diff --git a/conda.recipe/requirements.txt b/conda.recipe/requirements.txt
index 85c1f4c4..be18a1a4 100644
--- a/conda.recipe/requirements.txt
+++ b/conda.recipe/requirements.txt
@@ -4,3 +4,4 @@ hvplot
 panel
 pandas
 
+tornado>=6.3.3 # not directly required, pinned by Snyk to avoid a vulnerability