diff --git a/requirements-dev.txt b/requirements-dev.txt
index 60dd738e43..b6a5811ddc 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -101,3 +101,4 @@ jupyterlab >=3.4,<4
 jupyterlite==0.1.0b10
 sphinx-toggleprompt
 setuptools>=51.0.0
+tornado>=6.5 # not directly required, pinned by Snyk to avoid a vulnerability