Should we fix the `critical` or `high` issues reported by Dependabot alerts?

[tuhaihe]

There are some critical or high security issues reported in the Dependabot alert.

Should we create PRs by clicking on the Create Security Update button instead of manually?

cc @MisterRaindrop @ostinru

[tuhaihe]

• Bump golang.org/x/crypto from 0.21.0 to 0.52.0 in /cli #137: 184 alerts ~> 165 alerts
• Bump org.apache.tomcat.embed:tomcat-embed-core from 9.0.117 to 9.0.118 in /server #138

[ostinru]

I don't see urgency here. PXF is running near database, listening localhost. It is hard to exploit all this 195 issues. Most of them will require upgrading Spring & Hadoop libs - this cannot be done by dependabot and it is part of PXF 3.x milestone. So, I'd like to postpone enabling dependabot.