diff --git a/api.planx.uk/package.json b/api.planx.uk/package.json
index b83fd9feb2..47e2af7eda 100644
--- a/api.planx.uk/package.json
+++ b/api.planx.uk/package.json
@@ -9,7 +9,7 @@
     "axios": "^0.27.2",
     "body-parser": "^1.20.0",
     "cookie-parser": "^1.4.6",
-    "cookie-session": "^1.4.0",
+    "cookie-session": "^2.0.0",
     "cors": "^2.8.5",
     "csv-stringify": "^5.6.5",
     "date-fns": "^2.29.1",
@@ -26,7 +26,7 @@
     "mime": "^2.6.0",
     "nanoid": "^3.3.4",
     "notifications-node-client": "^5.1.1",
-    "passport": "^0.6.0",
+    "passport": "^0.5.3",
     "passport-google-oauth20": "^2.0.0",
     "pino-noir": "^2.2.1",
     "string-to-stream": "^3.0.1"
diff --git a/api.planx.uk/pnpm-lock.yaml b/api.planx.uk/pnpm-lock.yaml
index e8a74ace59..55bb3374ec 100644
--- a/api.planx.uk/pnpm-lock.yaml
+++ b/api.planx.uk/pnpm-lock.yaml
@@ -7,7 +7,7 @@ specifiers:
   axios: ^0.27.2
   body-parser: ^1.20.0
   cookie-parser: ^1.4.6
-  cookie-session: ^1.4.0
+  cookie-session: ^2.0.0
   cors: ^2.8.5
   csv-stringify: ^5.6.5
   date-fns: ^2.29.1
@@ -32,7 +32,7 @@ specifiers:
   nock: ^13.2.9
   node-dev: ^5.0.0
   notifications-node-client: ^5.1.1
-  passport: ^0.6.0
+  passport: ^0.5.3
   passport-google-oauth20: ^2.0.0
   pino-noir: ^2.2.1
   prettier: ~2.7.1
@@ -46,7 +46,7 @@ dependencies:
   axios: 0.27.2
   body-parser: 1.20.0
   cookie-parser: 1.4.6
-  cookie-session: 1.4.0
+  cookie-session: 2.0.0
   cors: 2.8.5
   csv-stringify: 5.6.5
   date-fns: 2.29.1
@@ -63,7 +63,7 @@ dependencies:
   mime: 2.6.0
   nanoid: 3.3.4
   notifications-node-client: 5.1.1
-  passport: 0.6.0
+  passport: 0.5.3
   passport-google-oauth20: 2.0.0
   pino-noir: 2.2.1
   string-to-stream: 3.0.1
@@ -133,7 +133,7 @@ packages:
       '@babel/traverse': 7.15.0
       '@babel/types': 7.15.0
       convert-source-map: 1.8.0
-      debug: 4.3.2
+      debug: 4.3.4
       gensync: 1.0.0-beta.2
       json5: 2.2.0
       semver: 6.3.0
@@ -437,7 +437,7 @@ packages:
       '@babel/helper-split-export-declaration': 7.14.5
       '@babel/parser': 7.15.3
       '@babel/types': 7.15.0
-      debug: 4.3.2
+      debug: 4.3.4
       globals: 11.12.0
     transitivePeerDependencies:
       - supports-color
@@ -1357,12 +1357,14 @@ packages:
       cookie-signature: 1.0.6
     dev: false
 
-  /cookie-session/1.4.0:
-    resolution: {integrity: sha512-0hhwD+BUIwMXQraiZP/J7VP2YFzqo6g4WqZlWHtEHQ22t0MeZZrNBSCxC1zcaLAs8ApT3BzAKizx9gW/AP9vNA==}
+  /cookie-session/2.0.0:
+    resolution: {integrity: sha512-hKvgoThbw00zQOleSlUr2qpvuNweoqBtxrmx0UFosx6AGi9lYtLoA+RbsvknrEX8Pr6MDbdWAb2j6SnMn+lPsg==}
+    engines: {node: '>= 0.10'}
     dependencies:
       cookies: 0.8.0
-      debug: 2.6.9
+      debug: 3.2.7
       on-headers: 1.0.2
+      safe-buffer: 5.2.1
     transitivePeerDependencies:
       - supports-color
     dev: false
@@ -1485,6 +1487,17 @@ packages:
     dependencies:
       ms: 2.0.0
 
+  /debug/3.2.7:
+    resolution: {integrity: sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+    dependencies:
+      ms: 2.1.3
+    dev: false
+
   /debug/4.3.2:
     resolution: {integrity: sha512-mOp8wKcvj7XxC78zLgw/ZA+6TSgkoE2C/ienthhRD298T7UNwAg9diBpLRxC0mOezLl4B0xV7M0cCO6P/O0Xhw==}
     engines: {node: '>=6.0'}
@@ -4161,13 +4174,12 @@ packages:
     engines: {node: '>= 0.4.0'}
     dev: false
 
-  /passport/0.6.0:
-    resolution: {integrity: sha512-0fe+p3ZnrWRW74fe8+SvCyf4a3Pb2/h7gFkQ8yTJpAO50gDzlfjZUZTO1k5Eg9kUct22OxHLqDZoKUWRHOh9ug==}
+  /passport/0.5.3:
+    resolution: {integrity: sha512-gGc+70h4gGdBWNsR3FuV3byLDY6KBTJAIExGFXTpQaYfbbcHCBlRRKx7RBQSpqEqc5Hh2qVzRs7ssvSfOpkUEA==}
     engines: {node: '>= 0.4.0'}
     dependencies:
       passport-strategy: 1.0.0
       pause: 0.0.1
-      utils-merge: 1.0.1
     dev: false
 
   /path-exists/4.0.0: