Use #[expect(…)] instead of #[allow(…)], remove unnecessary allows (#2784)

* Use expect instead of allow, remove unnecessary allows

* Remove more whitelist lint warnings

* tranisitioning more subprojects

* Re-add some necessary allows

* Re-add more required allows

* Some more windows clippy fixes

* Re-add more whitelist items for expect

* More clippy whitelist fun

* Reset changes to generated files

* Reset generated files to correct version

* Move libafl_concolic to expect instead of allow

* Move libafl_frida to expect from allow

* Move libafl_libfuzzer to expect from allow

* Remove more whitelist items for macOS

* Fix unknown clippy allow

* Remove more unnecessary allow statements

* moving fuzzers

* Remove mistakenly added subdirs

* fixing imports

* Remove more unnecessary whitelisted lints

* Fix test for /home/ubuntu/LibAFL/fuzzers/inprocess/libfuzzer_libpng_accounting

* More clippy improvements for libafl_qemu

* fmt

* Some pedantic options

* Fix more stuff

* Remove Little-CMS again

* Add note to static_mut_refs

* Reset the changed testing routine since it is unnecessary

fuzzers/baby/baby_fuzzer/src/main.rs

@@ -24,6 +24,8 @@ use libafl_bolts::{current_nanos, nonzero, rands::StdRand, tuples::tuple_list, A
 
 /// Coverage map with explicit assignments due to the lack of instrumentation
 static mut SIGNALS: [u8; 16] = [0; 16];
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
 static mut SIGNALS_PTR: *mut u8 = unsafe { SIGNALS.as_mut_ptr() };
 
 /// Assign a signal to the signals map
@@ -31,7 +33,7 @@ fn signals_set(idx: usize) {
     unsafe { write(SIGNALS_PTR.add(idx), 1) };
 }
 
-#[allow(clippy::similar_names, clippy::manual_assert)]
+#[expect(clippy::manual_assert)]
 pub fn main() {
     // The closure that we want to fuzz
     let mut harness = |input: &BytesInput| {
@@ -61,6 +63,8 @@ pub fn main() {
     };
 
     // Create an observation channel using the signals map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem in nightly
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS.len()) };
 
     // Feedback to rate the interestingness of an input

fuzzers/baby/baby_fuzzer_custom_executor/src/main.rs

@@ -26,7 +26,9 @@ use libafl_bolts::{current_nanos, nonzero, rands::StdRand, tuples::tuple_list, A
 /// Coverage map with explicit assignments due to the lack of instrumentation
 static mut SIGNALS: [u8; 16] = [0; 16];
 static mut SIGNALS_PTR: *mut u8 = &raw mut SIGNALS as _;
-static SIGNALS_LEN: usize = unsafe { (*&raw const (SIGNALS)).len() };
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
+static SIGNALS_LEN: usize = unsafe { SIGNALS.len() };
 
 /// Assign a signal to the signals map
 fn signals_set(idx: usize) {
@@ -81,7 +83,6 @@ where
     }
 }
 
-#[allow(clippy::similar_names, clippy::manual_assert)]
 pub fn main() {
     // Create an observation channel using the signals map
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS_LEN) };

fuzzers/baby/baby_fuzzer_minimizing/src/main.rs

@@ -7,6 +7,8 @@ use libafl_bolts::prelude::*;
 
 /// Coverage map with explicit assignments due to the lack of instrumentation
 static mut SIGNALS: [u8; 16] = [0; 16];
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
 static mut SIGNALS_PTR: *mut u8 = unsafe { SIGNALS.as_mut_ptr() };
 
 /// Assign a signal to the signals map
@@ -14,7 +16,6 @@ fn signals_set(idx: usize) {
     unsafe { write(SIGNALS_PTR.add(idx), 1) };
 }
 
-#[allow(clippy::similar_names)]
 pub fn main() -> Result<(), Error> {
     // The closure that we want to fuzz
     let mut harness = |input: &BytesInput| {
@@ -34,6 +35,8 @@ pub fn main() -> Result<(), Error> {
     };
 
     // Create an observation channel using the signals map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem in nightly
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS.len()) };
 
     let factory = MapEqualityFactory::new(&observer);

fuzzers/baby/baby_fuzzer_swap_differential/src/main.rs

@@ -61,8 +61,7 @@ mod slicemap {
 #[cfg(not(feature = "multimap"))]
 use slicemap::{HitcountsMapObserver, EDGES};
 
-#[allow(clippy::similar_names)]
+#[expect(clippy::too_many_lines)]
-#[allow(clippy::too_many_lines)]
 pub fn main() {
     // The closure that we want to fuzz
     let mut first_harness = |input: &BytesInput| {
@@ -144,6 +143,8 @@ pub fn main() {
             EDGES = core::slice::from_raw_parts_mut(alloc_zeroed(layout), num_edges * 2);
         }
 
+        // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+        #[allow(static_mut_refs)] // only a problem on nightly
         let edges_ptr = unsafe { EDGES.as_mut_ptr() };
 
         // create the base maps used to observe the different executors by splitting a slice

fuzzers/baby/baby_fuzzer_unicode/src/main.rs

@@ -25,14 +25,16 @@ use libafl_bolts::{rands::StdRand, tuples::tuple_list, AsSlice};
 /// Coverage map with explicit assignments due to the lack of instrumentation
 static mut SIGNALS: [u8; 64] = [0; 64];
 static mut SIGNALS_PTR: *mut u8 = (&raw mut SIGNALS).cast();
-static mut SIGNALS_LEN: usize = unsafe { (*&raw const SIGNALS).len() };
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
+static mut SIGNALS_LEN: usize = unsafe { SIGNALS.len() };
 
 /// Assign a signal to the signals map
 fn signals_set(idx: usize) {
     unsafe { write(SIGNALS_PTR.add(idx), 1) };
 }
 
-#[allow(clippy::similar_names, clippy::manual_assert)]
+#[expect(clippy::manual_assert)]
 pub fn main() {
     // The closure that we want to fuzz
     let mut harness = |input: &BytesInput| {

fuzzers/baby/backtrace_baby_fuzzers/c_code_with_fork_executor/src/main.rs

@@ -34,7 +34,6 @@ extern "C" {
 
 }
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     let mut shmem_provider = StdShMemProvider::new().unwrap();
     unsafe { create_shmem_array() };

fuzzers/baby/backtrace_baby_fuzzers/c_code_with_inprocess_executor/src/main.rs

@@ -26,7 +26,6 @@ extern "C" {
 
 }
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     let mut harness = |input: &BytesInput| {
         let target = input.target_bytes();

fuzzers/baby/backtrace_baby_fuzzers/command_executor/build.rs

@@ -2,9 +2,10 @@ use std::env;
 
 fn main() {
     let cwd = env::current_dir().unwrap().to_string_lossy().to_string();
-    let mut cmd = cc::Build::new().get_compiler().to_command();
+    let mut command = cc::Build::new().get_compiler().to_command();
-    cmd.args(["src/test_command.c", "-o"])
+    command
-        .arg(&format!("{}/test_command", &cwd))
+        .args(["src/test_command.c", "-o"])
+        .arg(format!("{}/test_command", &cwd))
         .arg("-fsanitize=address")
         .status()
         .unwrap();

fuzzers/baby/backtrace_baby_fuzzers/command_executor/src/main.rs

@@ -32,7 +32,6 @@ use libafl_bolts::{
     AsSlice, AsSliceMut,
 };
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     let mut shmem_provider = unix_shmem::UnixShMemProvider::new().unwrap();
     let mut signals = shmem_provider.new_shmem(3).unwrap();
@@ -81,6 +80,7 @@ pub fn main() {
     let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);
 
     // Create the executor for an in-process function with just one observer
+    #[expect(clippy::items_after_statements)]
     #[derive(Debug)]
     struct MyExecutor {
         shmem_id: ShMemId,
@@ -88,6 +88,8 @@ pub fn main() {
     }
 
     impl CommandConfigurator<BytesInput> for MyExecutor {
+        #[allow(unknown_lints)] // stable doesn't even know of the lint
+        #[allow(clippy::zombie_processes)] // only a problem on nightly
         fn spawn_child(&mut self, input: &BytesInput) -> Result<Child, Error> {
             let mut command = Command::new("./test_command");
 

fuzzers/baby/backtrace_baby_fuzzers/forkserver_executor/build.rs

@@ -40,7 +40,7 @@ fn main() {
 
     Command::new(afl_gcc_path)
         .args(["src/program.c", "-o"])
-        .arg(&format!("{}/target/release/program", &cwd))
+        .arg(format!("{}/target/release/program", &cwd))
         .arg("-fsanitize=address")
         .status()
         .unwrap();

fuzzers/baby/backtrace_baby_fuzzers/forkserver_executor/src/main.rs

@@ -28,7 +28,6 @@ use libafl_bolts::{
     AsSliceMut,
 };
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     const MAP_SIZE: usize = 65536;
 

fuzzers/baby/backtrace_baby_fuzzers/rust_code_with_fork_executor/src/main.rs

@@ -22,12 +22,11 @@ use libafl_bolts::{
     nonzero,
     ownedref::OwnedRefMut,
     rands::StdRand,
-    shmem::{unix_shmem, ShMem, ShMemProvider},
+    shmem::{unix_shmem, ShMemProvider},
     tuples::tuple_list,
     AsSlice, AsSliceMut,
 };
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     let mut shmem_provider = unix_shmem::UnixShMemProvider::new().unwrap();
     let mut signals = shmem_provider.new_shmem(16).unwrap();
@@ -66,6 +65,7 @@ pub fn main() {
     };
 
     // Create an observation channel using the signals map
+
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", signals_ptr, signals_len) };
     // Create a stacktrace observer
     let bt_observer = BacktraceObserver::new(

fuzzers/baby/backtrace_baby_fuzzers/rust_code_with_inprocess_executor/src/main.rs

@@ -22,6 +22,8 @@ use libafl_bolts::{nonzero, rands::StdRand, tuples::tuple_list, AsSlice};
 
 /// Coverage map with explicit assignments due to the lack of instrumentation
 static mut SIGNALS: [u8; 16] = [0; 16];
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
 static mut SIGNALS_PTR: *mut u8 = unsafe { SIGNALS.as_mut_ptr() };
 
 /// Assign a signal to the signals map
@@ -29,7 +31,6 @@ fn signals_set(idx: usize) {
     unsafe { write(SIGNALS_PTR.add(idx), 1) };
 }
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     // The closure that we want to fuzz
     let mut harness = |input: &BytesInput| {
@@ -59,6 +60,8 @@ pub fn main() {
     };
 
