Bug: Hash required for editable dependency even with skip-editable

[matsjoyce-refeyn]

Pre-submission checks

• I am not filing an auditing error (false positive or negative). These must be reported to pypa/advisory-database instead.
• I agree to follow the PSF Code of Conduct.
• I have looked through the open issues for a duplicate report.

Expected behavior

We run pip-audit -r <requirements-file> -s osv --progress-spinner off --no-deps --skip-editable --disable-pip. The requirements file contains an editable requirements -e file:., as well has requirements with --hash=... set. I would expect pip-audit to require hashes for all dependencies, except for the editable dependencies which would be skipped.

Actual behavior

Pip-audit fails with ERROR:pip_audit._cli:requirement --editable file:. does not contain a hash.

Reproduction steps

Run pip-audit -r <requirements-file> --skip-editable on a file with -e file:. and a dependency with a --hash=....

Logs

ERROR:pip_audit._cli:requirement --editable file:. does not contain a hash

Additional context

This is somewhat related to the discussion at pypa/pip#4995. However, since pip-audit has a --skip-editable flag, I would the flag to work regardless of what the behaviour of --require-hashes ought to be. We currently use UV for installing, so the pip behaviour doesn't affect us.

OS name, version, and architecture

Windows 11 64-bit

pip-audit version

2.10.0

pip version

26.0

Python version

3.12.13

[woodruffw]

Thanks for opening an issue @matsjoyce-refeyn. I'll take a look at this in the coming days.

We currently use UV for installing, so the pip behaviour doesn't affect us.

FYI, if you're using uv elsewhere, I recommend using uv audit directly. That'll mesh more directly with uv-native flows, pip-audit mostly targets PyPA tooling (which is why it inherits some limitations like you've noticed with pypa/pip#4995) 🙂