diff --git a/edamfu-xml/requirements.txt b/edamfu-xml/requirements.txt
index bbbc5e5..f33d3fe 100644
--- a/edamfu-xml/requirements.txt
+++ b/edamfu-xml/requirements.txt
@@ -87,7 +87,7 @@ soupsieve==2.5
 stack-data==0.6.3
 terminado==0.18.0
 tinycss2==1.2.1
-tornado==6.4
+#tornado==6.4 ## 2024-12-05: commenting for now - security alert - see https://github.com/advisories/GHSA-8w49-h785-mj3c/dependabot?query=user%3Aedamontology
 traitlets==5.14.1
 types-python-dateutil==2.8.19.20240106
 uri-template==1.3.0