diff --git a/pub_sub/python/http/order-processor/requirements.txt b/pub_sub/python/http/order-processor/requirements.txt
index 289bc5eec..0dfc08781 100644
--- a/pub_sub/python/http/order-processor/requirements.txt
+++ b/pub_sub/python/http/order-processor/requirements.txt
@@ -1,3 +1,4 @@
 Flask
 dapr
 cloudevents
+aiohttp>=3.9.4 # not directly required, pinned by Snyk to avoid a vulnerability