     // Create an observation channel using the signals map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem in nightly
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS.len()) };
     // Create a stacktrace observer to add the observers tuple
     let bt_observer = BacktraceObserver::owned(

fuzzers/baby/tutorial/src/input.rs

@@ -1,3 +1,4 @@
+#![expect(unexpected_cfgs)] // deriving NewFuzzed etc. introduces these
 use std::hash::Hash;
 
 use lain::prelude::*;

fuzzers/binary_only/frida_executable_libpng/src/fuzzer.rs

@@ -85,7 +85,7 @@ pub unsafe fn lib(main: extern "C" fn(i32, *const *const u8, *const *const u8) -
 }
 
 /// The actual fuzzer
-#[allow(clippy::too_many_lines, clippy::too_many_arguments)]
+#[expect(clippy::too_many_lines)]
 unsafe fn fuzz(
     options: &FuzzerOptions,
     mut frida_harness: &dyn Fn(&BytesInput) -> ExitKind,

fuzzers/binary_only/frida_executable_libpng/src/lib.rs

@@ -34,7 +34,6 @@ pub unsafe extern "C" fn main_hook(
 }
 
 #[no_mangle]
-#[allow(clippy::similar_names)]
 pub unsafe extern "C" fn __libc_start_main(
     main: extern "C" fn(i32, *const *const u8, *const *const u8) -> i32,
     argc: i32,

fuzzers/binary_only/frida_libpng/src/fuzzer.rs

@@ -66,7 +66,7 @@ pub fn main() {
 }
 
 /// The actual fuzzer
-#[allow(clippy::too_many_lines, clippy::too_many_arguments)]
+#[expect(clippy::too_many_lines)]
 unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
     log::info!("Frida fuzzer starting up.");
 

fuzzers/binary_only/frida_windows_gdiplus/src/fuzzer.rs

@@ -77,7 +77,7 @@ pub fn main() {
 }
 
 /// The actual fuzzer
-#[allow(clippy::too_many_lines, clippy::too_many_arguments)]
+#[expect(clippy::too_many_lines)]
 unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
     // 'While the stats are state, they are usually used in the broker - which is likely never restarted
     let monitor = MultiMonitor::new(|s| println!("{s}"));

fuzzers/binary_only/fuzzbench_fork_qemu/src/fuzzer.rs

@@ -243,7 +243,7 @@ fn fuzz(
     let cmplog = cmp_shmem.as_slice_mut();
 
     // Beginning of a page should be properly aligned.
-    #[allow(clippy::cast_ptr_alignment)]
+    #[expect(clippy::cast_ptr_alignment)]
     let cmplog_map_ptr = cmplog
         .as_mut_ptr()
         .cast::<libafl_qemu::modules::cmplog::CmpLogMap>();

fuzzers/binary_only/intel_pt_baby_fuzzer/src/main.rs

@@ -28,7 +28,8 @@ use proc_maps::get_process_maps;
 // Coverage map
 const MAP_SIZE: usize = 4096;
 static mut MAP: [u8; MAP_SIZE] = [0; MAP_SIZE];
-#[allow(static_mut_refs)]
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
 static mut MAP_PTR: *mut u8 = unsafe { MAP.as_mut_ptr() };
 
 pub fn main() {

fuzzers/binary_only/intel_pt_command_executor/src/main.rs

@@ -25,7 +25,8 @@ use libafl_intelpt::{IntelPT, PAGE_SIZE};
 // Coverage map
 const MAP_SIZE: usize = 4096;
 static mut MAP: [u8; MAP_SIZE] = [0; MAP_SIZE];
-#[allow(static_mut_refs)]
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
 static mut MAP_PTR: *mut u8 = unsafe { MAP.as_mut_ptr() };
 
 pub fn main() {

fuzzers/binary_only/qemu_cmin/src/fuzzer.rs

@@ -172,7 +172,6 @@ pub fn fuzz() -> Result<(), Error> {
 
     let mut feedback = MaxMapFeedback::new(&edges_observer);
 
-    #[allow(clippy::let_unit_value)]
     let mut objective = ();
 
     let mut state = state.unwrap_or_else(|| {

fuzzers/binary_only/qemu_coverage/src/fuzzer.rs

@@ -214,10 +214,8 @@ pub fn fuzz() {
             Err(Error::ShuttingDown)?
         }
 
-        #[allow(clippy::let_unit_value)]
         let mut feedback = ();
 
-        #[allow(clippy::let_unit_value)]
         let mut objective = ();
 
         let mut state = state.unwrap_or_else(|| {

fuzzers/binary_only/qemu_launcher/src/client.rs

@@ -27,7 +27,7 @@ use crate::{
     options::FuzzerOptions,
 };
 
-#[allow(clippy::module_name_repetitions)]
+#[expect(clippy::module_name_repetitions)]
 pub type ClientState =
     StdState<BytesInput, InMemoryOnDiskCorpus<BytesInput>, StdRand, OnDiskCorpus<BytesInput>>;
 
@@ -50,14 +50,14 @@ impl Client<'_> {
         Ok(args)
     }
 
-    #[allow(clippy::unused_self)] // Api should look the same as args above
+    #[expect(clippy::unused_self)] // Api should look the same as args above
     pub fn env(&self) -> Vec<(String, String)> {
         env::vars()
             .filter(|(k, _v)| k != "LD_LIBRARY_PATH")
             .collect::<Vec<(String, String)>>()
     }
 
-    #[allow(clippy::too_many_lines)]
+    #[expect(clippy::too_many_lines)]
     pub fn run<M: Monitor>(
         &self,
         state: Option<ClientState>,

fuzzers/binary_only/qemu_launcher/src/harness.rs

@@ -21,12 +21,12 @@ pub const MAX_INPUT_SIZE: usize = 1_048_576; // 1MB
 impl Harness {
     /// Change environment
     #[inline]
-    #[allow(clippy::ptr_arg)]
+    #[expect(clippy::ptr_arg)]
     pub fn edit_env(_env: &mut Vec<(String, String)>) {}
 
     /// Change arguments
     #[inline]
-    #[allow(clippy::ptr_arg)]
+    #[expect(clippy::ptr_arg)]
     pub fn edit_args(_args: &mut Vec<String>) {}
 
     /// Helper function to find the function we want to fuzz.
@@ -80,7 +80,7 @@ impl Harness {
 
     /// If we need to do extra work after forking, we can do that here.
     #[inline]
-    #[allow(clippy::unused_self)]
+    #[expect(clippy::unused_self)]
     pub fn post_fork(&self) {}
 
     pub fn run(&self, input: &BytesInput) -> ExitKind {

fuzzers/binary_only/qemu_launcher/src/instance.rs

@@ -73,7 +73,6 @@ pub struct Instance<'a, M: Monitor> {
 }
 
 impl<M: Monitor> Instance<'_, M> {
-    #[allow(clippy::similar_names)] // elf != self
     fn coverage_filter(&self, qemu: Qemu) -> Result<StdAddressFilter, Error> {
         /* Conversion is required on 32-bit targets, but not on 64-bit ones */
         if let Some(includes) = &self.options.include {
@@ -106,7 +105,7 @@ impl<M: Monitor> Instance<'_, M> {
         }
     }
 
-    #[allow(clippy::too_many_lines)]
+    #[expect(clippy::too_many_lines)]
     pub fn run<ET>(&mut self, modules: ET, state: Option<ClientState>) -> Result<(), Error>
     where
         ET: EmulatorModuleTuple<ClientState> + Debug,

fuzzers/binary_only/qemu_launcher/src/options.rs

@@ -11,7 +11,6 @@ use crate::version::Version;
 #[readonly::make]
 #[derive(Parser, Debug)]
 #[clap(author, version, about, long_about = None)]
-#[allow(clippy::module_name_repetitions)]
 #[command(
     name = format!("qemu_coverage-{}",env!("CPU_TARGET")),
     version = Version::default(),

fuzzers/forkserver/baby_fuzzer_with_forkexecutor/src/main.rs

@@ -25,10 +25,10 @@ use libafl_bolts::{
     AsSlice, AsSliceMut,
 };
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     let mut shmem_provider = unix_shmem::UnixShMemProvider::new().unwrap();
     let mut signals = shmem_provider.new_shmem(16).unwrap();
+
     let signals_len = signals.as_slice().len();
     let signals_ptr = signals.as_slice_mut().as_mut_ptr();
 
@@ -64,6 +64,7 @@ pub fn main() {
     };
 
     // Create an observation channel using the signals map
+
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", signals_ptr, signals_len) };
     // Create a stacktrace observer to add the observers tuple
 

fuzzers/forkserver/forkserver_libafl_cc/src/main.rs

@@ -83,7 +83,6 @@ struct Opt {
     signal: Signal,
 }
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     env_logger::init();
 

fuzzers/forkserver/forkserver_simple/src/main.rs

@@ -83,7 +83,6 @@ struct Opt {
     signal: Signal,
 }
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     env_logger::init();
     const MAP_SIZE: usize = 65536;

fuzzers/forkserver/fuzzbench_forkserver/src/main.rs

@@ -205,7 +205,7 @@ pub fn main() {
 }
 
 /// The actual fuzzer
-#[allow(clippy::too_many_arguments)]
+#[expect(clippy::too_many_arguments)]
 fn fuzz(
     corpus_dir: PathBuf,
     objective_dir: PathBuf,

fuzzers/forkserver/fuzzbench_forkserver_cmplog/src/main.rs

@@ -207,7 +207,7 @@ pub fn main() {
 }
 
 /// The actual fuzzer
-#[allow(clippy::too_many_arguments)]
+#[expect(clippy::too_many_arguments)]
 fn fuzz(
     corpus_dir: PathBuf,
     objective_dir: PathBuf,

fuzzers/forkserver/libafl-fuzz/src/corpus.rs

@@ -41,7 +41,7 @@ pub fn generate_base_filename(state: &mut LibaflFuzzState, id: CorpusId) -> Stri
 }
 
 // The function needs to be compatible with CustomFilepathToTestcaseFeedback
-#[allow(clippy::unnecessary_wraps)]
+#[expect(clippy::unnecessary_wraps)]
 pub fn set_corpus_filepath(
     state: &mut LibaflFuzzState,
     testcase: &mut Testcase<BytesInput>,
@@ -58,7 +58,7 @@ pub fn set_corpus_filepath(
 }
 
 // The function needs to be compatible with CustomFilepathToTestcaseFeedback
-#[allow(clippy::unnecessary_wraps)]
+#[expect(clippy::unnecessary_wraps)]
 pub fn set_solution_filepath(
     state: &mut LibaflFuzzState,
     testcase: &mut Testcase<BytesInput>,

fuzzers/forkserver/libafl-fuzz/src/executor.rs

@@ -201,7 +201,7 @@ pub fn find_afl_binary(filename: &str, same_dir_as: Option<PathBuf>) -> Result<P
         false
     };
 
