Annotations & Reflection

An annotation is typed metadata attached to a program element (class, method, field, parameter, type use, package, module). It has no behaviour by itself; a compiler, tool or runtime library reads it and acts.

• Compile time: @Override, @FunctionalInterface are checked by javac.
• Source time: annotation processors generate code (Lombok, MapStruct, Dagger).
• Runtime: frameworks read them reflectively (Spring, JPA, JUnit).

@Override, @Deprecated, @SuppressWarnings, @FunctionalInterface and @SafeVarargs are the core ones in java.lang.

• @Override: compile error if the method does not override or implement a supertype method.
• @Deprecated(since="9", forRemoval=true): forRemoval produces a stronger warning.
• @SuppressWarnings("unchecked"): silences named compiler lints, keep the scope narrow.
• @FunctionalInterface: compile error if the interface has other than one abstract method.
• @SafeVarargs: asserts a generic varargs method is heap-pollution safe.

Use @interface. Members are declared like abstract methods without parameters, may have default values, and are limited to primitives, String, Class, enums, annotations and one-dimensional arrays of those.

import java.lang.annotation.*;

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface Timed {
    String name() default "";
    long warnAboveMs() default 500;
}

@Retention decides how long an annotation survives. SOURCE is discarded by the compiler, CLASS (the default) is written to the .class file but not available through reflection, RUNTIME is kept in the class file and visible via reflection.

• @Override is SOURCE; Spring's @Component is RUNTIME.
• CLASS is useful for bytecode tools (e.g. some static analyzers, ASM-based agents).

@Target restricts where an annotation may be applied. Values include TYPE, FIELD, METHOD, PARAMETER, CONSTRUCTOR, LOCAL_VARIABLE, ANNOTATION_TYPE, PACKAGE, TYPE_PARAMETER, TYPE_USE, MODULE, RECORD_COMPONENT.

• Without @Target, an annotation applies to all declaration contexts (type-use contexts included since Java 14).
• TYPE_USE allows List<@NonNull String> and casts.
• Misplacing it is a compile error.

Meta-annotations are annotations applied to annotation declarations: @Retention, @Target, @Documented, @Inherited, @Repeatable.

• @Documented includes the annotation in Javadoc.
• @Inherited lets a class annotation be inherited by subclasses.
• @Repeatable allows the same annotation more than once via a container annotation.

If a runtime annotation is meta-annotated @Inherited and placed on a class, Class.getAnnotation on a subclass finds it by walking up the superclass chain. It does not apply to methods, fields, interfaces or interface implementations.

• getDeclaredAnnotations never includes inherited ones; getAnnotations does.
• Spring's AnnotatedElementUtils/MergedAnnotations search interfaces and methods as well, which core reflection does not.

Java 8 added @Repeatable(Container.class). The compiler wraps repeated annotations into the container annotation, whose value() returns an array of the repeatable type.

@Retention(RetentionPolicy.RUNTIME) @Repeatable(Roles.class)
@interface Role { String value(); }
@Retention(RetentionPolicy.RUNTIME)
@interface Roles { Role[] value(); }

@Role("admin") @Role("auditor")
class Report {}
// Report.class.getAnnotationsByType(Role.class).length == 2
// Report.class.getAnnotation(Role.class) == null (they live in @Roles)

AnnotatedElement (implemented by Class, Method, Field, Constructor, Parameter) offers isAnnotationPresent, getAnnotation, getAnnotations, getDeclaredAnnotations and getAnnotationsByType.

Method m = Service.class.getMethod("run");
Timed t = m.getAnnotation(Timed.class);
if (t != null) System.out.println(t.name() + " " + t.warnAboveMs());

• The returned object is a JDK-generated dynamic proxy implementing the annotation interface.
• Parameter names are only real if compiled with -parameters.

Values must be compile-time constants: literals, constant expressions, Class literals, enum constants, nested annotations, or arrays of these. A single-element value can be written without its name.

• @SuppressWarnings("x") is shorthand for @SuppressWarnings(value = "x").
• Single-element arrays can omit braces: @Target(ElementType.FIELD).
• static final String constants are fine, but a non-constant (System.getenv()) is not.

javac discovers Processor implementations (via META-INF/services/javax.annotation.processing.Processor or --processor-path) and runs them in rounds. Each round the processor sees elements annotated with its supported annotations and may generate new source or class files, which trigger further rounds until no new files appear.

• Processors read the model through javax.lang.model (Element, TypeMirror), not reflection, because classes are not loaded yet.
• Generate files with Filer; report problems with Messager.
• It runs at build time, so there is no runtime cost.

Lombok registers as an annotation processor but, instead of only generating new files, it hooks into javac's (or ECJ's) internal AST and mutates the parsed tree of your class to add getters, constructors, equals, builders and so on before bytecode generation.

• It relies on non-public compiler internals, so each new JDK often needs a Lombok upgrade.
• IDEs need a plugin because they use their own compiler front ends.
• delombok produces plain Java if you need to drop it.

Generated equals/hashCode/toString can be dangerous on JPA entities, and some annotations hide design problems.

• @Data on an entity includes lazy collections in toString, triggering lazy loading or LazyInitializationException.
• @EqualsAndHashCode on all fields breaks when a mutable or generated ID field changes in a HashSet.
• @Builder ignores field initializers unless @Builder.Default is used.
• @AllArgsConstructor order depends on field order; reordering fields silently changes the constructor.

Class<T> is the runtime representation of a loaded type and the entry point of reflection. One Class object exists per class per classloader.

• Foo.class literal (no initialization triggered).
• obj.getClass() (runtime type).
• Class.forName("pkg.Foo") (loads and initializes by default).
• classLoader.loadClass("pkg.Foo") (does not initialize).

getMethods() returns all public methods including inherited ones (from superclasses and interfaces). getDeclaredMethods() returns all methods declared in that class only, regardless of visibility, excluding inherited ones.

