diff --git a/api.planx.uk/package.json b/api.planx.uk/package.json
index 65cccb8e5d..9b0819d79f 100644
--- a/api.planx.uk/package.json
+++ b/api.planx.uk/package.json
@@ -88,7 +88,7 @@
     "@types/node": "^18.19.13",
     "@types/passport": "^1.0.16",
     "@types/passport-google-oauth20": "^2.0.14",
-    "@types/supertest": "^2.0.16",
+    "@types/supertest": "^6.0.2",
     "@types/swagger-jsdoc": "^6.0.4",
     "@types/swagger-ui-express": "^4.1.6",
     "@types/uuid": "^9.0.7",
@@ -108,7 +108,7 @@
     "node-dev": "^8.0.0",
     "prettier": "^3.2.4",
     "rimraf": "^5.0.5",
-    "supertest": "^6.3.3",
+    "supertest": "^7.0.0",
     "ts-jest": "^29.1.1",
     "ts-node-dev": "^2.0.0",
     "typescript": "^5.4.3",
@@ -125,8 +125,7 @@
       ]
     },
     "overrides": {
-      "follow-redirects@<=1.15.5": ">=1.15.6",
-      "formidable@<3.2.4": ">=3.2.4"
+      "follow-redirects@<=1.15.5": ">=1.15.6"
     }
   }
 }
diff --git a/api.planx.uk/pnpm-lock.yaml b/api.planx.uk/pnpm-lock.yaml
index e83d1d9982..0fcbc8a7c3 100644
--- a/api.planx.uk/pnpm-lock.yaml
+++ b/api.planx.uk/pnpm-lock.yaml
@@ -6,7 +6,6 @@ settings:
 
 overrides:
   follow-redirects@<=1.15.5: '>=1.15.6'
-  formidable@<3.2.4: '>=3.2.4'
 
 dependencies:
   '@airbrake/node':
@@ -204,8 +203,8 @@ devDependencies:
     specifier: ^2.0.14
     version: 2.0.14
   '@types/supertest':
-    specifier: ^2.0.16
-    version: 2.0.16
+    specifier: ^6.0.2
+    version: 6.0.2
   '@types/swagger-jsdoc':
     specifier: ^6.0.4
     version: 6.0.4
@@ -264,8 +263,8 @@ devDependencies:
     specifier: ^5.0.5
     version: 5.0.5
   supertest:
-    specifier: ^6.3.3
-    version: 6.3.3
+    specifier: ^7.0.0
+    version: 7.0.0
   ts-jest:
     specifier: ^29.1.1
     version: 29.1.1(@babel/core@7.24.0)(esbuild@0.20.0)(jest@29.7.0)(typescript@5.4.3)
@@ -2140,9 +2139,10 @@ packages:
       '@types/node': 18.19.13
     dev: true
 
-  /@types/supertest@2.0.16:
-    resolution: {integrity: sha512-6c2ogktZ06tr2ENoZivgm7YnprnhYE4ZoXGMY+oA7IuAf17M8FWvujXZGmxLv8y0PTyts4x5A+erSwVUFA8XSg==}
+  /@types/supertest@6.0.2:
+    resolution: {integrity: sha512-137ypx2lk/wTQbW6An6safu9hXmajAifU/s7szAHLN/FeIm5w7yR0Wkl9fdJMRSHwOn4HLAI0DaB2TOORuhPDg==}
     dependencies:
+      '@types/methods': 1.1.4
       '@types/superagent': 8.1.6
     dev: true
 
@@ -5743,6 +5743,7 @@ packages:
       chalk: 3.0.0
       diff-match-patch: 1.0.5
     dev: false
+    bundledDependencies: []
 
   /jsonwebtoken@9.0.2:
     resolution: {integrity: sha512-PRp66vJ865SSqOlgqS8hujT5U4AOgMfhrwYIuIhfKaoSCZcirrmASQr8CX7cUg+RMih+hgznrjp99o+W4pJLHQ==}
@@ -7585,10 +7586,9 @@ packages:
     resolution: {integrity: sha512-Orov6g6BB1sDfYgzWfTHDOxamtX1bE/zo104Dh9e6fqJ3PooipYyfJ0pUmrZO2wAvO8YbEyeFrkV91XTsGMSrw==}
     dev: false
 
-  /superagent@8.1.2:
-    resolution: {integrity: sha512-6WTxW1EB6yCxV5VFOIPQruWGHqc3yI7hEmZK6h+pyk69Lk/Ut7rLUY6W/ONF2MjBuGjvmMiIpsrVJ2vjrHlslA==}
-    engines: {node: '>=6.4.0 <13 || >=14'}
-    deprecated: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight. This project is supported and maintained by the team at Forward Email @ https://forwardemail.net
+  /superagent@9.0.1:
+    resolution: {integrity: sha512-CcRSdb/P2oUVaEpQ87w9Obsl+E9FruRd6b2b7LdiBtJoyMr2DQt7a89anAfiX/EL59j9b2CbRFvf2S91DhuCww==}
+    engines: {node: '>=14.18.0'}
     dependencies:
       component-emitter: 1.3.1
       cookiejar: 2.1.4
@@ -7604,12 +7604,12 @@ packages:
       - supports-color
     dev: true
 
-  /supertest@6.3.3:
-    resolution: {integrity: sha512-EMCG6G8gDu5qEqRQ3JjjPs6+FYT1a7Hv5ApHvtSghmOFJYtsU5S+pSb6Y2EUeCEY3CmEL3mmQ8YWlPOzQomabA==}
-    engines: {node: '>=6.4.0'}
+  /supertest@7.0.0:
+    resolution: {integrity: sha512-qlsr7fIC0lSddmA3tzojvzubYxvlGtzumcdHgPwbFWMISQwL22MhM2Y3LNt+6w9Yyx7559VW5ab70dgphm8qQA==}
+    engines: {node: '>=14.18.0'}
     dependencies:
       methods: 1.1.2
-      superagent: 8.1.2
+      superagent: 9.0.1
     transitivePeerDependencies:
       - supports-color
     dev: true