packaging.requirements makes it pretty easy to parse, but not do set operations on. For this issue, I'm most interested in when requirements.txt pins to a specific version, and that version is too low for install_requires. Similar to #6, this should go after UseDeclarativeMetadata.
There's no api for showing a message right now, so just log (and when there's an api I will migrate it). If you want to autofix to be the latest (or first compatible) version, that's great. honesty.releases.parse_index is one way to do this, there might be a simpler one.