diff --git a/src/python/cli_new/pip-requirements.txt b/src/python/cli_new/pip-requirements.txt
index 4f512a42129..6c25a13f787 100644
--- a/src/python/cli_new/pip-requirements.txt
+++ b/src/python/cli_new/pip-requirements.txt
@@ -16,3 +16,4 @@ wrapt==1.10.8
 tox==3.2.1
 
 -e ../lib
+setuptools>=70.0.0 # not directly required, pinned by Snyk to avoid a vulnerability