Possible fix(deps): 3 vulnerable dependencies in gradle.lockfile

[begininvoke]

Spotted what might be an issue in maestro-queue/gradle.lockfile around line 41.

The project is using commons-beanutils version 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a malicious property path to PropertyUtilsBean.getProperty() and read the "declaredClass" property of enum instances, exposing the application's ClassLoader and enabling arbitrary code execution. This constitutes an Improper Access Control issue with HIGH severity.

Something like this might fix it:

*** Begin Patch
*** Update File: maestro-queue/gradle.lockfile
@@
-    commons-beanutils:commons-beanutils:1.9.4
+    commons-beanutils:commons-beanutils:1.11.0
*** End Patch

# Additionally, ensure the build script pulls the updated version:
*** Begin Patch
*** Update File: maestro-queue/build.gradle
@@
-dependencies {
-    implementation "commons-beanutils:commons-beanutils:1.9.4"
-}
+dependencies {
+    // Upgrade to 1.11.0 which disables the unsafe "declaredClass" property by default
+    implementation "commons-beanutils:commons-beanutils:1.11.0"
+}
*** End Patch

For reference: rule CVE-2025-48734. Rated high.

I may be wrong about this one — closing it costs you nothing if so.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.