diff --git a/requirements/dev.txt b/requirements/dev.txt
index a920601b7c..f865e3be11 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -15,3 +15,4 @@ pathlib2==2.3.2; python_version<"3.4"
 futures==3.2.0; python_version<"3.2.3"
 # Py3.2 backport
 backports.tempfile==1.0
+setuptools>=70.0.0 # not directly required, pinned by Snyk to avoid a vulnerability