-    #[allow(clippy::useless_conversion)] // u16 on MacOS, u32 on Linux
+    #[expect(clippy::useless_conversion)] // u16 on MacOS, u32 on Linux
     let permission = if is_library {
         u32::from(S_IRUSR) // user can read
     } else {

fuzzers/forkserver/libafl-fuzz/src/feedback/filepath.rs

@@ -59,7 +59,6 @@ where
     S: HasCorpus,
     F: FnMut(&mut S, &mut Testcase<<S::Corpus as Corpus>::Input>, &Path) -> Result<(), Error>,
 {
-    #[allow(clippy::wrong_self_convention)]
     #[inline]
     fn is_interesting(
         &mut self,

fuzzers/forkserver/libafl-fuzz/src/feedback/persistent_record.rs

@@ -56,7 +56,6 @@ where
     S::Corpus: Corpus<Input = I>,
     I: Input,
 {
-    #[allow(clippy::wrong_self_convention)]
     #[inline]
     fn is_interesting(
         &mut self,

fuzzers/forkserver/libafl-fuzz/src/feedback/seed.rs

@@ -13,7 +13,7 @@ use crate::Opt;
 /// A wrapper feedback used to determine actions for initial seeds.
 /// Handles `AFL_EXIT_ON_SEED_ISSUES`, `AFL_IGNORE_SEED_ISSUES` & default afl-fuzz behavior
 /// then, essentially becomes benign
-#[allow(clippy::module_name_repetitions, clippy::struct_excessive_bools)]
+#[expect(clippy::module_name_repetitions, clippy::struct_excessive_bools)]
 #[derive(Debug)]
 pub struct SeedFeedback<A, S> {
     /// Inner [`Feedback`]

fuzzers/forkserver/libafl-fuzz/src/main.rs

@@ -21,6 +21,7 @@
     clippy::similar_names,
     clippy::too_many_lines,
     clippy::into_iter_without_iter, // broken
+    clippy::multiple_crate_versions
 )]
 #![cfg_attr(not(test), warn(
     missing_debug_implementations,
@@ -105,7 +106,6 @@ const DEFER_SIG: &str = "##SIG_AFL_DEFER_FORKSRV##\0";
 const SHMEM_ENV_VAR: &str = "__AFL_SHM_ID";
 static AFL_HARNESS_FILE_INPUT: &str = "@@";
 
-#[allow(clippy::too_many_lines)]
 fn main() {
     env_logger::init();
     let mut opt = Opt::parse();
@@ -202,7 +202,7 @@ fn main() {
     };
 }
 
-#[allow(clippy::struct_excessive_bools)]
+#[expect(clippy::struct_excessive_bools)]
 #[derive(Debug, Parser, Clone)]
 #[command(
     name = "afl-fuzz",
@@ -358,7 +358,7 @@ struct Opt {
     non_instrumented_mode: bool,
 }
 
-#[allow(dead_code, clippy::struct_excessive_bools)]
+#[expect(dead_code, clippy::struct_excessive_bools)]
 #[derive(Debug, Clone)]
 pub struct CmplogOpts {
     file_size: CmplogFileSize,
@@ -387,7 +387,7 @@ impl From<&str> for CmplogFileSize {
     }
 }
 
-#[allow(clippy::unnecessary_wraps)] // we need to be compatible with Clap's value_parser
+#[expect(clippy::unnecessary_wraps)] // we need to be compatible with Clap's value_parser
 fn parse_cmplog_args(s: &str) -> Result<CmplogOpts, String> {
     Ok(CmplogOpts {
         file_size: s.into(),

fuzzers/forkserver/libafl-fuzz/src/stages/mutational_stage.rs

@@ -63,7 +63,6 @@ where
     P: Stage<E, EM, S, Z>,
 {
     #[inline]
-    #[allow(clippy::let_and_return)]
     fn perform(
         &mut self,
         fuzzer: &mut Z,

fuzzers/fuzz_anything/baby_fuzzer_wasm/src/lib.rs

@@ -1,3 +1,4 @@
+#![allow(unexpected_cfgs)] // the wasm_bindgen introduces these on nightly only
 mod utils;
 
 use libafl::{
@@ -25,7 +26,11 @@ use crate::utils::set_panic_hook;
 
 // Defined for internal use by LibAFL
 #[no_mangle]
-#[allow(clippy::cast_sign_loss, clippy::cast_possible_truncation)]
+#[expect(
+    clippy::cast_sign_loss,
+    clippy::cast_possible_truncation,
+    clippy::missing_panics_doc
+)]
 pub extern "C" fn external_current_millis() -> u64 {
     let window: Window = web_sys::window().expect("should be in browser to run this demo");
     let performance: Performance = window
@@ -34,7 +39,7 @@ pub extern "C" fn external_current_millis() -> u64 {
     performance.now() as u64
 }
 
-#[allow(clippy::missing_panics_doc)]
+#[allow(clippy::missing_panics_doc)] // expect does not work, likely because of `wasm_bindgen`
 #[wasm_bindgen]
 pub fn fuzz() {
     set_panic_hook();
@@ -64,7 +69,6 @@ pub fn fuzz() {
             signals_set(1);
             if buf.len() > 1 && buf[1] == b'b' {
                 signals_set(2);
-                #[allow(clippy::manual_assert)]
                 if buf.len() > 2 && buf[2] == b'c' {
                     // WASM cannot handle traps: https://webassembly.github.io/spec/core/intro/overview.html
                     // in a "real" fuzzing campaign, you should prefer to setup trap handling in JS,
@@ -77,6 +81,8 @@ pub fn fuzz() {
     };
 
     // Create an observation channel using the signals map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem in nightly
     let observer =
         unsafe { StdMapObserver::from_mut_ptr("signals", signals.as_mut_ptr(), signals.len()) };
 

fuzzers/fuzz_anything/baby_no_std/src/main.rs

@@ -64,7 +64,6 @@ pub extern "C" fn external_current_millis() -> u64 {
 /// The main of this program.
 /// # Panics
 /// Will panic once the fuzzer finds the correct conditions.
-#[allow(clippy::similar_names)]
 #[no_mangle]
 pub extern "C" fn main(_argc: isize, _argv: *const *const u8) -> isize {
     // The closure that we want to fuzz
@@ -76,7 +75,7 @@ pub extern "C" fn main(_argc: isize, _argv: *const *const u8) -> isize {
             signals_set(1);
             if buf.len() > 1 && buf[1] == b'b' {
                 signals_set(2);
-                #[allow(clippy::manual_assert)]
+                #[expect(clippy::manual_assert)]
                 if buf.len() > 2 && buf[2] == b'c' {
                     panic!("=)");
                 }

fuzzers/fuzz_anything/cargo_fuzz/src/lib.rs

@@ -1,4 +1,8 @@
-#[allow(clippy::collapsible_if)]
+#[expect(
+    clippy::collapsible_if,
+    clippy::manual_assert,
+    clippy::missing_panics_doc
+)]
 pub fn do_thing(data: &[u8]) {
     if data.first() == Some(&b'a') {
         if data.get(1) == Some(&b'b') {

fuzzers/fuzz_anything/libafl_atheris/src/lib.rs

@@ -47,7 +47,6 @@ use libafl_targets::{extra_counters, CmpLogObserver};
 /// The `harness_fn` parameter is the function that will be called by `LibAFL` for each iteration
 /// and jumps back into `Atheris'` instrumented python code.
 #[no_mangle]
-#[allow(non_snake_case)]
 pub extern "C" fn LLVMFuzzerRunDriver(
     _argc: *const c_int,
     _argv: *const *const c_char,

fuzzers/fuzz_anything/push_harness/src/main.rs

@@ -29,7 +29,6 @@ fn signals_set(idx: usize) {
 }
 
 /// This generates the input, using klo-routines.
-#[allow(clippy::similar_names)]
 fn input_generator() {
     // The closure that produced the input for the generator
     let mut harness = |input: &BytesInput| {
@@ -43,6 +42,7 @@ fn input_generator() {
     let signals_len = unsafe { *signals_ptr }.len();
 
     // Create an observation channel using the signals map
+
     let observer =
         unsafe { StdMapObserver::from_mut_ptr("signals", &raw mut SIGNALS as _, signals_len) };
 
@@ -111,7 +111,7 @@ fn input_generator() {
 
 /// the main function loops independently of the fuzzer.
 /// `Klo` internally switches between the `LibAFL` and harness coroutines to generate the inputs.
-#[allow(clippy::manual_assert)]
+#[expect(clippy::manual_assert)]
 pub fn main() {
     // Set up the Klo-routines harness
     let mut input_generator = input_generator;

fuzzers/fuzz_anything/push_stage_harness/src/main.rs

@@ -31,9 +31,11 @@ fn signals_set(idx: usize) {
     unsafe { SIGNALS[idx] = 1 };
 }
 
-#[allow(clippy::similar_names, clippy::manual_assert)]
+#[expect(clippy::manual_assert)]
 pub fn main() {
     // Create an observation channel using the signals map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem in nightly
     let observer =
         unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS.as_mut_ptr(), SIGNALS.len()) };
 

fuzzers/inprocess/dynamic_analysis/build.rs

@@ -7,7 +7,7 @@ fn main() {
         println!("cargo:warning=Downloading Little-CMS");
         // Clone the Little-CMS repository if the directory doesn't exist
         let status = Command::new("git")
-            .args(&[
+            .args([
                 "clone",
                 "https://github.com/mm2/Little-CMS",
                 lcms_dir.to_str().unwrap(),
@@ -15,9 +15,7 @@ fn main() {
             .status()
             .expect("Failed to clone Little-CMS repository");
 
-        if !status.success() {
+        assert!(status.success(), "Failed to clone Little-CMS repository");
-            panic!("Failed to clone Little-CMS repository");
-        }
     }
 
     // Tell Cargo that if the given file changes, to rerun this build script

fuzzers/inprocess/dynamic_analysis/src/lib.rs

@@ -198,7 +198,7 @@ fn run_testcases(filenames: &[&str]) {
 }
 
 /// The actual fuzzer
-#[allow(clippy::too_many_lines)]
+#[expect(clippy::too_many_lines)]
 fn fuzz(
     corpus_dir: PathBuf,
     objective_dir: PathBuf,
@@ -252,8 +252,9 @@ fn fuzz(
     // Create an observation channel to keep track of the execution time
     let time_observer = TimeObserver::new("time");
 
