diff --git a/docs/samples/v1beta1/xgboost/requirements.txt b/docs/samples/v1beta1/xgboost/requirements.txt
index d867893a21..276f08dede 100644
--- a/docs/samples/v1beta1/xgboost/requirements.txt
+++ b/docs/samples/v1beta1/xgboost/requirements.txt
@@ -1,2 +1,3 @@
 mlserver
 mlserver-xgboost
+starlette>=0.27.0 # not directly required, pinned by Snyk to avoid a vulnerability