Should we fix the `critical` or `high` issues reported by Dependabot alerts?

There are some critical or high security issues reported in the Dependabot alert.

Should we create PRs by clicking on the Create Security Update button instead of manually?

cc @MisterRaindrop @ostinru

Review the critical and high Dependabot alerts first, then inspect the available Create Security Update workflow. Confirm whether updates should be opened through Dependabot or manually, and use the discussion to define the agreed follow-up; the issue names no files or tests.

Written by the indexing model from the issue text.