diff --git a/dev-requirements.txt b/dev-requirements.txt
index 42c94ba..5f0e4ab 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -16,3 +16,4 @@ sphinx-autobuild==0.7.1
 
 # Add project itself
 -e .
+tornado>=6.3.2 # not directly required, pinned by Snyk to avoid a vulnerability