diff --git a/composer/rest/requirements.txt b/composer/rest/requirements.txt
index 56eda507122..b975831ef58 100644
--- a/composer/rest/requirements.txt
+++ b/composer/rest/requirements.txt
@@ -1,3 +1,4 @@
 google-auth==1.6.2
 requests==2.21.0
 six==1.12.0
+urllib3>=2.6.0 # not directly required, pinned by Snyk to avoid a vulnerability