[PaulHoule]

The trouble is final is not final in Java, private is not private. I mean you can lock it down but you usually won’t. With reflective access, breaking the rules is one method call away. Common Java libraries such as meta factories (Spring, Guice), serializers (Jackson, GSON) and test frameworks regularly cheated in the JDK 8 era and a lot of us are running with protections for the stdlib turned off.

Normally a JDK 21 would let you get private/final reflective access to your own “module” but not to the stdlib modules but so many libraries want private access to stdlib objects such as all the various date and time objects.

[vips7L]

I haven’t really run into any libraries wanting reflective access at all. All of our applications are on Java 21, except for one that relies on 8 because it uses jdk internals.

What ones have you ran into? Jackson doesn’t even require you to —add-opens on anything.

[deepsun]

Spring, Guice? They need to instantiate classes, and call factory methods.

[vips7L]

Yes and they do that by calling the public constructors, which is permitted by the module system because they are public. There is no cracking into private methods there.