diff --git a/eng/release_requirements.txt b/eng/release_requirements.txt
index 5852e9577332..2880c54fd43d 100644
--- a/eng/release_requirements.txt
+++ b/eng/release_requirements.txt
@@ -1,3 +1,4 @@
 twine==3.1.1; python_version >= '3.6'
 readme-renderer[md]==25.0
 pkginfo==1.5.0.1
+pygments>=2.7.4 # not directly required, pinned by Snyk to avoid a vulnerability