• The same pair exists for Field and Constructor (constructors are never inherited, so getConstructors is public only).
• Order of the returned arrays is not guaranteed.
• To find a private inherited method, walk getSuperclass() with getDeclaredMethods.

Get a Constructor via getDeclaredConstructor(paramTypes) and call newInstance(args); get a Method via getMethod(name, paramTypes) and call invoke(target, args).

Class<?> c = Class.forName("java.lang.StringBuilder");
Object sb = c.getDeclaredConstructor(String.class).newInstance("ab");
Method append = c.getMethod("append", String.class);
append.invoke(sb, "cd");
System.out.println(sb); // abcd

• Class.newInstance() is deprecated since Java 9 because it propagates checked exceptions unchecked.

Field f = cls.getDeclaredField("name"); f.setAccessible(true); f.get(obj); f.set(obj, value);. Without setAccessible(true), access to a private field throws IllegalAccessException.

• getInt/setInt variants avoid boxing.
• Static fields take null as the instance.
• static final fields cannot be set (throws), instance final fields can be set after setAccessible(true) but the JIT may have inlined them.

setAccessible(true) suppresses Java access checks for that reflective object. Since Java 9, it also requires that the target package be open to the caller's module, otherwise it throws InaccessibleObjectException.

• Packages are open if declared with opens pkg or opens pkg to module in module-info.java, or if the module is open module.
• JDK internals: Java 9-15 default --illegal-access=permit warned; Java 16 default deny; Java 17 removed the flag. Use --add-opens java.base/java.lang=ALL-UNNAMED as workaround.
• exports allows compile-time public access but not deep reflection on private members.

Reflective calls skip static linking and JIT inlining opportunities, box primitives, allocate varargs arrays, check access and wrap exceptions. Typically 2-10x slower than a direct call in a warm hot loop, but lookup (getMethod) is the larger cost.

• Cache Method/Field objects; getDeclaredMethods copies arrays each call (although a root cache exists).
• JDK 18+ (JEP 416) reimplemented core reflection on method handles; old native accessor "inflation" after 15 calls is gone.
• Microbenchmark with JMH, not with System.nanoTime loops.

java.lang.invoke.MethodHandle is a typed, directly executable reference to a method, field or constructor. Access is checked once at lookup (using the caller's Lookup), and after that the JIT can inline it when the handle is a static final constant.

MethodHandles.Lookup lk = MethodHandles.lookup();
MethodHandle h = lk.findVirtual(String.class, "length",
        MethodType.methodType(int.class));
int n = (int) h.invokeExact("hello"); // 5

• invokeExact needs the exact call-site signature, otherwise WrongMethodTypeException; invoke adapts.
• Handles power lambdas (LambdaMetafactory), string concat and invokedynamic.

VarHandle (Java 9) is a typed reference to a variable (field, array element) with fine-grained memory-order access modes (plain, opaque, acquire/release, volatile) and atomic operations like compareAndSet. It replaces most sun.misc.Unsafe usage.

• Obtained with MethodHandles.lookup().findVarHandle(Cls.class, "field", int.class).
• Used in ConcurrentHashMap, AtomicReference, and lock-free structures.

java.lang.reflect.Proxy.newProxyInstance(loader, interfaces, handler) generates a class at runtime implementing the given interfaces; every call is routed to InvocationHandler.invoke(proxy, method, args).

interface Greeter { String hi(String n); }
Greeter g = (Greeter) Proxy.newProxyInstance(
    Greeter.class.getClassLoader(), new Class<?>[]{Greeter.class},
    (p, m, a) -> "proxied " + m.getName() + " " + a[0]);
System.out.println(g.hi("x")); // proxied hi x

JDK proxies implement interfaces and delegate to an InvocationHandler. CGLIB (and ByteBuddy) generate a subclass of the target class at runtime and override its methods, so they work without interfaces.

• CGLIB cannot proxy final classes or override final/private/static methods.
• Needs an accessible (or Objenesis-bypassed) constructor; Spring uses Objenesis so no default constructor is needed.
• Spring Boot 2.0+ defaults to CGLIB (proxyTargetClass=true) even if interfaces exist.
• Spring 6 repackages CGLIB inside spring-core; the original library is unmaintained.

They are bytecode libraries. ASM is a low-level visitor API; Javassist offers source-like editing; ByteBuddy has a fluent, type-safe API. Hibernate (proxies, enhancement), Mockito, and Spring use them to generate classes at runtime or build time.

• Java 8 lambdas themselves are spun by LambdaMetafactory/invokedynamic, not by these tools.
• Java agents (-javaagent) can transform classes on load via Instrumentation.
• Newer JDKs need updated ASM to read new class file versions.

Type erasure removes type arguments from instances (List<String> and List<Integer> share one class), but signatures of declarations are kept in the Signature attribute: field types, method parameter/return types, and superclass/interface declarations.

class Repo extends Base<User> {}
Type t = Repo.class.getGenericSuperclass();
Type arg = ((ParameterizedType) t).getActualTypeArguments()[0];
System.out.println(arg); // class User

• Field.getGenericType(), Method.getGenericReturnType() give ParameterizedType.
• Local variables and new ArrayList<String>() instance type arguments are not retrievable.

Create an anonymous subclass of a generic class so the actual type argument is recorded in its superclass signature, then read it with getGenericSuperclass(). Gson's TypeToken, Jackson's TypeReference and Spring's ParameterizedTypeReference use this trick.

abstract class Token<T> {
    final Type type = ((ParameterizedType)
        getClass().getGenericSuperclass()).getActualTypeArguments()[0];
}
Type t = new Token<List<String>>() {}.type;
System.out.println(t); // java.util.List<java.lang.String>

• The braces {} are essential; without them the subclass does not exist.

