Feature: --fix with download-only, or output fixes as requirements.txt

[Wes-dx]

Pre-submission checks

• I am not reporting a new vulnerability or requesting a new vulnerability identifier. These must be reported or managed via upstream dependency sources or services, not this repository.
• I agree to follow the PSF Code of Conduct.
• I have looked through the open issues for a duplicate request.

What's the problem this feature will solve?

Can't make a script to apply pip updates to an estate of machines in a controlled way.

Describe the solution you'd like

pip-audit has a --download-only option and/or an output as requirements format option when specifying --fix

Additional context

No response

[woodruffw]

pip-audit has a --download-only option and/or an output as requirements format option when specifying --fix

Sorry, I don't think I follow -- what would --download-only do here?

Note that --fix does emit requirements.txt by default, if that's the input you give it.

[Wes-dx]

Download would let me create an offline updater for multiple machines. I could get a requirements.txt by feeding it one generated by pip freeze i guess?

…

On Tue, 5 Aug 2025, 15:38 William Woodruff, ***@***.***> wrote: *woodruffw* left a comment (pypa/pip-audit#925) <#925 (comment)> pip-audit has a --download-only option and/or an output as requirements format option when specifying --fix Sorry, I don't think I follow -- what would --download-only do here? Note that --fix *does* emit requirements.txt by default, if that's the input you give it. — Reply to this email directly, view it on GitHub <#925 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE52O2N75FYAMHIG2332KT33MC6VXAVCNFSM6AAAAACDFEAQJSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTCNJVGUYDEMRXGY> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[woodruffw]

Download would let me create an offline updater for multiple machines.

Sorry, I'm still not following -- what would this download? The vulnerability DB?

(If I got that right, #698 has some related context -- making pip-audit completely offline-native is nontrivial, unfortunately.)

I could get a requirements.txt by feeding it one generated by pip freeze I guess?

Yeah, this is what I'd recommend. FWIW doing fully automatic updates with pip-audit --fix isn't something I'd necessarily encourage, since pip-audit is not itself a dependency resolver and doesn't try to select to most compatible update. The fix mode really benefits from manual human review + a feedback cycle with tests 🙂