *this;
 
@@ -141,6 +159,9 @@ struct Cookie {
 
         new (&data) Data(tag(), std::move(other.data));
         return *this;
+    } catch ( const std::exception& e ) {
+        auto type = hilti::rt::demangle(typeid(e).name());
+        reporter->FatalError("terminating with uncaught exception of type %s: %s", type.c_str(), e.what());
     }
 
     // Cache of values that can be expensive to compute.
@@ -224,7 +245,7 @@ private:
     Cookie(const Cookie& other) = delete;
     Cookie& operator=(const Cookie& other) = delete;
 
-    friend inline void swap(Cookie& lhs, Cookie& rhs) {
+    friend inline void swap(Cookie& lhs, Cookie& rhs) noexcept {
         Cookie tmp = std::move(lhs);
         lhs = std::move(rhs);
         rhs = std::move(tmp);
diff --git a/src/spicy/manager.cc b/src/spicy/manager.cc
index 4ae035cf90..db533a3030 100644
--- a/src/spicy/manager.cc
+++ b/src/spicy/manager.cc
@@ -5,7 +5,6 @@
 #include <dlfcn.h>
 #include <glob.h>
 
-#include <exception>
 #include <iterator>
 #include <limits>
 #include <utility>
@@ -29,7 +28,6 @@
 #include <zeek/file_analysis/Manager.h>
 #include <zeek/packet_analysis/Manager.h>
 
-#include "zeek/DebugLogger.h"
 #include "zeek/spicy/file-analyzer.h"
 #include "zeek/spicy/packet-analyzer.h"
 #include "zeek/spicy/protocol-analyzer.h"
@@ -244,7 +242,7 @@ void Manager::registerType(const std::string& id, const TypePtr& type) {
     zeek_id->SetType(type);
     zeek_id->MakeType();
 
-    detail::zeekygen_mgr->Identifier(zeek_id);
+    detail::zeekygen_mgr->Identifier(std::move(zeek_id));
 
     if ( _module_info )
         _module_info->AddBifItem(id, ::zeek::plugin::BifItem::TYPE);
@@ -281,7 +279,7 @@ void Manager::registerEvent(const std::string& name) {
     if ( auto id = detail::lookup_ID(name.c_str(), mod.c_str(), false, false, false) ) {
         // Auto-export IDs that already exist.
         id->SetExport();
-        _events[name] = id;
+        _events[name] = std::move(id);
     }
     else
         // This installs & exports the ID, but it doesn't set its type yet.
@@ -632,7 +630,7 @@ void Manager::InitPostScript() {
     hilti_config.abort_on_exceptions = id::find_const("Spicy::abort_on_exceptions")->AsBool();
     hilti_config.show_backtraces = id::find_const("Spicy::show_backtraces")->AsBool();
 
-    hilti::rt::configuration::set(hilti_config);
+    hilti::rt::configuration::set(std::move(hilti_config));
 
     auto spicy_config = ::spicy::rt::configuration::get();
     spicy_config.hook_accept_input = hook_accept_input;
@@ -686,7 +684,7 @@ void Manager::InitPostScript() {
         if ( ! tag )
             reporter->InternalError("cannot get analyzer tag for '%s'", p.name_analyzer.c_str());
 
-        auto register_analyzer_for_port = [&](auto tag, const hilti::rt::Port& port_) {
+        auto register_analyzer_for_port = [&](const auto& tag, const hilti::rt::Port& port_) {
             SPICY_DEBUG(hilti::rt::fmt("  Scheduling analyzer for port %s", port_));
 
             // Well-known ports are registered in scriptland, so we'll raise an
@@ -695,7 +693,7 @@ void Manager::InitPostScript() {
             vals.emplace_back(tag.AsVal());
             vals.emplace_back(zeek::spicy::rt::to_val(port_, base_type(TYPE_PORT)));
             EventHandlerPtr handler = event_registry->Register("spicy_analyzer_for_port");
-            event_mgr.Enqueue(handler, vals);
+            event_mgr.Enqueue(handler, std::move(vals));
         };
 
         for ( const auto& ports : p.ports ) {
@@ -717,7 +715,7 @@ void Manager::InitPostScript() {
         }
 
         if ( p.parser_resp ) {
-            for ( auto port : p.parser_resp->ports ) {
+            for ( const auto& port : p.parser_resp->ports ) {
                 if ( port.direction != ::spicy::rt::Direction::Both &&
                      port.direction != ::spicy::rt::Direction::Responder )
                     continue;
@@ -742,7 +740,7 @@ void Manager::InitPostScript() {
         if ( ! tag )
             reporter->InternalError("cannot get analyzer tag for '%s'", p.name_analyzer.c_str());
 