Spring scans the classpath for classes carrying stereotype annotations (@Component and its meta-annotated children), but reads class files with ASM (MetadataReader) rather than loading them. It then registers BeanDefinitions, instantiates beans through constructors (reflection), and injects dependencies into fields, setters and constructor parameters.

• @Service, @Repository, @Controller are meta-annotated with @Component.
• AutowiredAnnotationBeanPostProcessor handles @Autowired/@Value/@Inject.
• @Configuration classes are CGLIB-subclassed so @Bean methods return singletons.

Spring treats an annotation placed on another annotation as a meta-annotation and can synthesize attribute overrides with @AliasFor. This lets you build custom stereotypes like @RestController = @Controller + @ResponseBody.

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.TYPE)
@Service
@Transactional(readOnly = true)
public @interface ReadService {}

• JDK reflection cannot read @Service through @ReadService; Spring's MergedAnnotations can.

A BeanPostProcessor (AbstractAutoProxyCreator) wraps beans that match an advisor into a JDK or CGLIB proxy. The proxy's interceptor (TransactionInterceptor) reads @Transactional via reflection on the target method, begins a transaction, calls the target, then commits or rolls back.

• Only calls going through the proxy are advised; this.method() self-invocation bypasses it.
• By default only public methods (for proxy-based AOP) and RuntimeException/Error trigger rollback.
• AspectJ weaving avoids the proxy limits.

Hibernate reads @Entity, @Id, @Column, associations etc. to build mapping metadata. It instantiates entities through a no-arg constructor (any visibility, via reflection) and reads/writes state through fields or getters depending on where @Id is placed (access type).

• Lazy @ManyToOne/getReference return a ByteBuddy subclass proxy of the entity.
• This is why entities should be non-final with a no-arg constructor (at least protected).
• Bytecode enhancement can add dirty tracking and lazy attributes at build time.

JUnit 5 discovers classes and methods annotated with @Test, @ParameterizedTest, @BeforeEach etc. through reflection, creates a test-class instance (by default one per test method), and invokes the methods, resolving parameters through ParameterResolver extensions.

• Test methods and classes can be package-private; JUnit calls setAccessible.
• @ExtendWith registers extensions; @Tag, @Disabled and @Nested shape discovery.
• Composed annotations are supported (meta-annotations).

After instantiation, AutowiredAnnotationBeanPostProcessor inspects the class (and superclasses) for @Autowired fields and methods, resolves each dependency from the container, then calls field.setAccessible(true) and field.set(bean, dep).

• No constructor or setter participates, so the object can exist in an invalid state when created outside Spring.
• Fields cannot be final.
• Constructor injection is preferred: immutability, explicit dependencies, easy plain-Java tests.

Class.forName(name) loads, links and initializes the class using the caller's classloader, running static initializers. ClassLoader.loadClass(name) only loads it; initialization is deferred until first active use.

• Class.forName(name, false, loader) loads without initialization.
• Old JDBC code used Class.forName("com.mysql.Driver") to trigger driver registration in a static block; with ServiceLoader (JDBC 4) it is no longer needed.

ServiceLoader discovers implementations of an interface listed in META-INF/services/<fqcn> (or provides ... with in module-info) and instantiates them reflectively. It is the standard plugin mechanism and the usual target output of an annotation processor like AutoService.

• Instantiation is lazy and iterates providers.
• Providers need a public no-arg constructor or a public static provider() method (modules).

Records expose Class.isRecord() and getRecordComponents() giving name, type, generic type, accessor and annotations of each component. Enum constants are available via getEnumConstants(), and enums cannot be instantiated reflectively (newInstance throws IllegalArgumentException).

• Record fields are private final; reflection Field.set fails even with setAccessible.
• Annotations on a record component propagate to field, accessor, constructor parameter and/or record component depending on the annotation's @Target.

Java deserialization (ObjectInputStream) reconstructs objects and invokes readObject hooks reflectively without calling constructors of serializable classes. Gadget chains in libraries can reach Method.invoke and give remote code execution.

• Avoid native serialization of untrusted input; use ObjectInputFilter (JEP 290, JEP 415 context filters) with allow-lists.
• Jackson default typing (enableDefaultTyping) has similar polymorphic gadget risks; use PolymorphicTypeValidator.
• Prefer JSON/Protobuf with explicit schemas.

Historically the SecurityManager checked ReflectPermission("suppressAccessChecks") before setAccessible. The SecurityManager is deprecated for removal (Java 17) and effectively disabled in Java 24 (JEP 486). Today, the real controls are module encapsulation (opens), strong encapsulation of JDK internals, and review of reflective sinks.

• Treat any Class.forName, Method.invoke or getMethod driven by user input as a vulnerability (reflection injection).
• Use allow-lists mapping names to handlers instead of reflective dispatch.
• Sealed classes and final prevent unexpected subclassing but not reflection.

sun.misc.Unsafe gives raw memory access, CAS and uninitialized object allocation. It is not an official API and is being phased out (JEP 471/498 deprecate its memory-access methods for removal).

• VarHandle replaces field CAS and ordered access.
• MemorySegment (Foreign Function & Memory API, final in Java 22) replaces off-heap access.
• Serialization libraries used Unsafe.allocateInstance to skip constructors; Spring/Objenesis do this too.

Native image performs closed-world static analysis at build time; code reachable only through reflection is invisible and removed unless declared. You must supply configuration listing classes, methods and fields that need reflective access.

