# When pip-audit's fixed versions require a Python upgrade

## TL;DR
The fixed packages dropped support for your Python version, so no fix exists for your current interpreter. The real fix is upgrading Python; the alternatives are backporting the patch yourself, isolating the vulnerable component, or formally accepting the risk. Pick based on how exposed the vulnerable code path is.

```text
pip-audit found 3 vulnerabilities but the fixed versions require a Python upgrade
```

## Steps

1. Identify exactly which fixes are blocked and what Python floor they need.
   - Run: pip-audit and note each finding's fixed version, then check that version's requires-python metadata
   - Expected: a clear list like "package X fixed in 2.0 needs Python 3.11+, you run 3.9".

2. Check how far your Python is behind and whether an upgrade is feasible in your environment.
   - Run: python3 --version and check what your base image, CI runners, and deployment targets support
   - Expected: you know the target Python version and whether the platform supports it.

3. If upgrading is feasible, do it on a branch and re-run the full pipeline.
   - Run: update the base image or runtime to the needed Python version, reinstall deps, run pip-audit and your test suite
   - Expected: pip-audit shows the findings fixed and tests pass on the new interpreter.

4. If upgrading is not feasible now, contain the risk: check whether the vulnerable code path is reachable in your app, and record an accepted-risk exception with an expiry date.
   - Run: pip-audit to keep the findings listed, and document the exception with the planned Python upgrade quarter
   - Expected: the finding stays visible as accepted risk with an owner and a deadline, not silently ignored.

## Use this when
- pip-audit's fixed versions require a newer Python than you run
- Your base image or platform pins an older Python
- You need to justify a Python upgrade (or a risk acceptance) to the team

## Not for this skill when
- The fix is blocked by a pinned dependency, not the Python version (that is a resolver conflict)
- You already run a supported Python and pip-audit still complains (check requires-python metadata and your actual interpreter)
- The vulnerability is in a dev-only tool (upgrade the tool's own environment, not production)

## Variant phrasings
- pip-audit fix requires python upgrade
- pip-audit vulnerabilities need newer python version
- cannot fix pip-audit findings without upgrading python

## Why it happens
Package maintainers drop old Python versions in new releases, and security fixes ship only in those new releases. If you stay on an end-of-life or older interpreter, the fixed versions declare a requires-python floor above yours, so pip cannot install them at all. The scanner is telling you the truth: there is no patched version compatible with your runtime.

## Edge cases
- Only one of several findings needs the upgrade: fix what you can now and isolate the Python-blocked one.
- The vulnerable package is only used in a CLI or build tool: upgrade that tool's isolated environment (pipx, a separate venv) instead of production.
- Backporting the security patch yourself forks you from upstream: treat it as a last resort with a plan to rejoin upstream at the next Python upgrade.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ATKRrTjxwTRxx1rOF8IWZA