pip-audit: "FixResolutionImpossible: cannot fix without breaking dependency constraints"

Fix pip-audit "FixResolutionImpossible" without breaking your dependency tree

TL;DR

FixResolutionImpossible means the fixed versions conflict with your pins, so there is no single safe upgrade path. Loosen or bump the constraining package first, then re-run pip-audit. If nothing can move, record the finding as accepted risk instead of forcing an upgrade.

pip-audit: "FixResolutionImpossible: cannot fix without breaking dependency constraints"

Steps

1. See exactly which fix is blocked and why. Run pip-audit in report-only mode and note the package, the fixed version, and the constraint it breaks.

   • Run: pip-audit -r requirements.txt
   • Expected: a findings table listing the vulnerable package and the fixed version pip-audit wanted.

2. Find the pin that blocks the upgrade. Search your requirements for the package that constrains it.

   • Run: grep -n "PACKAGENAME" requirements.txt (replace PACKAGENAME with the constraining package shown by pip-audit)
   • Expected: the line pinning the conflicting package.

3. Check what else depends on the conflicting pin before loosening it.

   • Run: pipdeptree -p PACKAGENAME (replace PACKAGENAME with the package from step 1)
   • Expected: a list of dependents and their version ranges so you can see what a bump would affect.

4. Bump the constraining package to a version compatible with the fix, or widen its pin, then re-run pip-audit with fix mode.

   • Run: edit requirements.txt to allow the newer version, then run pip install -r requirements.txt and pip-audit --fix -r requirements.txt
   • Expected: pip-audit finishes with no FixResolutionImpossible and the finding shows as fixed.

5. If nothing can move (for example the fix needs Python 3.12 and you are pinned to 3.10), record an exception and keep the finding visible instead of forcing it.

   • Run: pip-audit --format=json, then check the finding is still listed
   • Expected: the finding remains listed as a known-accepted exception rather than silently disappearing.

Use this when

• pip-audit --fix exits with FixResolutionImpossible
• pip-audit reports a fix that would break other pinned packages
• You are deciding whether to widen a pin or accept a known vulnerability

Not for this skill when

• pip-audit fails to run at all (missing requirements file or environment - that is a different error)
• The dependency conflict is not security-related (use a pip resolver guide instead)
• You want to upgrade every package regardless of breakage (use a major-bump workflow)

Variant phrasings

• pip audit cannot fix without breaking dependency constraints
• FixResolutionImpossible pip-audit
• pip-audit fix fails with resolution error

Why it happens

pip-audit's fix mode asks the pip resolver to install the fixed versions on top of your existing pins. When a pin (or a transitive constraint) rules out every fixed version, the resolver cannot build a valid environment, so pip-audit aborts instead of leaving you with a broken install. The error is pip-audit protecting your environment, not a scanner bug.

Edge cases

• Multiple findings with conflicting fixes: fix the highest severity first, one bump at a time, re-running pip-audit between bumps.
• The blocking pin comes from a constraints file or a transitive dep, not requirements.txt: check pip freeze and constraints files too.
• The fix version was yanked from the index: pip-audit may propose it and pip refuses, so wait for a newer advisory or pin an alternative version.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_MPRJHvoGr8OMrwTUYMur8g