• Config lives in META-INF/native-image/<group>/<artifact>/reachability-metadata.json (older: reflect-config.json, proxy-config.json, resource-config.json, serialization-config.json, jni-config.json).
• Generate with the tracing agent: java -agentlib:native-image-agent=config-output-dir=... -jar app.jar.
• Spring uses @RegisterReflectionForBinding, @ImportRuntimeHints and AOT processing; Quarkus uses @RegisterForReflection.
• The GraalVM Reachability Metadata Repository supplies configs for common libraries.

Spring 6 / Boot 3 can run an AOT phase at build time that evaluates conditions and generates Java source for bean definitions and registration code, plus runtime hints for the remaining reflection, proxies and resources. This enables native image and faster JVM startup.

• Profiles and @Conditional outcomes are fixed at build time.
• Hints come from RuntimeHintsRegistrar, @RegisterReflectionForBinding, and built-in contributors.
• Proxies of configuration classes are generated at build time, not at runtime.

Class-level lookup honours @Inherited through superclasses. Method-level lookup never inherits: if a subclass overrides save(), getMethod("save").getAnnotation(...) shows only annotations declared on the overriding method.

• Frameworks reimplement search: Spring's AnnotationUtils.findAnnotation(method, type) checks superclasses, interfaces, and bridge methods.
• Parameter annotations are likewise not inherited.

For generics and covariant returns, the compiler creates synthetic bridge methods with the erased signature that delegate to the real method. Reflection (getDeclaredMethods) shows both.

class Box implements Comparable<Box> {
    public int compareTo(Box o) { return 0; }
    // compiler adds: public int compareTo(Object o) { return compareTo((Box) o); }
}

• Frameworks scanning annotated methods must skip bridges (Method.isBridge()) or they find duplicates.
• Annotations were not copied to bridge methods before Java 8 (javac 8 copies them), a known source of bugs.

By default javac does not retain parameter names, so Parameter.getName() returns arg0, arg1. Compile with -parameters to store them (Parameter.isNamePresent() becomes true). Spring Boot's Maven/Gradle plugins enable this flag by default.

• Debug info (-g) stores local variable names, which Spring's LocalVariableTableParameterNameDiscoverer used; removed in Spring 6.1.
• Record components always keep names.

For a nested class Outer.Inner in package p: getName() is p.Outer$Inner, getSimpleName() is Inner, getCanonicalName() is p.Outer.Inner, getTypeName() is like getName except arrays print as p.Outer$Inner[].

• Arrays: int[].class.getName() is [I, String[].class.getName() is [Ljava.lang.String;.
• Anonymous classes: simple name is empty, canonical name is null.

A default method is found through getMethod and invoked normally on an implementing instance. Invoking the default implementation from within a JDK proxy handler needs InvocationHandler.invokeDefault(proxy, method, args) (Java 16+). Before, you needed MethodHandles.privateLookupIn hacks.

InvocationHandler h = (p, m, a) -> m.isDefault()
        ? InvocationHandler.invokeDefault(p, m, a) : null;

• This is how Spring Data repository proxies and Feign support default methods.

Annotation processing generates code at compile time (zero reflection cost, errors reported at build, native-image friendly) but needs build tooling and cannot see runtime state. Reflection is flexible and needs no build step but is slower, bypassed by obfuscation, and hostile to AOT.

• Dagger, MapStruct, Micronaut, Quarkus (build-time) prefer processing/augmentation.
• Spring historically chose runtime reflection; Spring 6 AOT narrows the gap.
• Choose generation when startup, native image or compile-time safety matters.

AnnotationParser creates a JDK proxy with an AnnotationInvocationHandler holding a map of member values. equals compares member values with another annotation of the same type, hashCode is the sum of (127 * name.hashCode()) ^ valueHash, and toString renders @pkg.Timed(name="", warnAboveMs=500).

• Calling a member method is a map lookup; array members return a clone every call.
• Instances are cached per element, so repeated getAnnotation is cheap after the first parse.

Constraint annotations like @NotNull, @Size, @Email are meta-annotated with @Constraint(validatedBy = X.class). The validator (Hibernate Validator) reads them reflectively from fields, getters, parameters and type-use positions, instantiates the ConstraintValidator<A, T> and calls isValid.

• Required members: message, groups, payload.
• Cascading uses @Valid.
• Spring triggers it via @Valid/@Validated on controller arguments or via a method-validation AOP proxy.

The JDK has no package-listing API; libraries (Spring ClassPathScanningCandidateComponentProvider, ClassGraph, Reflections) list .class resources from directories and jars and read annotations by parsing bytecode (ASM) so classes are not loaded or initialized.

• Loading everything with Class.forName triggers static initializers, class loading memory, and possibly NoClassDefFoundError.
• Scanning is a major startup cost; narrow base packages.

Hidden classes (Java 15, JEP 371) are classes defined with Lookup.defineHiddenClass that cannot be linked to by name from other classes and are unloadable independently. Lambdas and invokedynamic infrastructure use them.

• Class.forName cannot find them; getName has a /0x... suffix.
• Their fields cannot be modified through Field.set even after setAccessible.
• Frameworks should use them instead of ClassLoader.defineClass or Unsafe.defineAnonymousClass (removed in 17).

invoke(Object target, Object... args) boxes primitive arguments, unboxes primitive returns to wrappers, and widens primitives automatically. Exceptions thrown by the target are wrapped in InvocationTargetException; wrong arg count or type gives IllegalArgumentException.

• For a target method that itself takes Object... or an array, pass new Object[]{ new String[]{"a"} } to avoid ambiguity.
• A null target for an instance method gives NullPointerException.
• Unwrap with e.getCause() and rethrow, or the real error is hidden.

Declarative clients (Spring Data repositories, Feign, Retrofit, MyBatis mappers) are interfaces with no implementation; the framework creates a JDK proxy and its handler reads annotations from the interface methods (@Query, @GetMapping, @Select) to decide behaviour.