-    let func_list =
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
-        unsafe { OwnedMutPtr::from_raw_mut(Lazy::force_mut(&mut *&raw mut FUNCTION_LIST)) };
+    #[allow(static_mut_refs)] // only a problem in nightly
+    let func_list = unsafe { OwnedMutPtr::from_raw_mut(Lazy::force_mut(&mut FUNCTION_LIST)) };
     let profiling_observer = ProfilingObserver::new("concatenated.json", func_list)?;
     let callhook = CallHook::new();
 

fuzzers/inprocess/fuzzbench/src/lib.rs

@@ -196,7 +196,7 @@ fn run_testcases(filenames: &[&str]) {
 }
 
 /// The actual fuzzer
-#[allow(clippy::too_many_lines)]
+#[expect(clippy::too_many_lines)]
 fn fuzz(
     corpus_dir: PathBuf,
     objective_dir: PathBuf,

fuzzers/inprocess/fuzzbench_ctx/src/lib.rs

@@ -201,7 +201,7 @@ fn run_testcases(filenames: &[&str]) {
 }
 
 /// The actual fuzzer
-#[allow(clippy::too_many_lines)]
+#[expect(clippy::too_many_lines)]
 fn fuzz(
     corpus_dir: PathBuf,
     objective_dir: PathBuf,

fuzzers/inprocess/fuzzbench_text/src/lib.rs

@@ -63,7 +63,7 @@ use nix::unistd::dup;
 
 /// The fuzzer main (as `no_mangle` C function)
 #[no_mangle]
-#[allow(clippy::too_many_lines)]
+#[expect(clippy::too_many_lines)]
 pub extern "C" fn libafl_main() {
     // Registry the metadata types used in this fuzzer
     // Needed only on no_std
@@ -258,7 +258,7 @@ fn run_testcases(filenames: &[&str]) {
 }
 
 /// The actual fuzzer
-#[allow(clippy::too_many_lines)]
+#[expect(clippy::too_many_lines)]
 fn fuzz_binary(
     corpus_dir: PathBuf,
     objective_dir: PathBuf,
@@ -469,7 +469,7 @@ fn fuzz_binary(
 }
 
 /// The actual fuzzer based on `Grimoire`
-#[allow(clippy::too_many_lines)]
+#[expect(clippy::too_many_lines)]
 fn fuzz_text(
     corpus_dir: PathBuf,
     objective_dir: PathBuf,

fuzzers/inprocess/libfuzzer_libmozjpeg/src/lib.rs

@@ -81,10 +81,14 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
     let edges_observer = unsafe { std_edges_map_observer("edges") };
 
     // Create an observation channel using the cmp map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem on nightly
     let cmps_observer =
         unsafe { StdMapObserver::from_mut_ptr("cmps", CMP_MAP.as_mut_ptr(), CMP_MAP.len()) };
 
     // Create an observation channel using the allocations map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem on nightly
     let allocs_observer = unsafe {
         StdMapObserver::from_mut_ptr(
             "allocs",

fuzzers/inprocess/libfuzzer_libpng/src/lib.rs

@@ -79,6 +79,8 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
         };
 
     // Create an observation channel using the coverage map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem on nightly
     let edges_observer = unsafe {
         HitcountsMapObserver::new(StdMapObserver::from_mut_ptr(
             "edges",

fuzzers/inprocess/libfuzzer_libpng_accounting/Cargo.toml

@@ -25,6 +25,7 @@ which = "6.0.3"
 libafl = { path = "../../../libafl", features = [
   "std",
   "derive",
+  "tcp_manager",
   "llmp_compression",
   "introspection",
 ] }

fuzzers/inprocess/libfuzzer_libpng_accounting/src/lib.rs

@@ -139,6 +139,8 @@ pub extern "C" fn libafl_main() {
 
     let mut run_client = |state: Option<_>, mut restarting_mgr, _client_description| {
         // Create an observation channel using the coverage map
+        // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+        #[allow(static_mut_refs)] // only a problem on nightly
         let edges_observer = HitcountsMapObserver::new(unsafe {
             StdMapObserver::from_mut_ptr("edges", EDGES_MAP.as_mut_ptr(), MAX_EDGES_FOUND)
         })

fuzzers/inprocess/libfuzzer_libpng_centralized/src/lib.rs

@@ -262,7 +262,7 @@ pub extern "C" fn libafl_main() {
             Ok(())
         };
 
-    let mut main_run_client = secondary_run_client.clone(); // clone it just for borrow checker
+    let mut main_run_client = secondary_run_client; // clone it just for borrow checker
 
     match CentralizedLauncher::builder()
         .shmem_provider(shmem_provider)

fuzzers/inprocess/libfuzzer_libpng_tcp_manager/src/lib.rs

@@ -77,6 +77,8 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
         };
 
     // Create an observation channel using the coverage map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem on nightly
     let edges_observer = unsafe {
         HitcountsMapObserver::new(StdMapObserver::from_mut_ptr(
             "edges",

fuzzers/structure_aware/baby_fuzzer_custom_input/src/main.rs

@@ -53,7 +53,7 @@ fn signals_set(idx: usize) {
     unsafe { write(SIGNALS_PTR.add(idx), 1) };
 }
 
-#[allow(clippy::similar_names, clippy::manual_assert)]
+#[expect(clippy::manual_assert)]
 pub fn main() {
     // The closure that we want to fuzz
     // The pseudo program under test uses all parts of the custom input
@@ -87,6 +87,7 @@ pub fn main() {
     };
 
     // Create an observation channel using the signals map
+
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS_LEN) };
 
     // Feedback to rate the interestingness of an input

fuzzers/structure_aware/baby_fuzzer_gramatron/src/main.rs

@@ -45,7 +45,6 @@ fn read_automaton_from_file<P: AsRef<Path>>(path: P) -> Automaton {
     postcard::from_bytes(&buffer).unwrap()
 }
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     let mut bytes = vec![];
 
@@ -59,6 +58,7 @@ pub fn main() {
     };
 
     // Create an observation channel using the signals map
+
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS_LEN) };
 
     // Feedback to rate the interestingness of an input

fuzzers/structure_aware/baby_fuzzer_grimoire/src/main.rs

@@ -25,6 +25,8 @@ use libafl_bolts::{rands::StdRand, tuples::tuple_list, AsSlice};
 
 /// Coverage map with explicit assignments due to the lack of instrumentation
 static mut SIGNALS: [u8; 16] = [0; 16];
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
 static mut SIGNALS_PTR: *mut u8 = unsafe { SIGNALS.as_mut_ptr() };
 /// Assign a signal to the signals map
 fn signals_set(idx: usize) {
@@ -44,7 +46,6 @@ fn is_sub<T: PartialEq>(mut haystack: &[T], needle: &[T]) -> bool {
     false
 }
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     let mut initial_inputs = vec![];
     for entry in fs::read_dir("./corpus").unwrap() {
@@ -83,6 +84,8 @@ pub fn main() {
     };
 
     // Create an observation channel using the signals map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem in nightly
     let observer = unsafe {
         StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS.len()).track_novelties()
     };

fuzzers/structure_aware/baby_fuzzer_multi/src/main.rs

@@ -40,7 +40,7 @@ fn count_set(count: usize) {
     unsafe { LAST_COUNT[0] = count };
 }
 
-#[allow(clippy::similar_names, clippy::manual_assert)]
+#[expect(clippy::manual_assert)]
 pub fn main() {
     // The closure that we want to fuzz
     let mut harness = |input: &MultipartInput<BytesInput>| {

fuzzers/structure_aware/baby_fuzzer_nautilus/src/main.rs

@@ -25,6 +25,8 @@ use libafl_bolts::{rands::StdRand, tuples::tuple_list};
 
 /// Coverage map with explicit assignments due to the lack of instrumentation
 static mut SIGNALS: [u8; 16] = [0; 16];
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
 static mut SIGNALS_PTR: *mut u8 = unsafe { SIGNALS.as_mut_ptr() };
 /*
 /// Assign a signal to the signals map
@@ -33,7 +35,6 @@ fn signals_set(idx: usize) {
 }
 */
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     let context = NautilusContext::from_file(15, "grammar.json").unwrap();
     let mut bytes = vec![];
@@ -48,6 +49,8 @@ pub fn main() {
     };
 
     // Create an observation channel using the signals map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem in nightly
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS.len()) };
 
     // Feedback to rate the interestingness of an input

fuzzers/structure_aware/baby_fuzzer_tokens/src/main.rs

@@ -20,6 +20,8 @@ use libafl_bolts::{rands::StdRand, tuples::tuple_list};
 
 /// Coverage map with explicit assignments due to the lack of instrumentation
 static mut SIGNALS: [u8; 16] = [0; 16];
+// TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+#[allow(static_mut_refs)] // only a problem in nightly
 static mut SIGNALS_PTR: *mut u8 = unsafe { SIGNALS.as_mut_ptr() };
 
 /*
@@ -29,7 +31,6 @@ fn signals_set(idx: usize) {
 }
 */
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     let mut tokenizer = NaiveTokenizer::default();
     let mut encoder_decoder = TokenInputEncoderDecoder::new();
@@ -67,6 +68,8 @@ pub fn main() {
     };
 
     // Create an observation channel using the signals map
+    // TODO: This will break soon, fix me! See https://github.com/AFLplusplus/LibAFL/issues/2786
+    #[allow(static_mut_refs)] // only a problem in nightly
     let observer = unsafe { StdMapObserver::from_mut_ptr("signals", SIGNALS_PTR, SIGNALS.len()) };
 
     // Feedback to rate the interestingness of an input

fuzzers/structure_aware/forkserver_simple_nautilus/src/main.rs

@@ -85,7 +85,6 @@ struct Opt {
     grammar: PathBuf,
 }
 
-#[allow(clippy::similar_names)]
 pub fn main() {
     env_logger::init();
     const MAP_SIZE: usize = 65536;

fuzzers/structure_aware/nautilus_sync/src/bin/libafl_cc.rs

@@ -2,7 +2,6 @@ use std::env;
 
 use libafl_cc::{ClangWrapper, CompilerWrapper, ToolWrapper};
 
-#[allow(clippy::missing_panics_doc)]
 pub fn main() {
     let args: Vec<String> = env::args().collect();
     if args.len() > 1 {

fuzzers/structure_aware/nautilus_sync/src/lib.rs

@@ -98,7 +98,7 @@ struct Opt {
 
 /// The main fn, `no_mangle` as it is a C symbol
 #[no_mangle]
-#[allow(clippy::missing_panics_doc, clippy::too_many_lines)]
+#[expect(clippy::missing_panics_doc, clippy::too_many_lines)]
 pub extern "C" fn libafl_main() {
     // Registry the metadata types used in this fuzzer
     // Needed only on no_std

libafl/src/common/mod.rs

@@ -1,7 +1,5 @@
 //! This module defines trait shared across different `LibAFL` modules
 
