diff --git a/app-engine/demo-version-index/requirements.txt b/app-engine/demo-version-index/requirements.txt
index ae64326a2f..984dd0abf9 100644
--- a/app-engine/demo-version-index/requirements.txt
+++ b/app-engine/demo-version-index/requirements.txt
@@ -3,3 +3,4 @@
 # SPDX-License-Identifier: Apache-2.0
 
 Flask==2.2.5
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability