diff --git a/twitter-sentiment-processor/demos/py-demo/provider/requirements.txt b/twitter-sentiment-processor/demos/py-demo/provider/requirements.txt
index 3fdbe7c9..354ab4b4 100644
--- a/twitter-sentiment-processor/demos/py-demo/provider/requirements.txt
+++ b/twitter-sentiment-processor/demos/py-demo/provider/requirements.txt
@@ -1,2 +1,3 @@
 dapr-ext-grpc >= 1.0.0
 dapr >= 1.0.0
+aiohttp>=3.9.4 # not directly required, pinned by Snyk to avoid a vulnerability