-#![allow(unused, missing_docs)]
-
 use alloc::boxed::Box;
 use core::any::type_name;
 

libafl/src/common/nautilus/grammartec/context.rs

@@ -1,5 +1,4 @@
 use alloc::{borrow::ToOwned, string::String, vec::Vec};
-use core::num::NonZero;
 
 use hashbrown::HashMap;
 use libafl_bolts::{

libafl/src/common/nautilus/grammartec/mutator.rs

@@ -27,7 +27,7 @@ impl Mutator {
     }
 
     //Return value indicates if minimization is complete: true: complete, false: not complete
-    #[allow(clippy::too_many_arguments)]
+    #[expect(clippy::too_many_arguments)]
     pub fn minimize_tree<F, R: Rand>(
         &mut self,
         rand: &mut R,
@@ -353,7 +353,7 @@ mod tests {
             .iter()
             .map(|x| RuleIdOrCustom::Rule(*x))
             .collect::<Vec<_>>();
-        let mut tree = Tree::from_rule_vec(rules, &ctx);
+        let tree = Tree::from_rule_vec(rules, &ctx);
 
         println!("tree: {tree:?}");
         let mut mutator = Mutator::new(&ctx);
@@ -529,7 +529,6 @@ mod tests {
 
     #[test]
     fn deterministic_splice() {
-        let mut rand = StdRand::new();
         let mut ctx = Context::new();
         let mut rand = StdRand::new();
         let mut cks = ChunkStore::new("/tmp/".to_string());

libafl/src/common/nautilus/grammartec/newtypes.rs

@@ -64,6 +64,7 @@ impl Add<usize> for NodeId {
 }
 
 impl NodeId {
+    #[expect(dead_code)]
     fn steps_between(start: Self, end: Self) -> Option<usize> {
         let start_i = start.to_i();
         let end_i = end.to_i();
@@ -72,12 +73,18 @@ impl NodeId {
         }
         Some(end_i - start_i)
     }
+
+    #[expect(dead_code)]
     fn add_one(self) -> Self {
         self.add(1)
     }
+
+    #[expect(dead_code)]
     fn sub_one(self) -> Self {
         NodeId(self.0 - 1)
     }
+
+    #[expect(dead_code)]
     fn add_usize(self, n: usize) -> Option<Self> {
         self.0.checked_add(n).map(NodeId::from)
     }

libafl/src/common/nautilus/grammartec/python_grammar_loader.rs

@@ -2,7 +2,7 @@ use std::{string::String, vec::Vec};
 
 use pyo3::{prelude::*, pyclass, types::IntoPyDict};
 
-use crate::{nautilus::grammartec::context::Context, Error};
+use crate::nautilus::grammartec::context::Context;
 
 #[pyclass]
 struct PyContext {
@@ -23,7 +23,7 @@ impl PyContext {
         }
     }
 
-    fn rule(&mut self, py: Python, nt: &str, format: &Bound<PyAny>) -> PyResult<()> {
+    fn rule(&mut self, _py: Python, nt: &str, format: &Bound<PyAny>) -> PyResult<()> {
         if let Ok(s) = format.extract::<&str>() {
             self.ctx.add_rule(nt, s.as_bytes());
         } else if let Ok(s) = format.extract::<&[u8]>() {
@@ -36,7 +36,7 @@ impl PyContext {
         Ok(())
     }
 
-    #[allow(clippy::needless_pass_by_value)]
+    #[expect(clippy::needless_pass_by_value)]
     fn script(&mut self, nt: &str, nts: Vec<String>, script: PyObject) {
         self.ctx.add_script(nt, &nts, script);
     }

libafl/src/common/nautilus/grammartec/recursion_info.rs

@@ -53,7 +53,7 @@ impl RecursionInfo {
     // different recursions. Therefore we use the weight of the node to sample the endpoint of a path trough the
     // recursion tree. Then we just sample the length of this path uniformly as `(1.. weight)`. This
     // yields a uniform sample from the whole set of recursions inside the tree. If you read this, Good luck you are on your own.
-    #[allow(clippy::type_complexity)]
+    #[expect(clippy::type_complexity)]
     fn find_parents(
         t: &Tree,
         nt: NTermId,
@@ -82,7 +82,7 @@ impl RecursionInfo {
         res
     }
 
-    #[allow(clippy::cast_precision_loss)]
+    #[expect(clippy::cast_precision_loss)]
     fn build_sampler(depths: &[usize]) -> Result<LoadedDiceSampler, Error> {
         let mut weights = depths.iter().map(|x| *x as f64).collect::<Vec<_>>();
         let norm: f64 = weights.iter().sum();

libafl/src/common/nautilus/grammartec/rule.rs

@@ -1,5 +1,4 @@
 use alloc::{string::String, vec::Vec};
-use core::cell::OnceCell;
 use std::sync::OnceLock;
 
 use libafl_bolts::rands::Rand;

libafl/src/common/nautilus/grammartec/tree.rs

@@ -6,7 +6,7 @@ use libafl_bolts::rands::Rand;
 use pyo3::{
     prelude::{PyObject, PyResult, Python},
     types::{PyAnyMethods, PyBytes, PyBytesMethods, PyString, PyStringMethods, PyTuple},
-    FromPyObject, PyTypeInfo,
+    PyTypeInfo,
 };
 use serde::{Deserialize, Serialize};
 
@@ -211,9 +211,11 @@ impl TreeLike for Tree {
     fn get_rule<'c>(&self, n: NodeId, ctx: &'c Context) -> &'c Rule {
         ctx.get_rule(self.get_rule_id(n))
     }
+
     fn get_custom_rule_data(&self, n: NodeId) -> &[u8] {
         self.rules[n.to_i()].data()
     }
+
     fn get_rule_or_custom(&self, n: NodeId) -> &RuleIdOrCustom {
         &self.rules[n.to_i()]
     }
@@ -240,6 +242,7 @@ impl Tree {
         self.rules[n.to_i()].id()
     }
 
+    #[expect(dead_code)]
     fn get_rule_or_custom(&self, n: NodeId) -> &RuleIdOrCustom {
         &self.rules[n.to_i()]
     }
@@ -384,6 +387,7 @@ impl Tree {
         }
     }
 
+    #[expect(dead_code)]
     fn find_recursions_iter(&self, ctx: &Context) -> Vec<(NodeId, NodeId)> {
         let mut found_recursions = Vec::new();
         //Only search for iterations for up to 10000 nodes
@@ -442,6 +446,7 @@ impl TreeLike for TreeMutation<'_> {
     fn size(&self) -> usize {
         self.prefix.len() + self.repl.len() + self.postfix.len()
     }
+
     fn get_rule_or_custom(&self, n: NodeId) -> &RuleIdOrCustom {
         self.get_at(n)
     }

libafl/src/common/nautilus/mod.rs

@@ -2,5 +2,7 @@
 //!
 #![doc = include_str!("README.md")]
 
+#[allow(missing_docs)]
 pub mod grammartec;
+#[allow(missing_docs)]
 pub mod regex_mutator;

libafl/src/common/nautilus/regex_mutator/mod.rs

@@ -53,7 +53,6 @@ fn append_unicode_range<R: Rand>(
     cls: ClassUnicodeRange,
 ) {
     let mut chr_a_buf = [0; 4];
-    #[allow(clippy::similar_names)]
     let mut chr_b_buf = [0; 4];
     cls.start().encode_utf8(&mut chr_a_buf);
     cls.end().encode_utf8(&mut chr_b_buf);

libafl/src/corpus/inmemory_ondisk.rs

@@ -470,11 +470,14 @@ impl<I> InMemoryOnDiskCorpus<I> {
 
 #[cfg(test)]
 mod tests {
+    #[cfg(not(miri))]
     use std::{env, fs, io::Write};
 
+    #[cfg(not(miri))]
     use super::{create_new, try_create_new};
 
     #[test]
+    #[cfg(not(miri))]
     fn test() {
         let tmp = env::temp_dir();
         let path = tmp.join("testfile.tmp");

libafl/src/corpus/minimizer.rs

@@ -64,7 +64,7 @@ where
     TS: TestcaseScore<E::State>,
 {
     /// Do the minimization
-    #[allow(clippy::too_many_lines)]
+    #[expect(clippy::too_many_lines)]
     pub fn minimize<CS, EM, Z>(
         &self,
         fuzzer: &mut Z,

libafl/src/corpus/testcase.rs

@@ -358,7 +358,6 @@ where
     }
 
     /// Get the `len` or calculate it, if not yet calculated.
-    #[allow(clippy::len_without_is_empty)]
     pub fn load_len<C: Corpus<Input = I>>(&mut self, corpus: &C) -> Result<usize, Error> {
         match &self.input {
             Some(i) => {
@@ -389,7 +388,7 @@ impl<I> From<I> for Testcase<I> {
 #[derive(Serialize, Deserialize, Clone, Debug)]
 #[cfg_attr(
     any(not(feature = "serdeany_autoreg"), miri),
-    allow(clippy::unsafe_derive_deserialize)
+    expect(clippy::unsafe_derive_deserialize)
 )] // for SerdeAny
 pub struct SchedulerTestcaseMetadata {
     /// Number of bits set in bitmap, updated in `calibrate_case`

libafl/src/events/broker_hooks/centralized.rs

@@ -89,7 +89,7 @@ where
     }
 
     /// Handle arriving events in the broker
-    #[allow(clippy::unnecessary_wraps)]
+    #[expect(clippy::unnecessary_wraps)]
     fn handle_in_broker(
         _client_id: ClientId,
         event: &Event<I>,

libafl/src/events/broker_hooks/mod.rs

@@ -104,7 +104,7 @@ where
     }
 
     /// Handle arriving events in the broker
-    #[allow(clippy::unnecessary_wraps)]
+    #[expect(clippy::unnecessary_wraps)]
     fn handle_in_broker(
         monitor: &mut MT,
         client_id: ClientId,

libafl/src/events/centralized.rs

@@ -27,8 +27,6 @@ use serde::{Deserialize, Serialize};
 use super::NopEventManager;
 #[cfg(feature = "llmp_compression")]
 use crate::events::llmp::COMPRESS_THRESHOLD;
-#[cfg(feature = "scalability_introspection")]
-use crate::state::HasScalabilityMonitor;
 use crate::{
     corpus::Corpus,
     events::{
@@ -278,7 +276,7 @@ where
         self.inner.should_send()
     }
 
