Fix 8 issues flagged across 8 files

[begininvoke]

A scan flagged a few things in this repository. This changes 8 files — one item each, described below.

1. maestro-common/gradle.lockfile, around line 33

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply crafted property paths to PropertyUtilsBean.getProperty() and retrieve the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) disables the unsafe "declaredClass" introspection by default, eliminating the attack vector.

Update three vulnerable dependencies to non‑CVE versions as recommended.

For reference: rule CVE-2025-48734. Rated high.

2. maestro-engine/gradle.lockfile, around line 42

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a crafted property path to PropertyUtilsBean.getProperty() and read the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a HIGH‑severity issue because it allows remote code execution through uncontrolled input. Upgrading to version 1.11.0 (or later) makes the BeanIntrospector suppress the dangerous property by default, fully mitigating the risk.

Updated vulnerable dependencies to versions fixing the reported CVEs: commons-beanutils to 1.11.0, httpcore5 and httpcore5-h2 to 5.4.3.

For reference: rule CVE-2025-48734. Rated high.

3. gradle.lockfile, around line 22

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply untrusted property paths to BeanUtils' getProperty()/getNestedProperty() methods and read the "declaredClass" property of enum instances, exposing the class loader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) enables a built‑in BeanIntrospector that blocks the dangerous "declaredClass" property by default, mitigating the exploit.

Update gradle.lockfile to resolve CVEs for commons-beanutils, httpcore5, and httpcore5-h2.

For reference: rule CVE-2025-48734. Rated high.

4. maestro-http/gradle.lockfile, around line 39

The project depends on Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply malicious property paths to PropertyUtilsBean.getProperty() or getNestedProperty() and read the hidden "declaredClass" property of enum instances, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity issue because it allows remote code execution when untrusted input is used for property access. Upgrading to a version where the protective BeanIntrospector is enabled by default (>= 1.11.0) eliminates the flaw.

Upgrade vulnerable dependencies in the lockfile: commons-beanutils to 1.11.0, httpcore5 and httpcore5-h2 to 5.4.3 to address the reported CVEs while preserving compatibility.

For reference: rule CVE-2025-48734. Rated high.

5. maestro-signal/gradle.lockfile, around line 42

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can exploit uncontrolled enum property access (e.g., the "declaredClass" property) to obtain the ClassLoader and execute arbitrary code. This is a high‑severity issue because it enables remote code execution. Upgrading to version 1.11.0 (or later) enables a built‑in BeanIntrospector that blocks the dangerous property by default, eliminating the exploit path.

Updated three vulnerable dependencies to safe versions: commons-beanutils 1.9.4→1.11.0, httpcore5 and httpcore5-h2 from 5.1.3→5.4.3.

For reference: rule CVE-2025-48734. Rated high.

6. maestro-kubernetes/gradle.lockfile, around line 39

CVE‑2025‑48734 is a high‑severity improper access control flaw in Apache Commons BeanUtils ≤ 1.10.x. When an application forwards unchecked property paths to PropertyUtilsBean.getProperty()/getNestedProperty(), an attacker can exploit the enum "declaredClass" property to obtain the class loader and potentially execute arbitrary code. The current project pins Commons BeanUtils at version 1.9.4, leaving it vulnerable. Upgrading to 1.11.0 (or later) enables the safe BeanIntrospector that blocks the dangerous "declaredClass" property by default, eliminating this attack vector.

Update vulnerable dependencies to patched versions.

For reference: rule CVE-2025-48734. Rated high.

7. maestro-database/gradle.lockfile, around line 44

The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply crafted property paths to PropertyUtilsBean.getProperty() and retrieve the enum's declaredClass, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrade to a version where the protective BeanIntrospector is enabled by default (>= 1.11.0) to mitigate the risk.

Updated three vulnerable dependencies to fixed versions in gradle.lockfile.

For reference: rule CVE-2025-48734. Rated high.

8. maestro-dsl/gradle.lockfile, around line 33

Improper access control in Apache Commons BeanUtils (CVE-2025-48734) allows an attacker to read the hidden 'declaredClass' property on enum instances via PropertyUtilsBean.getProperty()/getNestedProperty(). By obtaining the enum's ClassLoader, remote code execution is possible. This is a HIGH‑severity issue because many applications use BeanUtils to map external input to objects, potentially exposing the vulnerable getter. The fix is to upgrade to a version where the protective BeanIntrospector is enabled by default (>= 1.11.0).

Upgrade three vulnerable dependencies to patched versions.

For reference: rule CVE-2025-48734. Rated high.

I may well be missing context here — if the current code is deliberate, feel free to close this.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.