PXF 2.0 using Spring-Boot ecosystem component dependencies - Security vulnerability

@tuhaihe Regarding PXF2.0, seems like using Spring Boot 2.5.12 ecosystem framework:

Is PXF built using Spring Boot 2.5.12 ecosystem components?

If yes, can this be patched to latest version (OR) removed, to make it supported by PXF avoiding vulnerabilities ?

I can see multiple Sprin-boot components:

spring-boot-gradle-plugin-2.5.12.jar
spring-boot-starter-web-2.5.12.jar
spring-boot-starter-tomcat-2.5.12.jar
spring-boot-actuator-2.5.12.jar
spring-boot-autoconfigure-2.5.12.jar

Start by locating the dependency declarations for the listed Spring Boot 2.5.12 components, including spring-boot-starter-web, spring-boot-starter-tomcat, spring-boot-actuator, and spring-boot-autoconfigure. Check which versions are supported and affected, then confirm whether the dependencies can be upgraded or removed without breaking PXF.

Written by the indexing model from the issue text.