diff --git a/GNUmakefile b/GNUmakefile
index 2eef3128..3dd0690b 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -743,7 +743,7 @@ $(SQLITE_OBJS): CFLAGS += \
 
 QUICKJS_SOURCES := \
 	deps/quickjs/cutils.c \
-	deps/quickjs/libbf.c \
+	deps/quickjs/dtoa.c \
 	deps/quickjs/libregexp.c \
 	deps/quickjs/libunicode.c \
 	deps/quickjs/quickjs.c
diff --git a/deps/quickjs b/deps/quickjs
index 3f81070e..19abf188 160000
--- a/deps/quickjs
+++ b/deps/quickjs
@@ -1 +1 @@
-Subproject commit 3f81070e573e3592728dbbbd04c84c498b20d6dc
+Subproject commit 19abf1888db5884a5758036ff6e7fa2b340acedc
diff --git a/src/ssb.c b/src/ssb.c
index a0fc6d04..739d927b 100644
--- a/src/ssb.c
+++ b/src/ssb.c
@@ -4630,6 +4630,10 @@ void tf_ssb_sync_start(tf_ssb_t* ssb)
 
 bool tf_ssb_tunnel_create(tf_ssb_t* ssb, const char* portal_id, const char* target_id, int connect_flags)
 {
+	if (!portal_id || !target_id)
+	{
+		return false;
+	}
 	tf_ssb_connection_t* connection = tf_ssb_connection_get(ssb, portal_id);
 	if (connection && !tf_ssb_connection_get(ssb, target_id))
 	{
diff --git a/src/ssb.js.c b/src/ssb.js.c
index ed9981a7..461dfe91 100644
--- a/src/ssb.js.c
+++ b/src/ssb.js.c
@@ -1788,7 +1788,7 @@ static JSValue _tf_ssb_createTunnel(JSContext* context, JSValueConst this_val, i
 	const char* portal_id = JS_ToCString(context, argv[0]);
 	const char* target_id = JS_ToCString(context, argv[1]);
 
-	bool result = tf_ssb_tunnel_create(ssb, portal_id, target_id, 0);
+	bool result = portal_id && target_id && tf_ssb_tunnel_create(ssb, portal_id, target_id, 0);
 
 	JS_FreeCString(context, target_id);
 	JS_FreeCString(context, portal_id);