diff --git a/requirements/default.txt b/requirements/default.txt
index 2efafa48a0a..9a224faae8f 100644
--- a/requirements/default.txt
+++ b/requirements/default.txt
@@ -302,3 +302,4 @@ wheel==0.29.0 \
 whitenoise==2.0.6 \
     --hash=sha256:826ffe5d608c9dc8daebef1b0b43d01f7958f17c2fce36e75c80e26160172c4f \
     --hash=sha256:5aea935dfc09ef2beeb76960b4a808b0bbe65e85fb0b0312434b9c365ca02a41
+urllib3>=2.5.0 # not directly required, pinned by Snyk to avoid a vulnerability