Currently this has only been addressed for 2.7.x, which is not released yet. It's better to also fix this in 2.6.x due to the severity of the issue.

See https://github.com/spring-projects/spring-boot/issues/30301 and https://issues.apache.org/jira/browse/MDEP-761

Comment From: scottfrederick

Spring Boot will only upgrade to a new patch version of a dependency in a patch release. For Boot 2.6.x we will only upgrade to a Maven Dependency Plugin version 3.2.x.

You can override the version of the Maven Dependency plugin used in your project by setting a maven-dependency-plugin.version property in your Maven or Gradle build file.