Fix 10 issues flagged across 10 files

[begininvoke]

A scan flagged a few things in this repository. This changes 10 files — one item each, described below.

1. maestro-common/gradle.lockfile, around line 33

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply crafted property paths to PropertyUtilsBean.getProperty() and retrieve the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) disables the unsafe "declaredClass" introspection by default, eliminating the attack vector.

Upgrade vulnerable dependencies to resolved versions: commons-beanutils to 1.11.0, httpcore5 and httpcore5-h2 to 5.4.3.

For reference: rule CVE-2025-48734. Rated high.

2. maestro-queue/gradle.lockfile, around line 41

The project is using commons-beanutils version 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a malicious property path to PropertyUtilsBean.getProperty() and read the "declaredClass" property of enum instances, exposing the application's ClassLoader and enabling arbitrary code execution. This constitutes an Improper Access Control issue with HIGH severity.

Updated vulnerable dependencies to patched versions (commons-beanutils 1.11.0, httpcore5 and httpcore5-h2 5.4.3).

For reference: rule CVE-2025-48734. Rated high.

3. maestro-engine/gradle.lockfile, around line 42

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a crafted property path to PropertyUtilsBean.getProperty() and read the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a HIGH‑severity issue because it allows remote code execution through uncontrolled input. Upgrading to version 1.11.0 (or later) makes the BeanIntrospector suppress the dangerous property by default, fully mitigating the risk.

Update vulnerable dependencies in gradle.lockfile: commons-beanutils to 1.11.0, httpcore5 and httpcore5-h2 to 5.4.3.

For reference: rule CVE-2025-48734. Rated high.

4. gradle.lockfile, around line 22

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply untrusted property paths to BeanUtils' getProperty()/getNestedProperty() methods and read the "declaredClass" property of enum instances, exposing the class loader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) enables a built‑in BeanIntrospector that blocks the dangerous "declaredClass" property by default, mitigating the exploit.

Updated three vulnerable dependencies to fixed versions, preserving lock file format.

For reference: rule CVE-2025-48734. Rated high.

5. maestro-http/gradle.lockfile, around line 39

The project depends on Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply malicious property paths to PropertyUtilsBean.getProperty() or getNestedProperty() and read the hidden "declaredClass" property of enum instances, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity issue because it allows remote code execution when untrusted input is used for property access. Upgrading to a version where the protective BeanIntrospector is enabled by default (>= 1.11.0) eliminates the flaw.

Update three vulnerable dependencies to their fixed versions per CVE advisories.

For reference: rule CVE-2025-48734. Rated high.

6. maestro-signal/gradle.lockfile, around line 42

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can exploit uncontrolled enum property access (e.g., the "declaredClass" property) to obtain the ClassLoader and execute arbitrary code. This is a high‑severity issue because it enables remote code execution. Upgrading to version 1.11.0 (or later) enables a built‑in BeanIntrospector that blocks the dangerous property by default, eliminating the exploit path.

Update three vulnerable dependencies to patched versions to address CVEs: commons-beanutils to 1.11.0, httpcore5 and httpcore5-h2 to 5.4.3.

For reference: rule CVE-2025-48734. Rated high.

7. maestro-kubernetes/gradle.lockfile, around line 39

CVE‑2025‑48734 is a high‑severity improper access control flaw in Apache Commons BeanUtils ≤ 1.10.x. When an application forwards unchecked property paths to PropertyUtilsBean.getProperty()/getNestedProperty(), an attacker can exploit the enum "declaredClass" property to obtain the class loader and potentially execute arbitrary code. The current project pins Commons BeanUtils at version 1.9.4, leaving it vulnerable. Upgrading to 1.11.0 (or later) enables the safe BeanIntrospector that blocks the dangerous "declaredClass" property by default, eliminating this attack vector.

Update vulnerable dependencies to versions with CVE fixes.

For reference: rule CVE-2025-48734. Rated high.

8. maestro-database/gradle.lockfile, around line 44

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply crafted property paths to PropertyUtilsBean.getProperty() and retrieve the enum's declaredClass, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrade to a version where the protective BeanIntrospector is enabled by default (>= 1.11.0) to mitigate the risk.

Upgrade vulnerable dependencies to latest stable versions to resolve reported CVEs.

For reference: rule CVE-2025-48734. Rated high.

9. maestro-dsl/gradle.lockfile, around line 33

Improper access control in Apache Commons BeanUtils (CVE-2025-48734) allows an attacker to read the hidden 'declaredClass' property on enum instances via PropertyUtilsBean.getProperty()/getNestedProperty(). By obtaining the enum's ClassLoader, remote code execution is possible. This is a HIGH‑severity issue because many applications use BeanUtils to map external input to objects, potentially exposing the vulnerable getter. The fix is to upgrade to a version where the protective BeanIntrospector is enabled by default (>= 1.11.0).

Upgrade vulnerable dependencies to versions that address reported CVEs.

For reference: rule CVE-2025-48734. Rated high.

10. maestro-timetrigger/gradle.lockfile, around line 39

The project pins Apache Commons BeanUtils at version 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a crafted property path to PropertyUtilsBean.getProperty() or getNestedProperty() and read the enum’s ‘declaredClass’ property, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity flaw because it grants remote code execution with minimal effort. Upgrading to the patched version (>= 1.11.0) disables the unsafe property accessor by default and eliminates the exploit vector.

Updates vulnerable dependencies to fixed versions.

For reference: rule CVE-2025-48734. Rated high.

I may well be missing context here — if the current code is deliberate, feel free to close this.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.