-        auto register_analyzer_for_mime_type = [&](auto tag, const std::string& mt) {
+        auto register_analyzer_for_mime_type = [&](const auto& tag, const std::string& mt) {
             SPICY_DEBUG(hilti::rt::fmt("  Scheduling analyzer for MIME type %s", mt));
 
             // MIME types are registered in scriptland, so we'll raise an
@@ -751,7 +749,7 @@ void Manager::InitPostScript() {
             vals.emplace_back(tag.AsVal());
             vals.emplace_back(make_intrusive<StringVal>(mt));
             EventHandlerPtr handler = event_registry->Register("spicy_analyzer_for_mime_type");
-            event_mgr.Enqueue(handler, vals);
+            event_mgr.Enqueue(handler, std::move(vals));
         };
 
         for ( const auto& mt : p.mime_types )
diff --git a/src/spicy/protocol-analyzer.h b/src/spicy/protocol-analyzer.h
index 71be171aff..257e92145d 100644
--- a/src/spicy/protocol-analyzer.h
+++ b/src/spicy/protocol-analyzer.h
@@ -11,6 +11,7 @@
 #include <spicy/rt/driver.h>
 #include <spicy/rt/parser.h>
 
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 #include "zeek/spicy/cookie.h"
 
 namespace zeek::spicy::rt {
diff --git a/src/spicy/runtime-support.cc b/src/spicy/runtime-support.cc
index 77e05bf903..bf05925a4f 100644
--- a/src/spicy/runtime-support.cc
+++ b/src/spicy/runtime-support.cc
@@ -120,7 +120,7 @@ TypePtr rt::create_enum_type(
         etype->AddName(ns, name.c_str(), lval, true);
     }
 
-    return etype;
+    return std::move(etype);
 }
 
 TypePtr rt::create_record_type(const std::string& ns, const std::string& id,
@@ -289,7 +289,7 @@ void rt::debug(const Cookie& cookie, const std::string& msg) {
             hilti::rt::fmt("[%s/%" PRIu32 "/%s] %s", name, p->analyzer->GetID(), (p->is_orig ? "orig" : "resp"), msg));
     }
     else if ( const auto f = cookie.file ) {
-        auto name = file_mgr->GetComponentName(f->analyzer->Tag());
+        const auto& name = file_mgr->GetComponentName(f->analyzer->Tag());
         SPICY_DEBUG(hilti::rt::fmt("[%s/%" PRIu32 "] %s", name, f->analyzer->GetID(), msg));
     }
     else if ( const auto f = cookie.packet ) {
diff --git a/src/spicy/runtime-support.h b/src/spicy/runtime-support.h
index a12780c870..78d82d3897 100644
--- a/src/spicy/runtime-support.h
+++ b/src/spicy/runtime-support.h
@@ -705,7 +705,7 @@ inline ValPtr to_val(const hilti::rt::Vector<T>& v, const TypePtr& target) {
     for ( const auto& i : v )
         zv->Assign(zv->Size(), to_val(i, vt->Yield()));
 
-    return zv;
+    return std::move(zv);
 }
 
 /**
diff --git a/src/spicy/spicy.bif b/src/spicy/spicy.bif
index 1c8b38ab5f..37ab40415b 100644
--- a/src/spicy/spicy.bif
+++ b/src/spicy/spicy.bif
@@ -56,5 +56,5 @@ function Spicy::__resource_usage%(%) : Spicy::ResourceUsage
     r->Assign(n++, ru.max_fiber_stack_size);
     r->Assign(n++, ru.cached_fibers);
 