• Method name parsing (findByEmailAndStatus) in Spring Data is also reflection on method names.
• Each interface method's metadata is parsed once at startup and cached.

Expected output is null, because the default retention is CLASS.

@Target(ElementType.METHOD)
@interface Audit {}

class S { @Audit void run() {} }

System.out.println(S.class.getDeclaredMethod("run").getAnnotation(Audit.class));
// null

Fix by adding @Retention(RetentionPolicy.RUNTIME).

Wrap the target in a proxy; the handler checks the annotation on the target's method (the interface Method passed to the handler does not carry implementation annotations).

@Retention(RetentionPolicy.RUNTIME) @interface Timed {}
interface Svc { void work(); }
class SvcImpl implements Svc { @Timed public void work() {} }

static <T> T timed(T target, Class<T> iface) {
    return iface.cast(Proxy.newProxyInstance(iface.getClassLoader(),
        new Class<?>[]{iface}, (p, m, a) -> {
            Method impl = target.getClass().getMethod(m.getName(), m.getParameterTypes());
            if (!impl.isAnnotationPresent(Timed.class)) return m.invoke(target, a);
            long t = System.nanoTime();
            try { return m.invoke(target, a); }
            catch (InvocationTargetException e) { throw e.getCause(); }
            finally { System.out.println(m.getName() + " " + (System.nanoTime() - t)); }
        }));
}

Define the annotation with @Constraint, then implement ConstraintValidator. For cross-field rules, annotate the class and read two properties.

@Documented @Target(ElementType.TYPE) @Retention(RetentionPolicy.RUNTIME)
@Constraint(validatedBy = ActiveNameValidator.class)
public @interface NotBlankIfActive {
    String message() default "name required when active";
    Class<?>[] groups() default {};
    Class<? extends Payload>[] payload() default {};
}

public class ActiveNameValidator
        implements ConstraintValidator<NotBlankIfActive, UserForm> {
    public boolean isValid(UserForm f, ConstraintValidatorContext c) {
        return !f.active() || (f.name() != null && !f.name().isBlank());
    }
}

Iterate declared fields, check annotations, read values with setAccessible, collect errors.

@Retention(RetentionPolicy.RUNTIME) @Target(ElementType.FIELD)
@interface Min { int value(); }

static List<String> validate(Object o) throws IllegalAccessException {
    List<String> errs = new ArrayList<>();
    for (Field f : o.getClass().getDeclaredFields()) {
        Min m = f.getAnnotation(Min.class);
        if (m == null) continue;
        f.setAccessible(true);
        if (((Number) f.get(o)).intValue() < m.value())
            errs.add(f.getName() + " must be >= " + m.value());
    }
    return errs;
}
// class P { @Min(18) int age = 10; }  -> [age must be >= 18]

Register classes, pick the single constructor, resolve each parameter recursively, cache singletons, and detect cycles.

public class MiniContainer {
    private final Map<Class<?>, Object> singletons = new HashMap<>();
    private final Set<Class<?>> creating = new HashSet<>();

    @SuppressWarnings("unchecked")
    public <T> T get(Class<T> type) throws Exception {
        Object existing = singletons.get(type);
        if (existing != null) return (T) existing;
        if (!creating.add(type))
            throw new IllegalStateException("Cycle: " + type.getName());
        try {
            Constructor<?> c = type.getDeclaredConstructors()[0];
            Object[] args = new Object[c.getParameterCount()];
            Class<?>[] pt = c.getParameterTypes();
            for (int i = 0; i < args.length; i++) args[i] = get(pt[i]);
            c.setAccessible(true);
            Object o = c.newInstance(args);
            singletons.put(type, o);
            return (T) o;
        } finally { creating.remove(type); }
    }
}

• Real containers add interface-to-implementation bindings, scopes, qualifiers, and @Inject-based constructor selection.

Add a bind(Class<I>, Class<? extends I>) map and, after construction, scan fields for @Inject, resolve the field's type through the binding map, and set it.

private final Map<Class<?>, Class<?>> bindings = new HashMap<>();
public <I> void bind(Class<I> i, Class<? extends I> impl) { bindings.put(i, impl); }

private void injectFields(Object o) throws Exception {
    for (Class<?> c = o.getClass(); c != Object.class; c = c.getSuperclass())
        for (Field f : c.getDeclaredFields())
            if (f.isAnnotationPresent(Inject.class)) {
                f.setAccessible(true);
                f.set(o, get(bindings.getOrDefault(f.getType(), f.getType())));
            }
}

• Walking superclasses matters; @Inject in base classes would otherwise be skipped.

With @Autowired private Repo repo;, new Service() yields an object whose repo is null; the first call throws NullPointerException. There is no constructor or setter to supply a mock, so tests need the Spring context, @InjectMocks (Mockito reflection) or ReflectionTestUtils.setField.

class Service { @Autowired private Repo repo;
    String name(int id) { return repo.find(id).name(); } }
new Service().name(1); // NullPointerException

• Constructor injection makes the dependency explicit, allows final fields, and tests use plain new Service(mockRepo).

Plain JUnit does not process Spring annotations; no container exists, so @Autowired is just metadata nobody reads. Fix with @SpringBootTest/@ExtendWith(SpringExtension.class), or avoid Spring with a constructor-injected unit test.

• @SpringBootTest loads the full context (slow); slices (@WebMvcTest, @DataJpaTest) load less.
• JUnit 5 + Spring: the SpringExtension acts as the test instance post-processor.

Message: Unable to make field private final ... accessible: module java.base does not "opens java.lang" to unnamed module. JDK 17 strongly encapsulates internals.

