diff --git a/requirements-tpu.txt b/requirements-tpu.txt
index 4c606cf0a910..8b574dd81964 100644
--- a/requirements-tpu.txt
+++ b/requirements-tpu.txt
@@ -5,3 +5,5 @@
 # Currently, the TPU backend uses a nightly version of PyTorch XLA.
 # You can install the dependencies in Dockerfile.tpu.
 ray[default]
+protobuf>=4.25.8 # not directly required, pinned by Snyk to avoid a vulnerability
+urllib3>=2.5.0 # not directly required, pinned by Snyk to avoid a vulnerability