Fix 5 issues flagged across 5 files

[begininvoke]

A scan flagged a few things in this repository. This changes 5 files — one item each, described below.

1. maestro-common/gradle.lockfile, around line 33

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply crafted property paths to PropertyUtilsBean.getProperty() and retrieve the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) disables the unsafe "declaredClass" introspection by default, eliminating the attack vector.

Updated vulnerable dependencies to patched versions per CVE advisories.

For reference: rule CVE-2025-48734. Rated high.

2. maestro-queue/gradle.lockfile, around line 41

The project is using commons-beanutils version 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a malicious property path to PropertyUtilsBean.getProperty() and read the "declaredClass" property of enum instances, exposing the application's ClassLoader and enabling arbitrary code execution. This constitutes an Improper Access Control issue with HIGH severity.

Updates three vulnerable dependencies to fixed versions, preserving existing usage configurations.

For reference: rule CVE-2025-48734. Rated high.

3. maestro-engine/gradle.lockfile, around line 42

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a crafted property path to PropertyUtilsBean.getProperty() and read the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a HIGH‑severity issue because it allows remote code execution through uncontrolled input. Upgrading to version 1.11.0 (or later) makes the BeanIntrospector suppress the dangerous property by default, fully mitigating the risk.

Update vulnerable dependencies to fixed versions per CVE advisories.

For reference: rule CVE-2025-48734. Rated high.

4. gradle.lockfile, around line 22

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply untrusted property paths to BeanUtils' getProperty()/getNestedProperty() methods and read the "declaredClass" property of enum instances, exposing the class loader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) enables a built‑in BeanIntrospector that blocks the dangerous "declaredClass" property by default, mitigating the exploit.

Updated vulnerable dependencies to their fixed versions in gradle.lockfile.

For reference: rule CVE-2025-48734. Rated high.

5. maestro-kubernetes/gradle.lockfile, around line 39

CVE‑2025‑48734 is a high‑severity improper access control flaw in Apache Commons BeanUtils ≤ 1.10.x. When an application forwards unchecked property paths to PropertyUtilsBean.getProperty()/getNestedProperty(), an attacker can exploit the enum "declaredClass" property to obtain the class loader and potentially execute arbitrary code. The current project pins Commons BeanUtils at version 1.9.4, leaving it vulnerable. Upgrading to 1.11.0 (or later) enables the safe BeanIntrospector that blocks the dangerous "declaredClass" property by default, eliminating this attack vector.

Updates three vulnerable dependencies to patched versions: commons-beanutils to 1.11.0, httpcore5 and httpcore5-h2 to 5.4.3, eliminating the reported CVEs.

For reference: rule CVE-2025-48734. Rated high.

I may well be missing context here — if the current code is deliberate, feel free to close this.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.