Options in order of preference:

1. Upgrade the library to a version that uses public APIs, MethodHandles.privateLookupIn or VarHandle.
2. Use --add-opens java.base/java.lang=ALL-UNNAMED (JVM flag, JAVA_TOOL_OPTIONS, or in the jar manifest Add-Opens:).
3. For your own modules, add opens com.app.model to jackson.databind;.

Reflection can break a class-based singleton by calling its private constructor.

class Single { static final Single I = new Single(); private Single() {} }
Constructor<Single> c = Single.class.getDeclaredConstructor();
c.setAccessible(true);
System.out.println(c.newInstance() == Single.I); // false

Mitigations: throw from the constructor if I != null, or use an enum singleton, which Constructor.newInstance explicitly refuses.

The CGLIB proxy is a subclass instance whose own fields are uninitialized (created via Objenesis, no constructor run). Method calls are intercepted and delegated to the real target, but direct field access on the proxy (e.g. other.name from the same package or a final method call) reads the proxy's empty fields.

@Service class Price { String currency = "USD"; public final String cur() { return currency; } }
// injected proxy: proxy.currency == null; proxy.cur() -> final, not intercepted, runs on proxy -> null

• Use getters (non-final), keep logic in non-final public methods, avoid exposing fields.

The inner call does not start a new transaction; it runs inside the outer one. Self-invocation uses this, not the proxy, so the advice never runs.

@Service class Orders {
    @Transactional public void place() { audit(); }          // outer tx
    @Transactional(propagation = REQUIRES_NEW) void audit() { } // ignored
}

Fixes: move audit into another bean, inject self lazily, use TransactionTemplate, or AspectJ weaving mode.

method.getAnnotation only sees annotations declared directly on that Method. For overridden methods, search the hierarchy yourself or use Spring's AnnotatedElementUtils.findMergedAnnotation(method, Type.class), which looks at superclass and interface methods.

Audit a = AnnotatedElementUtils.findMergedAnnotation(impl, Audit.class);

• Alternatively put the annotation on the class and make it @Inherited.

readValue(json, List.class) supplies only the raw type, so elements default to LinkedHashMap. Pass full generic type information with TypeReference.

List<User> users = mapper.readValue(json, new TypeReference<List<User>>() {});
// or
mapper.getTypeFactory().constructCollectionType(List.class, User.class);

The failure shows later as ClassCastException: LinkedHashMap cannot be cast to User at use.

Read the generic superclass of the concrete class.

abstract class Repo<T> {
    @SuppressWarnings("unchecked")
    final Class<T> type = (Class<T>) ((ParameterizedType)
        getClass().getGenericSuperclass()).getActualTypeArguments()[0];
}
class UserRepo extends Repo<User> {}
System.out.println(new UserRepo().type); // class User

Breaks for new Repo<User>() {}? No, that works too; but class Mid<T> extends Repo<T> and Mid<User> instances yield TypeVariable and ClassCastException. Spring's GenericTypeResolver.resolveTypeArgument handles hierarchies.

Prefer testing through the public API. If the private logic is complex enough to need its own tests, extract it into a package-private or separate class. Reflection (setAccessible) works but couples tests to implementation names and breaks silently under refactoring.

Method m = Calc.class.getDeclaredMethod("round", double.class);
m.setAccessible(true);
double r = (double) m.invoke(new Calc(), 2.567);

First, hoist getMethod and setAccessible out of the loop. Then, for the remaining overhead, use a static final MethodHandle (inlineable) or generate a lambda with LambdaMetafactory for a typed functional interface. Best of all, avoid reflection by generating code at build time.

private static final MethodHandle LEN;
static { try { LEN = MethodHandles.lookup().findVirtual(
    String.class, "length", MethodType.methodType(int.class));
} catch (ReflectiveOperationException e) { throw new ExceptionInInitializerError(e); } }
int n = (int) LEN.invokeExact("abc");

The caller receives InvocationTargetException whose getCause() is the original exception. The stack trace shows reflection frames.

try { m.invoke(obj); }
catch (InvocationTargetException e) {
    Throwable real = e.getCause();   // e.g. IOException
    throw real;                       // rethrow original
}

• With a JDK proxy, a checked exception thrown from the handler that the interface does not declare becomes UndeclaredThrowableException.

Two different classloaders loaded com.A; a class's identity is (name, defining loader). Typical in app servers, OSGi, Spring Boot devtools restart loader, or plugin systems.

• Fix by ensuring the type comes from a shared parent loader (e.g. put the API in the server's lib), or communicate through interfaces loaded by a common parent.
• Diagnose with a.getClass().getClassLoader() for both objects.

Output order demonstrates that forName initializes while .class and loadClass do not.

class Boot { static { System.out.println("init"); } }

Class<?> a = Boot.class;                                     // nothing
Class<?> b = Boot.class.getClassLoader().loadClass("Boot");  // nothing
Class<?> c = Class.forName("Boot");                          // prints: init

Initialization is triggered once, on first new, static method call, non-constant static field access, or forName.

The DTOs were not registered for reflection, so Jackson found no accessible properties (or no constructor) in the native binary. On the JVM, reflection works without registration.

Fix:

@RegisterReflectionForBinding({OrderDto.class, ItemDto.class})
@Configuration class Hints {}

• Or provide reflect-config.json, or run the tracing agent in tests (-agentlib:native-image-agent).
• Spring detects types in controller signatures automatically, but not types used only through ObjectMapper.convertValue.

Native image needs to know proxy interface sets at build time. The error is Proxy class defined by interfaces [...] not found. Register the exact ordered interface list in proxy configuration.

{
  "reflection": [],
  "proxy": [ ["com.app.PaymentClient", "org.springframework.aop.SpringProxy"] ]
}

(Older layout: proxy-config.json with [["com.app.PaymentClient"]].)

