Currently this has only been addressed for 2.7.x, which is not released yet. It's better to also fix this in 2.6.x due to the severity of the issue.
See https://github.com/spring-projects/spring-boot/issues/30301 and https://issues.apache.org/jira/browse/MDEP-761
Comment From: scottfrederick
Spring Boot will only upgrade to a new patch version of a dependency in a patch release. For Boot 2.6.x we will only upgrade to a Maven Dependency Plugin version 3.2.x.
You can override the version of the Maven Dependency plugin used in your project by setting a maven-dependency-plugin.version property in your Maven or Gradle build file.