cargo audit does not provide a stable library interface, but the rustsec crate does. So the functions from binary_deps.rs should be moved to the rustsec crate, behind a binary-scanning Cargo feature.

Sorry if that wasn't clear from the start.

No problem! I misunderstood... I'm still an amateur contributor, so thank you for the explanation. I tried applying what you explained - I hope this is what you meant - otherwise please let me know!

The pipeline fails because there is a new vulnerability in rustls. What is the procedure in a case like this? AFAIK the package is only indirectly used by rustsec.

cargo update -p rustls should do the trick.