• Order of interfaces matters and each distinct combination is its own entry.
• Spring AOT usually generates these hints; add @ImportRuntimeHints for custom proxies.

Define a runtime, method-target annotation and an @Aspect with @Around("@annotation(rl)") that binds the annotation instance.

@Retention(RetentionPolicy.RUNTIME) @Target(ElementType.METHOD)
public @interface RateLimited { int perMinute() default 60; }

@Aspect @Component
class RateLimitAspect {
    @Around("@annotation(rl)")
    Object limit(ProceedingJoinPoint pjp, RateLimited rl) throws Throwable {
        if (!bucketFor(pjp).tryAcquire(rl.perMinute()))
            throw new TooManyRequestsException();
        return pjp.proceed();
    }
}

• Key by user/method; use Redis or Bucket4j for multi-instance limiting.
• Remember self-invocation, final methods and order relative to @Transactional (@Order).

Extend AbstractProcessor, iterate annotated elements, inspect enclosed constructors with javax.lang.model, and report with Messager.

@SupportedAnnotationTypes("com.app.NeedsNoArg")
@SupportedSourceVersion(SourceVersion.RELEASE_17)
public class NoArgCheck extends AbstractProcessor {
    public boolean process(Set<? extends TypeElement> ann, RoundEnvironment env) {
        for (Element e : env.getElementsAnnotatedWith(NeedsNoArg.class)) {
            boolean ok = ElementFilter.constructorsIn(e.getEnclosedElements())
                .stream().anyMatch(c -> c.getParameters().isEmpty());
            if (!ok) processingEnv.getMessager()
                .printMessage(Diagnostic.Kind.ERROR, "needs no-arg ctor", e);
        }
        return false;
    }
}

• Register via META-INF/services/javax.annotation.processing.Processor (or @AutoService).
• Use getSupportedSourceVersion returning latestSupported() to avoid warnings on newer JDKs.

Since Gradle 5, processors on compileOnly are not executed. You must declare both:

dependencies {
    compileOnly 'org.projectlombok:lombok'
    annotationProcessor 'org.projectlombok:lombok'
    testCompileOnly 'org.projectlombok:lombok'
    testAnnotationProcessor 'org.projectlombok:lombok'
}

Symptom: cannot find symbol: method getName() on Lombok-annotated classes.

In a bidirectional relationship, Order.toString() prints its items, each Item.toString() prints its order, forever. Same for generated hashCode/equals.

@Data @Entity class Order { @OneToMany(mappedBy="order") List<Item> items; }
@Data @Entity class Item  { @ManyToOne Order order; }
// order.toString() -> StackOverflowError

Fix: @ToString.Exclude / @EqualsAndHashCode.Exclude on the back-reference, or write equals/hashCode on the business key/ID manually.

For a record component, an annotation is propagated only to the declaration contexts permitted by its @Target. If @Target(ElementType.FIELD) only, it lands on the private field; reading getRecordComponents()[0].getAnnotation finds nothing, and reading the accessor finds nothing.

@Retention(RUNTIME) @Target(FIELD) @interface Tag {}
record P(@Tag String name) {}
P.class.getDeclaredField("name").isAnnotationPresent(Tag.class);       // true
P.class.getRecordComponents()[0].isAnnotationPresent(Tag.class);       // false
P.class.getMethod("name").isAnnotationPresent(Tag.class);              // false

Add RECORD_COMPONENT, METHOD, PARAMETER to @Target to expose it where the framework looks.

Annotations are only processed for beans created by the container. new Mailer() skips BeanPostProcessors, so @Value/@Autowired fields stay null/default and @Transactional has no proxy.

• Fixes: declare it as a bean and inject it, use ObjectProvider/ApplicationContext.getBean, or AutowireCapableBeanFactory.autowireBean(obj) for externally created objects.
• Objects created by JPA, Jackson, or Kafka deserializers are likewise not injected.

Likely causes: the bean is not Spring-managed; the jakarta.annotation API is missing; Boot 3 uses jakarta.annotation.PostConstruct, not javax; or the method has a parameter/is static.

• In Spring 6, javax.annotation.PostConstruct is not recognized.
• CommonAnnotationBeanPostProcessor handles it, called after dependency injection and before use.
• Alternatives: InitializingBean.afterPropertiesSet, @Bean(initMethod).

Hibernate instantiates entities reflectively and needs a no-argument constructor with at least package/protected visibility (public/protected per JPA spec).

@Entity class User {
    @Id Long id; String name;
    protected User() {}              // for JPA
    public User(String name) { this.name = name; }
}

JaCoCo's agent instruments bytecode and adds a synthetic static field $jacocoData and a method $jacocoInit. Reflection-based code (serializers, equals builders, schema generators) sees them.

• Filter with field.isSynthetic() / method.isSynthetic().
• Same story for inner classes' this$0 and enum $VALUES.

Define @Column(name, order), collect annotated fields once per class into a cached sorted list of Field (made accessible), then format rows using field.get.

@Retention(RUNTIME) @Target(FIELD) @interface Column { String value(); int order(); }

static final ClassValue<List<Field>> FIELDS = new ClassValue<>() {
    protected List<Field> computeValue(Class<?> c) {
        return Arrays.stream(c.getDeclaredFields())
            .filter(f -> f.isAnnotationPresent(Column.class))
            .sorted(Comparator.comparingInt(f -> f.getAnnotation(Column.class).order()))
            .peek(f -> f.setAccessible(true)).toList();
    }
};

• ClassValue caches per class without leaking classloaders.
• Escape quotes and commas; handle null.

Names used via string lookups (getDeclaredField("email"), JSON property names derived from fields, Class.forName) no longer match, giving NoSuchFieldException or silently empty JSON. Add keep rules or use explicit names.

