diff --git a/test-requirements.txt b/test-requirements.txt
index bedd666..a3c6326 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -2,3 +2,4 @@
 sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2
 oslosphinx>=2.5.0 # Apache-2.0
 reno>=0.1.1 # Apache-2.0
+pygments>=2.7.4 # not directly required, pinned by Snyk to avoid a vulnerability