diff --git a/requirements-publish.txt b/requirements-publish.txt
index 8f48357..340731a 100644
--- a/requirements-publish.txt
+++ b/requirements-publish.txt
@@ -1,3 +1,4 @@
 setuptools==41.0.1
 wheel==0.33.4
 twine==1.13.0
+urllib3>=2.6.3 # not directly required, pinned by Snyk to avoid a vulnerability