diff --git a/apps/gcp_to_cwl/requirements.txt b/apps/gcp_to_cwl/requirements.txt
index 9bd7ae5..7181ce8 100644
--- a/apps/gcp_to_cwl/requirements.txt
+++ b/apps/gcp_to_cwl/requirements.txt
@@ -2,3 +2,4 @@ boto3==1.7.19
 google-cloud-pubsub==0.30.1
 proto-google-cloud-pubsub-v1==0.15.4
 dcplib
+setuptools>=65.5.1 # not directly required, pinned by Snyk to avoid a vulnerability