ERROR pip security_error ai_generated true

ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE

ID: pip/hash-mismatch

Also available as: JSON · Markdown
88%Fix Rate
90%Confidence
50Evidence
2022-06-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
23 active — — —
24 active — — —

Root Cause

Package hash mismatch in pip 23 occurs when cached or downloaded wheels do not match the hashes specified in requirements. Often caused by stale cache or updated packages on PyPI.

generic

Workarounds

  1. 92% success Clear pip cache and regenerate hashes: pip cache purge && pip-compile --generate-hashes 
    Run pip cache purge to clear stale wheels, then regenerate requirements with correct hashes
  2. 88% success Pin exact package versions with updated hashes using pip hash 
    Download the wheel manually, run pip hash <file>.whl, update requirements.txt with new hash

Dead Ends

Common approaches that don't work:

  1. Simply retry the install without clearing cache 75% fail

    The cached wheel has the wrong hash and will keep being reused

  2. Disable hash checking entirely with --no-verify 85% fail

    Pip 23 does not support --no-verify; also removes important supply chain security

Error Chain

Leads to:
Frequently confused with: