diff --git a/dev-requirements.txt b/dev-requirements.txt
index 2cb82ab..cf8ad9e 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -11,3 +11,4 @@ selenium<4.10
 six>=1.13.0
 
 -e git+https://github.com/ckan/ckanext-scheming.git@release-3.0.0#egg=ckanext-scheming
+urllib3>=2.2.2 # not directly required, pinned by Snyk to avoid a vulnerability