-    return r;
+    return std::move(r);
     %}
diff --git a/src/spicy/spicyz/driver.cc b/src/spicy/spicyz/driver.cc
index 3cbd91d302..60345277e1 100644
--- a/src/spicy/spicyz/driver.cc
+++ b/src/spicy/spicyz/driver.cc
@@ -137,7 +137,7 @@ hilti::Result<hilti::Nothing> Driver::loadFile(hilti::rt::filesystem::path file,
                 hilti::util::fmt("error computing path of %s relative to %s: %s", file, relative_to, ec.message()));
 
         if ( exists )
-            file = p;
+            file = std::move(p);
     }
 
     auto exists = hilti::rt::filesystem::exists(file, ec);
diff --git a/src/spicy/spicyz/glue-compiler.cc b/src/spicy/spicyz/glue-compiler.cc
index c519084d0a..20b09fac4b 100644
--- a/src/spicy/spicyz/glue-compiler.cc
+++ b/src/spicy/spicyz/glue-compiler.cc
@@ -2,7 +2,6 @@
 
 #include "glue-compiler.h"
 
-#include <algorithm>
 #include <limits>
 #include <stdexcept>
 
@@ -422,7 +421,7 @@ void GlueCompiler::preprocessEvtFile(hilti::rt::filesystem::path& path, std::ist
             // Output empty line to keep line numbers the same
             out << '\n';
 
-            auto m = hilti::util::split1(trimmed);
+            auto m = hilti::util::split1(std::move(trimmed));
 
             if ( auto rc = pp.processLine(m.first, m.second); ! rc )
                 throw ParseError(rc.error());
@@ -517,7 +516,7 @@ bool GlueCompiler::loadEvtFile(hilti::rt::filesystem::path& path) {
                 else
                     SPICY_DEBUG(hilti::util::fmt("  Got module %s to import", module));
 
-                _imports.emplace_back(hilti::ID(module), std::move(scope));
+                _imports.emplace_back(hilti::ID(std::move(module)), std::move(scope));
             }
 
             else if ( looking_at(*chunk, 0, "export") ) {
@@ -699,7 +698,7 @@ glue::ProtocolAnalyzer GlueCompiler::parseProtocolAnalyzer(const std::string& ch
 
                 case both:
                     a.unit_name_orig = unit;
-                    a.unit_name_resp = unit;
+                    a.unit_name_resp = std::move(unit);
                     break;
             }
         }
@@ -1359,7 +1358,10 @@ bool GlueCompiler::CreateSpicyHook(glue::Event* ev) {
 
     body.addCall("zeek_rt::raise_event", {handler_expr, builder()->move(builder()->id("args"))}, meta);
 
-#if SPICY_VERSION_NUMBER >= 11200
+#if SPICY_VERSION_NUMBER >= 11300
+    auto attrs = builder()->attributeSet(
+        {builder()->attribute(hilti::attribute::Kind::Priority, builder()->integer(ev->priority))});
+#elif SPICY_VERSION_NUMBER >= 11200
     auto attrs = builder()->attributeSet(
         {builder()->attribute(hilti::Attribute::Kind::Priority, builder()->integer(ev->priority))});
 #else
@@ -1367,7 +1369,7 @@ bool GlueCompiler::CreateSpicyHook(glue::Event* ev) {
 #endif
     auto parameters = hilti::util::transform(ev->parameters, [](const auto& p) { return p.get(); });
     auto unit_hook = builder()->declarationHook(parameters, body.block(), attrs, meta);
-    auto hook_decl = builder()->declarationUnitHook(ev->hook, unit_hook, meta);
+    auto hook_decl = builder()->declarationUnitHook(ev->hook, unit_hook, std::move(meta));
     ev->spicy_module->spicy_module->add(context(), hook_decl);
 
     return true;
diff --git a/src/spicy/spicyz/main.cc b/src/spicy/spicyz/main.cc
index 0d30af174c..80a76b597e 100644
--- a/src/spicy/spicyz/main.cc
+++ b/src/spicy/spicyz/main.cc
@@ -235,7 +235,7 @@ static hilti::Result<Nothing> parseOptions(int argc, char** argv, hilti::driver:
     return Nothing();
 }
 
-int main(int argc, char** argv) {
+int main(int argc, char** argv) try {
     Driver driver(std::make_unique<GlueCompiler>(), "", configuration::LibraryPath(),
                   configuration::ZeekVersionNumber());
 
@@ -271,4 +271,7 @@ int main(int argc, char** argv) {
     }
 
     return 0;
+} catch ( const std::exception& e ) {
+    hilti::logger().fatalError(hilti::util::fmt("terminating with uncaught exception of type %s: %s",
+                                                hilti::util::demangle(typeid(e).name()), e.what()));
 }