diff --git a/src/python/cli_new/pip-requirements.txt b/src/python/cli_new/pip-requirements.txt
index 4f512a42129..de4369769a2 100644
--- a/src/python/cli_new/pip-requirements.txt
+++ b/src/python/cli_new/pip-requirements.txt
@@ -16,3 +16,4 @@ wrapt==1.10.8
 tox==3.2.1
 
 -e ../lib
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability