diff --git a/requirements/base.txt b/requirements/base.txt
index 5da6d74ca6..25e51d9606 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -14,3 +14,4 @@ pathlib2~=2.3.2; python_version<"3.4"
 requests==2.20.1
 aws_lambda_builders==0.2.0
 serverlessrepo==0.1.8
+idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability