diff --git a/CHANGES.md b/CHANGES.md
index 7ca8533f..22825a53 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,3 +1,9 @@
+2020-09-11, Version 4.6.0
+=========================
+
+ * chore: move explorer to devdependency (jannyHou)
+
+
 2019-01-28, Version 4.5.2
 =========================
 
diff --git a/package.json b/package.json
index a3fee723..1faac7ca 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "loopback-workspace",
-  "version": "4.5.2",
+  "version": "4.6.0",
   "engines": {
     "node": ">=6"
   },
@@ -28,7 +28,6 @@
     "lodash": "^4.17.11",
     "loopback": "^3.24.0",
     "loopback-boot": "^2.27.1",
-    "loopback-component-explorer": "^6.3.1",
     "method-override": "^3.0.0",
     "morgan": "^1.9.1",
     "ncp": "^2.0.0",
@@ -46,6 +45,7 @@
     "chai": "^1.10.0",
     "eslint": "^2.13.1",
     "eslint-config-loopback": "^2.0.0",
+    "loopback-component-explorer": "^6.3.1",
     "mocha": "^5.2.0",
     "mysql": "^2.16.0",
     "read": "^1.0.7",
diff --git a/server/server.js b/server/server.js
index 5cd61d8f..d389c773 100644
--- a/server/server.js
+++ b/server/server.js
@@ -13,6 +13,7 @@ var methodOverride = require('method-override');
 var app = module.exports = loopback();
 var boot = require('loopback-boot');
 var cookieParser = require('cookie-parser');
+var debug = require('debug')('loopback:workspace:server');
 var errorHandler = require('strong-error-handler');
 
 /*
@@ -52,11 +53,29 @@ app.use(methodOverride());
 // LoopBack REST interface
 app.use(app.get('restApiRoot'), loopback.rest());
 
-// API explorer
-require('loopback-component-explorer')(app);
-app.once('started', function(baseUrl) {
-  g.log('Browse your REST API at %s%s', baseUrl, '/explorer');
-});
+// To prevent the snyk warning about swagger-ui@2.x, the explorer component
+// is moved from dependencies to devDependencies.
+// Here we try to mount the explorer component in case it's installed.
+
+var hasExplorer;
+try {
+  require.resolve('loopback-component-explorer');
+  hasExplorer = true;
+} catch (err) {
+  debug(
+    'loopback-workspace runs without API Explorer enabled due to %s. \n' +
+    'To install it, run `npm i loopback-component-explorer`.',
+    err.stack || err
+  );
+  hasExplorer = false;
+}
+
+if (hasExplorer) {
+  require('loopback-component-explorer')(app);
+  app.once('started', function(baseUrl) {
+    g.log('Browse your REST API at %s%s', baseUrl, '/explorer');
+  });
+}
 
 /*
  * EXTENSION POINT