Fix 7 issues flagged across 7 files

[begininvoke]

A scan flagged a few things in this repository. This changes 7 files — one item each, described below.

1. maestro-queue/gradle.lockfile, around line 41

The project is using commons-beanutils version 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a malicious property path to PropertyUtilsBean.getProperty() and read the "declaredClass" property of enum instances, exposing the application's ClassLoader and enabling arbitrary code execution. This constitutes an Improper Access Control issue with HIGH severity.

Updated vulnerable dependencies: commons-beanutils to 1.11.0, httpcore5 and httpcore5-h2 to 5.4.3.

For reference: rule CVE-2025-48734. Rated high.

2. maestro-engine/gradle.lockfile, around line 42

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a crafted property path to PropertyUtilsBean.getProperty() and read the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a HIGH‑severity issue because it allows remote code execution through uncontrolled input. Upgrading to version 1.11.0 (or later) makes the BeanIntrospector suppress the dangerous property by default, fully mitigating the risk.

Updates three vulnerable dependencies to fixed versions.

For reference: rule CVE-2025-48734. Rated high.

3. gradle.lockfile, around line 22

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply untrusted property paths to BeanUtils' getProperty()/getNestedProperty() methods and read the "declaredClass" property of enum instances, exposing the class loader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) enables a built‑in BeanIntrospector that blocks the dangerous "declaredClass" property by default, mitigating the exploit.

Update three vulnerable dependencies to patched versions.

For reference: rule CVE-2025-48734. Rated high.

4. maestro-http/gradle.lockfile, around line 39

The project depends on Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply malicious property paths to PropertyUtilsBean.getProperty() or getNestedProperty() and read the hidden "declaredClass" property of enum instances, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity issue because it allows remote code execution when untrusted input is used for property access. Upgrading to a version where the protective BeanIntrospector is enabled by default (>= 1.11.0) eliminates the flaw.

Updates three vulnerable dependencies to versions that address reported CVEs.

For reference: rule CVE-2025-48734. Rated high.

5. maestro-signal/gradle.lockfile, around line 42

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can exploit uncontrolled enum property access (e.g., the "declaredClass" property) to obtain the ClassLoader and execute arbitrary code. This is a high‑severity issue because it enables remote code execution. Upgrading to version 1.11.0 (or later) enables a built‑in BeanIntrospector that blocks the dangerous property by default, eliminating the exploit path.

Upgrade vulnerable dependencies to patched versions in gradle.lockfile.

For reference: rule CVE-2025-48734. Rated high.

6. maestro-dsl/gradle.lockfile, around line 33

Improper access control in Apache Commons BeanUtils (CVE-2025-48734) allows an attacker to read the hidden 'declaredClass' property on enum instances via PropertyUtilsBean.getProperty()/getNestedProperty(). By obtaining the enum's ClassLoader, remote code execution is possible. This is a HIGH‑severity issue because many applications use BeanUtils to map external input to objects, potentially exposing the vulnerable getter. The fix is to upgrade to a version where the protective BeanIntrospector is enabled by default (>= 1.11.0).

Updates three vulnerable dependencies to versions that address the reported CVEs, preserving existing usage across the build.

For reference: rule CVE-2025-48734. Rated high.

7. maestro-timetrigger/gradle.lockfile, around line 39

The project pins Apache Commons BeanUtils at version 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a crafted property path to PropertyUtilsBean.getProperty() or getNestedProperty() and read the enum’s ‘declaredClass’ property, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity flaw because it grants remote code execution with minimal effort. Upgrading to the patched version (>= 1.11.0) disables the unsafe property accessor by default and eliminates the exploit vector.

Updates vulnerable dependencies (commons-beanutils, httpcore5, httpcore5-h2) to patched versions, removing reported CVEs.

For reference: rule CVE-2025-48734. Rated high.

Take or leave whichever parts are useful. If this is not the right approach, closing is fine.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.