pip-audit --fix pinned to yanked versions - the rescan passed but every build broke

TL;DR

pip-audit --fix picks the first version that resolves the CVE, and that version can be yanked: still listed, but its files removed from the index, so every fresh install fails. The rescan passes because the pin satisfies the audit, while the build breaks because pip cannot download the file. List the fix candidates without applying them, skip the yanked ones, and pin the next non-yanked fixed version yourself.

The query

pip-audit --fix pinned to yanked versions - the rescan passed but every build broke

Use this when

• pip-audit --fix changed your requirements and builds started failing on install
• pip reports the pinned version as yanked or cannot find its files
• The rescan is green but nothing installs

Not for

• CVEs with no fixed version available at all (nothing to pin)
• Build failures unrelated to the pinned versions (check the error first)
• pip-audit false positives (a matcher problem, not a fix problem)

Steps

1. See what --fix actually pinned

git diff requirements.txt

Expected output: the version pins --fix wrote. Note each changed package and version.

2. Check which pins are yanked

For each pinned version, check its status on the package index. A yanked release shows a yanked marker; its files may already be gone.

Expected output: a list of which pins are yanked versus healthy.

3. List fix candidates without applying

pip-audit --desc

Expected output: the vulnerabilities with their fix versions listed. You are looking for the next fixed version after the yanked one.

4. Pin the next non-yanked fix by hand

Edit the requirements to the healthy fixed version and reinstall from a clean environment:

pip install -r requirements.txt

Expected output: the install succeeds and pip-audit reports the CVE fixed. The pin is now both green and installable.

5. Verify from a truly clean environment

Build in a fresh container or virtualenv with no cache, the way CI does. Verify: the install and the audit both pass with empty caches.

Variant phrasings

pip-audit fix yanked version breaks build

The short symptom search.

pip-audit --fix pinned version files removed

The cause-first search.

Compatibility: pip-audit with any pip version honoring yanked releases per PEP 592.

Why it happens

Yanked releases stay visible in version metadata but have their files withdrawn, usually because the release itself was broken. pip-audit's fixer resolves against version metadata, where the yanked version looks like a perfectly good fix target. The audit then passes because the pin satisfies the version constraint, while pip fails because there is nothing to download. Two tools, two different definitions of "this version exists".

Edge cases / pitfalls

• A yanked version can become un-yanked, but do not count on it. Pin the healthy version and move on.
• If every fixed version is yanked, the release line is abandoned. Look for the fix in a newer minor or major release, or a fork.
• Pinning to a yanked version that still has files works today and breaks without warning tomorrow. Treat any yanked pin as tech debt with an expiry date of "whenever".
• Record why you skipped the yanked version next to the pin. Otherwise the next pip-audit --fix run will happily re-pin it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_JGFxjjx3LFx2vTt4YOY7WA