-    #[allow(clippy::match_same_arms)]
+    #[expect(clippy::match_same_arms)]
     fn fire(
         &mut self,
         state: &mut Self::State,

libafl/src/events/launcher.rs

@@ -380,7 +380,7 @@ where
 
     /// Launch the broker and the clients and fuzz
     #[cfg(any(windows, not(feature = "fork")))]
-    #[allow(clippy::too_many_lines, clippy::match_wild_err_arm)]
+    #[expect(clippy::too_many_lines, clippy::match_wild_err_arm)]
     pub fn launch_with_hooks<EMH, S>(&mut self, hooks: EMH) -> Result<(), Error>
     where
         S: State + HasExecutions,
@@ -453,7 +453,7 @@ where
                         for overcommit_i in 0..self.overcommit {
                             index += 1;
                             // Forward own stdio to child processes, if requested by user
-                            #[allow(unused_mut)]
+                            #[allow(unused_mut)] // mut only on certain cfgs
                             let (mut stdout, mut stderr) = (Stdio::null(), Stdio::null());
                             #[cfg(unix)]
                             {

libafl/src/events/llmp/mgr.rs

@@ -365,7 +365,7 @@ where
         let msg = TcpRequest::ClientQuit { client_id };
         // Send this mesasge off and we are leaving.
         match send_tcp_msg(&mut stream, &msg) {
-            Ok(_) => (),
+            Ok(()) => (),
             Err(e) => log::error!("Failed to send tcp message {:#?}", e),
         }
         log::debug!("Asking he broker to be disconnected");
@@ -393,7 +393,6 @@ where
     SP: ShMemProvider,
 {
     // Handle arriving events in the client
-    #[allow(clippy::unused_self)]
     fn handle_in_client<E, Z>(
         &mut self,
         fuzzer: &mut Z,

libafl/src/events/llmp/mod.rs

@@ -341,7 +341,6 @@ where
     }
 
     /// Handle arriving events in the client
-    #[allow(clippy::unused_self)]
     pub fn process<E, EM, Z>(
         &mut self,
         fuzzer: &mut Z,

libafl/src/events/llmp/restarting.rs

@@ -333,7 +333,7 @@ pub enum ManagerKind {
 ///
 /// The restarting mgr is a combination of restarter and runner, that can be used on systems with and without `fork` support.
 /// The restarter will spawn a new process each time the child crashes or timeouts.
-#[allow(clippy::type_complexity)]
+#[expect(clippy::type_complexity)]
 pub fn setup_restarting_mgr_std<MT, S>(
     monitor: MT,
     broker_port: u16,
@@ -364,7 +364,7 @@ where
 /// The restarting mgr is a combination of restarter and runner, that can be used on systems with and without `fork` support.
 /// The restarter will spawn a new process each time the child crashes or timeouts.
 /// This one, additionally uses the timeobserver for the adaptive serialization
-#[allow(clippy::type_complexity)]
+#[expect(clippy::type_complexity)]
 pub fn setup_restarting_mgr_std_adaptive<MT, S>(
     monitor: MT,
     broker_port: u16,
@@ -397,7 +397,6 @@ where
 /// The [`RestartingMgr`] is is a combination of a
 /// `restarter` and `runner`, that can be used on systems both with and without `fork` support. The
 /// `restarter` will start a new process each time the child crashes or times out.
-#[allow(clippy::default_trait_access, clippy::ignored_unit_patterns)]
 #[derive(TypedBuilder, Debug)]
 pub struct RestartingMgr<EMH, MT, S, SP> {
     /// The shared memory provider to use for the broker or client spawned by the restarting
@@ -439,7 +438,7 @@ pub struct RestartingMgr<EMH, MT, S, SP> {
     phantom_data: PhantomData<(EMH, S)>,
 }
 
-#[allow(clippy::type_complexity, clippy::too_many_lines)]
+#[expect(clippy::type_complexity, clippy::too_many_lines)]
 impl<EMH, MT, S, SP> RestartingMgr<EMH, MT, S, SP>
 where
     EMH: EventManagerHooksTuple<S> + Copy + Clone,
@@ -612,15 +611,12 @@ where
                     return Err(Error::shutting_down());
                 }
 
-                #[allow(clippy::manual_assert)]
                 if !staterestorer.has_content() && !self.serialize_state.oom_safe() {
                     if let Err(err) = mgr.detach_from_broker(self.broker_port) {
                         log::error!("Failed to detach from broker: {err}");
                     }
                     #[cfg(unix)]
-                    if child_status == 9 {
+                    assert_ne!(9, child_status, "Target received SIGKILL!. This could indicate the target crashed due to OOM, user sent SIGKILL, or the target was in an unrecoverable situation and could not save state to restart");
-                        panic!("Target received SIGKILL!. This could indicate the target crashed due to OOM, user sent SIGKILL, or the target was in an unrecoverable situation and could not save state to restart");
-                    }
                     // Storing state in the last round did not work
                     panic!("Fuzzer-respawner: Storing state in crashed fuzzer instance did not work, no point to spawn the next client! This can happen if the child calls `exit()`, in that case make sure it uses `abort()`, if it got killed unrecoverable (OOM), or if there is a bug in the fuzzer itself. (Child exited with: {child_status})");
                 }

libafl/src/events/mod.rs

@@ -11,13 +11,11 @@ pub mod centralized;
 #[cfg(all(unix, feature = "std"))]
 pub use centralized::*;
 #[cfg(feature = "std")]
-#[allow(clippy::ignored_unit_patterns)]
 pub mod launcher;
-#[allow(clippy::ignored_unit_patterns)]
+
 pub mod llmp;
 pub use llmp::*;
 #[cfg(feature = "tcp_manager")]
-#[allow(clippy::ignored_unit_patterns)]
 pub mod tcp;
 
 pub mod broker_hooks;

libafl/src/events/multi_machine.rs

@@ -122,7 +122,6 @@ impl NodeId {
 
 /// The state of the hook shared between the background threads and the main thread.
 #[derive(Debug)]
-#[allow(dead_code)]
 pub struct TcpMultiMachineState<A> {
     node_descriptor: NodeDescriptor<A>,
     /// the parent to which the testcases should be forwarded when deemed interesting
@@ -364,7 +363,7 @@ where
     /// Read a [`TcpMultiMachineMsg`] from a stream.
     /// Expects a message written by [`TcpMultiMachineState::write_msg`].
     /// If there is nothing to read from the stream, return asap with Ok(None).
-    #[allow(clippy::uninit_vec)]
+    #[expect(clippy::uninit_vec)]
     async fn read_msg<'a, I: Input + 'a>(
         stream: &mut TcpStream,
     ) -> Result<Option<MultiMachineMsg<'a, I>>, Error> {

libafl/src/events/simple.rs

@@ -200,7 +200,7 @@ where
     }
 
     /// Handle arriving events in the broker
-    #[allow(clippy::unnecessary_wraps)]
+    #[expect(clippy::unnecessary_wraps)]
     fn handle_in_broker(
         monitor: &mut MT,
         event: &Event<S::Input>,
@@ -273,7 +273,6 @@ where
     }
 
     // Handle arriving events in the client
-    #[allow(clippy::needless_pass_by_value, clippy::unused_self)]
     fn handle_in_client(&mut self, state: &mut S, event: Event<S::Input>) -> Result<(), Error> {
         match event {
             Event::CustomBuf { buf, tag } => {
@@ -299,7 +298,6 @@ where
 /// `restarter` and `runner`, that can be used on systems both with and without `fork` support. The
 /// `restarter` will start a new process each time the child crashes or times out.
 #[cfg(feature = "std")]
-#[allow(clippy::default_trait_access)]
 #[derive(Debug)]
 pub struct SimpleRestartingEventManager<MT, S, SP>
 where
@@ -433,7 +431,6 @@ where
 }
 
 #[cfg(feature = "std")]
-#[allow(clippy::type_complexity, clippy::too_many_lines)]
 impl<MT, S, SP> SimpleRestartingEventManager<MT, S, SP>
 where
     S: UsesInput + Stoppable,
@@ -451,7 +448,6 @@ where
     /// Launch the simple restarting manager.
     /// This [`EventManager`] is simple and single threaded,
     /// but can still used shared maps to recover from crashes and timeouts.
-    #[allow(clippy::similar_names)]
     pub fn launch(mut monitor: MT, shmem_provider: &mut SP) -> Result<(Option<S>, Self), Error>
     where
         S: DeserializeOwned + Serialize + HasCorpus + HasSolutions,
@@ -519,7 +515,7 @@ where
                     return Err(Error::shutting_down());
                 }
 
-                #[allow(clippy::manual_assert)]
+                #[expect(clippy::manual_assert)]
                 if !staterestorer.has_content() {
                     #[cfg(unix)]
                     if child_status == 9 {

libafl/src/events/tcp.rs

@@ -112,9 +112,9 @@ where
     }
 
     /// Run in the broker until all clients exit
-    // TODO: remove allow(clippy::needless_return) when clippy is fixed
+    // TODO: remove expect(clippy::needless_return) when clippy is fixed
     #[tokio::main(flavor = "current_thread")]
-    #[allow(clippy::too_many_lines, clippy::needless_return)]
+    #[expect(clippy::too_many_lines)]
     pub async fn broker_loop(&mut self) -> Result<(), Error> {
         let (tx_bc, rx) = broadcast::channel(65536);
         let (tx, mut rx_mpsc) = mpsc::channel(65536);
@@ -289,10 +289,9 @@ where
             let event_bytes = &buf[4..];
 
             #[cfg(feature = "tcp_compression")]
-            let event_bytes = GzipCompressor::new().decompress(event_bytes)?;
+            let event_bytes = &GzipCompressor::new().decompress(event_bytes)?;
 
-            #[allow(clippy::needless_borrow)] // make decompressed vec and slice compatible
+            let event: Event<I> = postcard::from_bytes(event_bytes)?;
-            let event: Event<I> = postcard::from_bytes(&event_bytes)?;
             match Self::handle_in_broker(&mut self.monitor, client_id, &event)? {
                 BrokerEventResult::Forward => {
                     tx_bc.send(buf).expect("Could not send");
@@ -311,7 +310,7 @@ where
     }
 
     /// Handle arriving events in the broker
-    #[allow(clippy::unnecessary_wraps)]
+    #[expect(clippy::unnecessary_wraps)]
     fn handle_in_broker(
         monitor: &mut MT,
         client_id: ClientId,
@@ -593,7 +592,6 @@ where
     }
 
     // Handle arriving events in the client
-    #[allow(clippy::unused_self)]
     fn handle_in_client<E, Z>(
         &mut self,
         fuzzer: &mut Z,
@@ -789,7 +787,6 @@ where
                         let buf = self.compressor.decompress(buf)?;
 
                         // make decompressed vec and slice compatible
-                        #[allow(clippy::needless_borrow)]
                         let event = postcard::from_bytes(&buf)?;
 
                         self.handle_in_client(fuzzer, executor, state, other_client_id, event)?;
@@ -1067,7 +1064,7 @@ pub enum TcpManagerKind {
 ///
 /// The [`TcpRestartingEventManager`] is a combination of restarter and runner, that can be used on systems with and without `fork` support.
 /// The restarter will spawn a new process each time the child crashes or timeouts.
-#[allow(clippy::type_complexity)]
+#[expect(clippy::type_complexity)]
 pub fn setup_restarting_mgr_tcp<MT, S>(
     monitor: MT,
     broker_port: u16,
@@ -1099,7 +1096,6 @@ where
 /// The [`TcpRestartingMgr`] is a combination of a
 /// `restarter` and `runner`, that can be used on systems both with and without `fork` support. The
 /// `restarter` will start a new process each time the child crashes or times out.
-#[allow(clippy::default_trait_access, clippy::ignored_unit_patterns)]
 #[derive(TypedBuilder, Debug)]
 pub struct TcpRestartingMgr<EMH, MT, S, SP>
 where
@@ -1142,7 +1138,7 @@ where
     phantom_data: PhantomData<S>,
 }
 
