Bump the commons-beanutils for CVE-2025-48734. Since `commons-validator`

hasn't had new release with newer `commons-beanutils` versions, we manually bump it in kafka.

Reviewers: Mickael Maison <mickael.maison@gmail.com>

LICENSE-binary

@@ -206,11 +206,11 @@ This project bundles some components that are also licensed under the Apache
 License Version 2.0:
 
 - caffeine-3.1.1
-- commons-beanutils-1.9.4
+- commons-beanutils-1.11.0
 - commons-collections-3.2.2
 - commons-digester-2.1
 - commons-lang3-3.12.0
-- commons-logging-1.3.2
+- commons-logging-1.3.5
 - commons-validator-1.9.0
 - jackson-annotations-2.16.2
 - jackson-core-2.16.2

build.gradle

@@ -197,6 +197,8 @@ allprojects {
           // ensure we have a single version in the classpath despite transitive dependencies
           libs.scalaLibrary,
           libs.scalaReflect,
+          // Workaround before `commons-validator` has new release. See KAFKA-19359.
+          libs.commonsBeanutils,
           libs.jacksonAnnotations
         )
       }

gradle/dependencies.gradle

@@ -60,6 +60,7 @@ versions += [
   caffeine: "3.1.1",
   bndlib: "7.0.0",
   checkstyle: project.hasProperty('checkstyleVersion') ? checkstyleVersion : "10.20.2",
+  commonsBeanutils: "1.11.0",
   commonsValidator: "1.9.0",
   classgraph: "4.8.173",
   gradle: "8.10.2",
@@ -148,6 +149,7 @@ libs += [
   bndlib:"biz.aQute.bnd:biz.aQute.bndlib:$versions.bndlib",
   caffeine: "com.github.ben-manes.caffeine:caffeine:$versions.caffeine",
   classgraph: "io.github.classgraph:classgraph:$versions.classgraph",
+  commonsBeanutils: "commons-beanutils:commons-beanutils:$versions.commonsBeanutils",
   commonsValidator: "commons-validator:commons-validator:$versions.commonsValidator",
   jacksonAnnotations: "com.fasterxml.jackson.core:jackson-annotations:$versions.jackson",
   jacksonDatabind: "com.fasterxml.jackson.core:jackson-databind:$versions.jackson",