Fix 6 issues flagged across 6 files

[begininvoke]

A scan flagged a few things in this repository. This changes 6 files — one item each, described below.

1. maestro-common/gradle.lockfile, around line 33

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply crafted property paths to PropertyUtilsBean.getProperty() and retrieve the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) disables the unsafe "declaredClass" introspection by default, eliminating the attack vector.

Upgrade vulnerable dependencies to patched versions as per advisories

For reference: rule CVE-2025-48734. Rated high.

2. maestro-queue/gradle.lockfile, around line 41

The project is using commons-beanutils version 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a malicious property path to PropertyUtilsBean.getProperty() and read the "declaredClass" property of enum instances, exposing the application's ClassLoader and enabling arbitrary code execution. This constitutes an Improper Access Control issue with HIGH severity.

Upgrade vulnerable dependencies to fix CVE-2025-48734 and CVE-2026-54399/54428.

For reference: rule CVE-2025-48734. Rated high.

3. gradle.lockfile, around line 22

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply untrusted property paths to BeanUtils' getProperty()/getNestedProperty() methods and read the "declaredClass" property of enum instances, exposing the class loader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) enables a built‑in BeanIntrospector that blocks the dangerous "declaredClass" property by default, mitigating the exploit.

Updated vulnerable dependencies in gradle.lockfile to patched versions.

For reference: rule CVE-2025-48734. Rated high.

4. maestro-signal/gradle.lockfile, around line 42

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can exploit uncontrolled enum property access (e.g., the "declaredClass" property) to obtain the ClassLoader and execute arbitrary code. This is a high‑severity issue because it enables remote code execution. Upgrading to version 1.11.0 (or later) enables a built‑in BeanIntrospector that blocks the dangerous property by default, eliminating the exploit path.

Update vulnerable dependencies to fixed versions.

For reference: rule CVE-2025-48734. Rated high.

5. maestro-kubernetes/gradle.lockfile, around line 39

CVE‑2025‑48734 is a high‑severity improper access control flaw in Apache Commons BeanUtils ≤ 1.10.x. When an application forwards unchecked property paths to PropertyUtilsBean.getProperty()/getNestedProperty(), an attacker can exploit the enum "declaredClass" property to obtain the class loader and potentially execute arbitrary code. The current project pins Commons BeanUtils at version 1.9.4, leaving it vulnerable. Upgrading to 1.11.0 (or later) enables the safe BeanIntrospector that blocks the dangerous "declaredClass" property by default, eliminating this attack vector.

Updated vulnerable dependencies to fixed versions in gradle.lockfile.

For reference: rule CVE-2025-48734. Rated high.

6. maestro-dsl/gradle.lockfile, around line 33

Improper access control in Apache Commons BeanUtils (CVE-2025-48734) allows an attacker to read the hidden 'declaredClass' property on enum instances via PropertyUtilsBean.getProperty()/getNestedProperty(). By obtaining the enum's ClassLoader, remote code execution is possible. This is a HIGH‑severity issue because many applications use BeanUtils to map external input to objects, potentially exposing the vulnerable getter. The fix is to upgrade to a version where the protective BeanIntrospector is enabled by default (>= 1.11.0).

Updates vulnerable dependencies to patched versions, resolving reported CVEs.

For reference: rule CVE-2025-48734. Rated high.

I may well be missing context here — if the current code is deliberate, feel free to close this.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.