-#[allow(clippy::type_complexity, clippy::too_many_lines)]
+#[expect(clippy::type_complexity, clippy::too_many_lines)]
 impl<EMH, MT, S, SP> TcpRestartingMgr<EMH, MT, S, SP>
 where
     EMH: EventManagerHooksTuple<S> + Copy + Clone,
@@ -1289,7 +1285,7 @@ where
                     return Err(Error::shutting_down());
                 }
 
-                #[allow(clippy::manual_assert)]
+                #[expect(clippy::manual_assert)]
                 if !staterestorer.has_content() && self.serialize_state {
                     #[cfg(unix)]
                     if child_status == 137 {

libafl/src/executors/command.rs

@@ -80,7 +80,6 @@ pub enum InputLocation {
 /// A simple Configurator that takes the most common parameters
 /// Writes the input either to stdio or to a file
 /// Use [`CommandExecutor::builder()`] to use this configurator.
-#[allow(clippy::struct_excessive_bools)]
 #[derive(Debug)]
 pub struct StdCommandConfigurator {
     /// If set to true, the child output will remain visible

libafl/src/executors/differential.rs

@@ -208,7 +208,7 @@ where
     B: MatchName,
     DOT: MatchName,
 {
-    #[allow(deprecated)]
+    #[expect(deprecated)]
     fn match_name<T>(&self, name: &str) -> Option<&T> {
         if let Some(t) = self.primary.as_ref().match_name::<T>(name) {
             Some(t)
@@ -219,7 +219,7 @@ where
         }
     }
 
-    #[allow(deprecated)]
+    #[expect(deprecated)]
     fn match_name_mut<T>(&mut self, name: &str) -> Option<&mut T> {
         if let Some(t) = self.primary.as_mut().match_name_mut::<T>(name) {
             Some(t)

libafl/src/executors/forkserver.rs

@@ -54,43 +54,43 @@ use crate::{
 };
 
 const FORKSRV_FD: i32 = 198;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_NEW_ERROR: i32 = 0xeffe0000_u32 as i32;
 
 const FS_NEW_VERSION_MIN: u32 = 1;
 const FS_NEW_VERSION_MAX: u32 = 1;
 
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_OPT_ENABLED: i32 = 0x80000001_u32 as i32;
 
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_NEW_OPT_MAPSIZE: i32 = 1_u32 as i32;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_OPT_MAPSIZE: i32 = 0x40000000_u32 as i32;
 
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_OPT_SHDMEM_FUZZ: i32 = 0x01000000_u32 as i32;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_NEW_OPT_SHDMEM_FUZZ: i32 = 2_u32 as i32;
 
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_NEW_OPT_AUTODTCT: i32 = 0x00000800_u32 as i32;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_OPT_AUTODTCT: i32 = 0x10000000_u32 as i32;
 
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_ERROR_MAP_SIZE: i32 = 1_u32 as i32;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_ERROR_MAP_ADDR: i32 = 2_u32 as i32;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_ERROR_SHM_OPEN: i32 = 4_u32 as i32;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_ERROR_SHMAT: i32 = 8_u32 as i32;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_ERROR_MMAP: i32 = 16_u32 as i32;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_ERROR_OLD_CMPLOG: i32 = 32_u32 as i32;
-#[allow(clippy::cast_possible_wrap)]
+#[expect(clippy::cast_possible_wrap)]
 const FS_ERROR_OLD_CMPLOG_QEMU: i32 = 64_u32 as i32;
 
 /// Forkserver message. We'll reuse it in a testcase.
@@ -209,7 +209,7 @@ impl ConfigTarget for Command {
         }
     }
 
-    #[allow(trivial_numeric_casts, clippy::cast_possible_wrap)]
+    #[expect(trivial_numeric_casts)]
     fn setlimit(&mut self, memlimit: u64) -> &mut Self {
         if memlimit == 0 {
             return self;
@@ -315,10 +315,10 @@ const fn fs_opt_get_mapsize(x: i32) -> i32 {
     ((x & 0x00fffffe) >> 1) + 1
 }
 
-#[allow(clippy::fn_params_excessive_bools)]
+#[expect(clippy::fn_params_excessive_bools)]
 impl Forkserver {
     /// Create a new [`Forkserver`]
-    #[allow(clippy::too_many_arguments)]
+    #[expect(clippy::too_many_arguments)]
     pub fn new(
         target: OsString,
         args: Vec<OsString>,
@@ -351,7 +351,7 @@ impl Forkserver {
     /// Create a new [`Forkserver`] that will kill child processes
     /// with the given `kill_signal`.
     /// Using `Forkserver::new(..)` will default to [`Signal::SIGTERM`].
-    #[allow(clippy::too_many_arguments)]
+    #[expect(clippy::too_many_arguments)]
     pub fn with_kill_signal(
         target: OsString,
         args: Vec<OsString>,
@@ -540,7 +540,7 @@ impl Forkserver {
         #[allow(
             clippy::uninit_vec,
             reason = "The vec will be filled right after setting the length."
-        )]
+        )] // expect for some reason does not work
         unsafe {
             buf.set_len(size);
         }
@@ -806,7 +806,7 @@ where
 
 /// The builder for `ForkserverExecutor`
 #[derive(Debug)]
-#[allow(clippy::struct_excessive_bools)]
+#[expect(clippy::struct_excessive_bools)]
 pub struct ForkserverExecutorBuilder<'a, TC, SP> {
     program: Option<OsString>,
     arguments: Vec<OsString>,
@@ -839,7 +839,7 @@ where
     /// Else this forkserver will pass the input to the target via `stdin`
     /// in case no input file is specified.
     /// If `debug_child` is set, the child will print to `stdout`/`stderr`.
-    #[allow(clippy::pedantic)]
+    #[expect(clippy::pedantic)]
     pub fn build<OT, S>(mut self, observers: OT) -> Result<ForkserverExecutor<TC, OT, S, SP>, Error>
     where
         OT: ObserversTuple<S::Input, S>,
@@ -902,7 +902,7 @@ where
     }
 
     /// Builds `ForkserverExecutor` downsizing the coverage map to fit exaclty the AFL++ map size.
-    #[allow(clippy::pedantic)]
+    #[expect(clippy::pedantic)]
     pub fn build_dynamic_map<A, MO, OT, S>(
         mut self,
         mut map_observer: A,
@@ -967,7 +967,7 @@ where
         })
     }
 
-    #[allow(clippy::pedantic)]
+    #[expect(clippy::pedantic)]
     fn build_helper(&mut self) -> Result<(Forkserver, InputFile, Option<SP::ShMem>), Error>
     where
         SP: ShMemProvider,
@@ -1040,8 +1040,8 @@ where
     }
 
     /// Intialize forkserver > v4.20c
-    #[allow(clippy::cast_possible_wrap)]
+    #[expect(clippy::cast_possible_wrap)]
-    #[allow(clippy::cast_sign_loss)]
+    #[expect(clippy::cast_sign_loss)]
     fn initialize_forkserver(
         &mut self,
         status: i32,
@@ -1139,8 +1139,7 @@ where
     }
 
     /// Intialize old forkserver. < v4.20c
-    #[allow(clippy::cast_possible_wrap)]
+    #[expect(clippy::cast_sign_loss)]
-    #[allow(clippy::cast_sign_loss)]
     fn initialize_old_forkserver(
         &mut self,
         status: i32,
@@ -1214,7 +1213,7 @@ where
         Ok(())
     }
 
-    #[allow(clippy::cast_sign_loss)]
+    #[expect(clippy::cast_sign_loss)]
     fn set_map_size(&mut self, fsrv_map_size: i32) -> Result<usize, Error> {
         // When 0, we assume that map_size was filled by the user or const
         /* TODO autofill map size from the observer

libafl/src/executors/hooks/inprocess.rs

@@ -25,19 +25,19 @@ use crate::executors::hooks::timer::TimerStruct;
 use crate::executors::hooks::unix::unix_signal_handler;
 #[cfg(windows)]
 use crate::state::State;
+#[cfg(any(unix, windows))]
+use crate::{corpus::Corpus, observers::ObserversTuple, state::UsesState};
 use crate::{
-    corpus::Corpus,
     events::{EventFirer, EventRestarter},
     executors::{hooks::ExecutorHook, inprocess::HasInProcessHooks, Executor, HasObservers},
     feedbacks::Feedback,
     inputs::UsesInput,
-    observers::ObserversTuple,
+    state::{HasCorpus, HasExecutions, HasSolutions},
-    state::{HasCorpus, HasExecutions, HasSolutions, UsesState},
     Error, HasObjective,
 };
 
 /// The inmem executor's handlers.
-#[allow(missing_debug_implementations)]
+#[expect(missing_debug_implementations)]
 pub struct InProcessHooks<S> {
     /// On crash C function pointer
     #[cfg(feature = "std")]
@@ -128,7 +128,7 @@ where
     }
 
     #[cfg(all(unix, feature = "std"))]
-    #[allow(unused)]
+    #[allow(unused_variables)] // depends on the features
     fn handle_timeout(&mut self, data: &mut InProcessExecutorHandlerData) -> bool {
         #[cfg(not(target_os = "linux"))]
         {
@@ -197,8 +197,7 @@ where
 {
     fn init<E: HasObservers>(&mut self, _state: &mut S) {}
     /// Call before running a target.
-    #[allow(clippy::unused_self)]
+    #[expect(unused_variables)]
-    #[allow(unused_variables)]
     fn pre_exec(&mut self, state: &mut S, input: &S::Input) {
         #[cfg(feature = "std")]
         unsafe {
@@ -212,7 +211,6 @@ where
     }
 
     /// Call after running a target.
-    #[allow(clippy::unused_self)]
     fn post_exec(&mut self, _state: &mut S, _input: &S::Input) {
         // timeout stuff
         // # Safety
@@ -228,7 +226,7 @@ where
 {
     /// Create new [`InProcessHooks`].
     #[cfg(unix)]
-    #[allow(unused_variables)]
+    #[allow(unused_variables)] // for `exec_tmout` without `std`
     pub fn new<E, EM, OF, Z>(exec_tmout: Duration) -> Result<Self, Error>
     where
         E: Executor<EM, Z> + HasObservers + HasInProcessHooks<E::State>,
@@ -243,7 +241,8 @@ where
         // # Safety
         // We get a pointer to `GLOBAL_STATE` that will be initialized at this point in time.
         // This unsafe is needed in stable but not in nightly. Remove in the future(?)
-        #[allow(unused_unsafe)]
+        #[expect(unused_unsafe)]
+        #[cfg(all(not(miri), unix, feature = "std"))]
         let data = unsafe { &raw mut GLOBAL_STATE };
         #[cfg(feature = "std")]
         unix_signal_handler::setup_panic_hook::<E, EM, OF, Z>();
@@ -271,7 +270,7 @@ where
 
