diff --git a/requirements-dev-py37.txt b/requirements-dev-py37.txt
index d0ddc7c26..70d0ef216 100644
--- a/requirements-dev-py37.txt
+++ b/requirements-dev-py37.txt
@@ -16,3 +16,4 @@ autoflake
 pytest
 pytest-xdist
 pytest-html
+tornado>=6.4.2 # not directly required, pinned by Snyk to avoid a vulnerability