I understand this is about the trust-dns binary, which unconditionally depends on the trust-dns-server crate. Is that correct? If that's the case, a separate advisory should not be needed - cargo audit will inspect the dependency tree and locate the vulnerable trust-dns-server crate.

If you have other use cases, please let me know, but as it stands I think an advisory about trust-dns-server should be sufficient.

Yes, it is about the binary, since it can be used “independent” of the trust-dns-server. But you are right, that there is a mandatory dependency between them. If you think the existing advisory is sufficient, then I close this one.