     /// Create new [`InProcessHooks`].
     #[cfg(windows)]
-    #[allow(unused)]
+    #[allow(unused_variables)] // for `exec_tmout` without `std`
     pub fn new<E, EM, OF, Z>(exec_tmout: Duration) -> Result<Self, Error>
     where
         E: Executor<EM, Z> + HasObservers + HasInProcessHooks<E::State>,
@@ -329,7 +328,7 @@ where
 
     /// Create a new [`InProcessHooks`]
     #[cfg(all(not(unix), not(windows)))]
-    #[allow(unused_variables)]
+    #[expect(unused_variables)]
     pub fn new<E, EM, OF, Z>(exec_tmout: Duration) -> Result<Self, Error>
     where
         E: Executor<EM, Z> + HasObservers + HasInProcessHooks<E::State>,

libafl/src/executors/hooks/timer.rs

@@ -38,7 +38,7 @@ pub(crate) struct Timeval {
 
 #[cfg(all(unix, not(target_os = "linux")))]
 impl core::fmt::Debug for Timeval {
-    #[allow(clippy::cast_sign_loss)]
+    #[expect(clippy::cast_sign_loss)]
     fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
         write!(
             f,
@@ -69,7 +69,7 @@ extern "C" {
 
 /// The strcut about all the internals of the timer.
 /// This struct absorb all platform specific differences about timer.
-#[allow(missing_debug_implementations)]
+#[expect(missing_debug_implementations)]
 pub struct TimerStruct {
     // timeout time (windows)
     #[cfg(windows)]
@@ -103,7 +103,7 @@ pub struct TimerStruct {
 }
 
 #[cfg(windows)]
-#[allow(non_camel_case_types)]
+#[expect(non_camel_case_types)]
 type PTP_TIMER_CALLBACK = unsafe extern "system" fn(
     param0: PTP_CALLBACK_INSTANCE,
     param1: *mut c_void,
@@ -201,8 +201,6 @@ impl TimerStruct {
 
     #[cfg(target_os = "linux")]
     #[must_use]
-    #[allow(unused_unsafe)]
-    #[allow(unused_mut)]
     /// Create a `TimerStruct` with the specified timeout
     pub fn new(exec_tmout: Duration) -> Self {
         let milli_sec = exec_tmout.as_millis();
@@ -218,9 +216,10 @@ impl TimerStruct {
             it_interval,
             it_value,
         };
+        #[allow(unused_mut)] // miri doesn't mutate this
         let mut timerid: libc::timer_t = null_mut();
+        #[cfg(not(miri))]
         unsafe {
-            #[cfg(not(miri))]
             // creates a new per-process interval timer
             libc::timer_create(libc::CLOCK_MONOTONIC, null_mut(), &raw mut timerid);
         }
@@ -264,7 +263,7 @@ impl TimerStruct {
     }
 
     #[cfg(windows)]
-    #[allow(clippy::cast_sign_loss)]
+    #[expect(clippy::cast_sign_loss)]
     /// Set timer
     pub fn set_timer(&mut self) {
         unsafe {
@@ -324,7 +323,6 @@ impl TimerStruct {
 
     /// Disable the timer
     #[cfg(target_os = "linux")]
-    #[allow(unused_variables)]
     pub fn unset_timer(&mut self) {
         // # Safety
         // Just API calls, no user-provided inputs
@@ -351,9 +349,9 @@ impl TimerStruct {
                 }
             }
         } else {
+            #[cfg(not(miri))]
             unsafe {
                 let disarmed: libc::itimerspec = zeroed();
-                #[cfg(not(miri))]
                 libc::timer_settime(self.timerid, 0, &raw const disarmed, null_mut());
             }
         }

libafl/src/executors/hooks/unix.rs

@@ -122,7 +122,7 @@ pub mod unix_signal_handler {
     /// # Safety
     /// Well, signal handling is not safe
     #[cfg(unix)]
-    #[allow(clippy::needless_pass_by_value)]
+    #[allow(clippy::needless_pass_by_value)] // nightly no longer requires this
     pub unsafe fn inproc_timeout_handler<E, EM, OF, Z>(
         _signal: Signal,
         _info: &mut siginfo_t,
@@ -179,8 +179,7 @@ pub mod unix_signal_handler {
     ///
     /// # Safety
     /// Well, signal handling is not safe
-    #[allow(clippy::too_many_lines)]
+    #[allow(clippy::needless_pass_by_value)] // nightly no longer requires this
-    #[allow(clippy::needless_pass_by_value)]
     pub unsafe fn inproc_crash_handler<E, EM, OF, Z>(
         signal: Signal,
         _info: &mut siginfo_t,

libafl/src/executors/hooks/windows.rs

@@ -154,7 +154,6 @@ pub mod windows_exception_handler {
     impl ExceptionHandler for InProcessExecutorHandlerData {
         /// # Safety
         /// Will dereference `EXCEPTION_POINTERS` and access `GLOBAL_STATE`.
-        #[allow(clippy::not_unsafe_ptr_arg_deref)]
         unsafe fn handle(
             &mut self,
             _code: ExceptionCode,
@@ -316,7 +315,6 @@ pub mod windows_exception_handler {
     ///
     /// # Safety
     /// Well, exception handling is not safe
-    #[allow(clippy::too_many_lines)]
     pub unsafe fn inproc_crash_handler<E, EM, OF, Z>(
         exception_pointers: *mut EXCEPTION_POINTERS,
         data: &mut InProcessExecutorHandlerData,

libafl/src/executors/inprocess/mod.rs

@@ -2,8 +2,6 @@
 //! It should usually be paired with extra error-handling, such as a restarting event manager, to be effective.
 //!
 //! Needs the `fork` feature flag.
-#![allow(clippy::needless_pass_by_value)]
-
 use alloc::boxed::Box;
 use core::{
     borrow::BorrowMut,
@@ -57,7 +55,6 @@ pub type OwnedInProcessExecutor<OT, S> = GenericInProcessExecutor<
 >;
 
 /// The inmem executor simply calls a target function, then returns afterwards.
-#[allow(dead_code)]
 pub struct GenericInProcessExecutor<H, HB, HT, OT, S>
 where
     H: FnMut(&S::Input) -> ExitKind + ?Sized,
@@ -426,7 +423,6 @@ where
 }
 
 #[inline]
-#[allow(clippy::too_many_arguments)]
 /// Save state if it is an objective
 pub fn run_observers_and_save_state<E, EM, OF, Z>(
     executor: &mut E,
@@ -550,7 +546,6 @@ mod tests {
     }
 
     #[test]
-    #[allow(clippy::let_unit_value)]
     fn test_inmem_exec() {
         let mut harness = |_buf: &NopInput| ExitKind::Ok;
         let rand = XkcdRand::new();

libafl/src/executors/inprocess/stateful.rs

@@ -44,7 +44,6 @@ pub type OwnedInProcessExecutor<OT, S, ES> = StatefulGenericInProcessExecutor<
 
 /// The inmem executor simply calls a target function, then returns afterwards.
 /// The harness can access the internal state of the executor.
-#[allow(dead_code)]
 pub struct StatefulGenericInProcessExecutor<H, HB, HT, OT, S, ES>
 where
     H: FnMut(&mut ES, &mut S, &S::Input) -> ExitKind + ?Sized,
@@ -318,7 +317,7 @@ where
 
     /// Create a new in mem executor with the default timeout and use batch mode(5 sec)
     #[cfg(all(feature = "std", target_os = "linux"))]
-    #[allow(clippy::too_many_arguments)]
+    #[expect(clippy::too_many_arguments)]
     pub fn batched_timeout_generic<EM, OF, Z>(
         user_hooks: HT,
         harness_fn: HB,
@@ -357,7 +356,7 @@ where
     /// * `observers` - the observers observing the target during execution
     ///
     /// This may return an error on unix, if signal handler setup fails
-    #[allow(clippy::too_many_arguments)]
+    #[expect(clippy::too_many_arguments)]
     pub fn with_timeout_generic<EM, OF, Z>(
         user_hooks: HT,
         harness_fn: HB,

libafl/src/executors/inprocess_fork/inner.rs

@@ -254,7 +254,6 @@ where
 
     /// Creates a new [`GenericInProcessForkExecutorInner`] with custom hooks
     #[cfg(target_os = "linux")]
-    #[allow(clippy::too_many_arguments)]
     pub fn with_hooks(
         userhooks: HT,
         observers: OT,
@@ -279,7 +278,6 @@ where
 
     /// Creates a new [`GenericInProcessForkExecutorInner`], non linux
     #[cfg(not(target_os = "linux"))]
-    #[allow(clippy::too_many_arguments)]
     pub fn with_hooks(
         userhooks: HT,
         observers: OT,

libafl/src/executors/inprocess_fork/mod.rs

@@ -57,7 +57,6 @@ where
     S: HasSolutions,
     Z: HasObjective<Objective = OF>,
 {
-    #[allow(clippy::too_many_arguments)]
     /// The constructor for `InProcessForkExecutor`
     pub fn new(
         harness_fn: &'a mut H,
@@ -147,7 +146,6 @@ where
     HT: ExecutorHooksTuple<S>,
     EM: EventFirer<State = S> + EventRestarter<State = S>,
 {
-    #[allow(unreachable_code)]
     #[inline]
     fn run_target(
         &mut self,
@@ -190,7 +188,7 @@ where
     Z: HasObjective<Objective = OF>,
 {
     /// Creates a new [`GenericInProcessForkExecutor`] with custom hooks
-    #[allow(clippy::too_many_arguments)]
+    #[expect(clippy::too_many_arguments)]
     pub fn with_hooks(
         userhooks: HT,
         harness_fn: &'a mut H,
@@ -301,7 +299,7 @@ pub mod child_signal_handlers {
     /// The function should only be called from a child crash handler.
     /// It will dereference the `data` pointer and assume it's valid.
     #[cfg(unix)]
-    #[allow(clippy::needless_pass_by_value)]
+    #[allow(clippy::needless_pass_by_value)] // nightly no longer requires this
     pub(crate) unsafe fn child_crash_handler<E>(
         _signal: Signal,
         _info: &mut siginfo_t,
@@ -325,9 +323,9 @@ pub mod child_signal_handlers {
     }
 
     #[cfg(unix)]
-    #[allow(clippy::needless_pass_by_value)]
+    #[allow(clippy::needless_pass_by_value)] // nightly no longer requires this
     pub(crate) unsafe fn child_timeout_handler<E>(
-        _signal: Signal,
+        #[cfg(unix)] _signal: Signal,
         _info: &mut siginfo_t,
         _context: Option<&mut ucontext_t>,
         data: &mut InProcessForkExecutorGlobalData,