-keep class com.app.dto.** { *; }
-keepattributes Signature,*Annotation*

• Signature attribute must be kept or generic info (TypeToken) is lost.
• Prefer @SerializedName/@JsonProperty("email") so names do not depend on field names.

Both lists have the same runtime class, so the comparison is true.

List<String> a = new ArrayList<>();
List<Integer> b = new ArrayList<>();
System.out.println(a.getClass() == b.getClass()); // true

Method m = Holder.class.getMethod("get");        // List<String> get()
System.out.println(m.getReturnType());           // interface java.util.List
System.out.println(m.getGenericReturnType());    // java.util.List<java.lang.String>

Instance-level type args are erased; declaration-level signatures survive.

Use java.lang.reflect.Array.newInstance(componentType, length) with a Class<T> token.

@SuppressWarnings("unchecked")
static <T> T[] newArray(Class<T> type, int n) {
    return (T[]) Array.newInstance(type, n);
}
String[] s = newArray(String.class, 3);
System.out.println(s.getClass().getSimpleName()); // String[]

getDeclaredFields is per class, so loop up the superclass chain.

static List<Field> allFields(Class<?> c) {
    List<Field> out = new ArrayList<>();
    for (; c != null && c != Object.class; c = c.getSuperclass())
        out.addAll(Arrays.asList(c.getDeclaredFields()));
    return out;
}

• Skip static and synthetic fields in most use cases.
• Shadowed field names are possible, so key by declaring class too.

getMethod matches exact parameter types: int.class is not Integer.class. Use getMethod("process", int.class); invoke accepts an Integer and unboxes it.

Method m = Svc.class.getMethod("process", int.class);
m.invoke(svc, 5);  // autoboxed arg, OK

• There is no overload resolution like the compiler does; you must match the declared types exactly (or loop to find the best fit, as Spring's BeanUtils/MethodUtils do).

JDK 9 introduced strong encapsulation; JDK 16 closed java.* internals by default; 17 removed the escape flag. Libraries relying on sun.misc.Unsafe still work (jdk.unsupported), but those using jdk.internal.* or sun.nio.ch need --add-exports/--add-opens. JDK 23+ emits warnings for Unsafe memory access and later releases will deny it.

• Diagnose with jdeps --jdk-internals app.jar.
• Upgrade Lombok, Mockito, ByteBuddy, Kryo, Hadoop and Spark clients before moving JDK versions.

A reflective equals iterates fields and compares with Objects.equals.

static boolean same(Object a, Object b) throws IllegalAccessException {
    if (a == b) return true;
    if (a == null || b == null || a.getClass() != b.getClass()) return false;
    for (Field f : a.getClass().getDeclaredFields()) {
        f.setAccessible(true);
        if (!Objects.equals(f.get(a), f.get(b))) return false;
    }
    return true;
}

Problems: slow, ignores superclass fields, includes synthetic fields, breaks on arrays (Objects.equals is reference equality; use deepEquals), and fails under module encapsulation. Records and IDE-generated equals are better.

Find methods annotated with @Check, instantiate the class, invoke each, count successes and failures, and unwrap InvocationTargetException.

@Retention(RUNTIME) @Target(METHOD) @interface Check {}

static void run(Class<?> c) throws Exception {
    Object inst = c.getDeclaredConstructor().newInstance();
    for (Method m : c.getDeclaredMethods()) {
        if (!m.isAnnotationPresent(Check.class)) continue;
        m.setAccessible(true);
        try { m.invoke(inst); System.out.println("PASS " + m.getName()); }
        catch (InvocationTargetException e) {
            System.out.println("FAIL " + m.getName() + " " + e.getCause());
        }
    }
}

Reflection mappers (BeanUtils.copyProperties, ModelMapper) are convenient but fail late: renamed fields silently stop copying. Compile-time generators (MapStruct) produce plain getter/setter code, giving type safety, speed and native-image compatibility.

• BeanUtils.copyProperties ignores type mismatches silently (property skipped) and shallow-copies.
• MapStruct errors at compile time for unmapped targets when unmappedTargetPolicy = ERROR.

setAccessible(true) throws InaccessibleObjectException (a RuntimeException) even though the member is public and the caller is a framework, if the declaring class is non-public or the package is not open/exported to the framework's module.

• For public members of exported packages of public classes, no setAccessible is needed.
• trySetAccessible() returns false instead of throwing, useful for frameworks that fall back.
• Module.isOpen(pkg, other) can check beforehand; the owner can call module.addOpens(pkg, other) at runtime from inside the module.

A non-static inner class constructor takes the outer instance as a hidden first parameter.

class Outer { class Inner { Inner() {} } }
Constructor<?>[] cs = Outer.Inner.class.getDeclaredConstructors();
System.out.println(cs[0].getParameterCount());      // 1
System.out.println(cs[0].getParameterTypes()[0]);   // class Outer
Object in = cs[0].newInstance(new Outer());

• getDeclaredConstructor() (no args) throws NoSuchMethodException. Same issue breaks Jackson/Gson on non-static inner classes.

If the bean has interfaces and JDK proxying is selected (proxyTargetClass=false, e.g. via @EnableAsync(proxyTargetClass=false) or older Spring), the proxy implements the interface only, so injecting MyServiceImpl fails: BeanNotOfRequiredTypeException ... is actually of type jdk.proxy2.$Proxy45.

Fix: inject by interface, or force CGLIB with proxyTargetClass = true (Boot default).

The aspect likely used only the method name as the key. A correct key combines the target class, method signature and the arguments (Arrays.deepHashCode/SimpleKey) or a SpEL expression from the annotation.

String key = pjp.getTarget().getClass().getName() + "#"
    + pjp.getSignature().toLongString() + Arrays.deepToString(pjp.getArgs());

• Beware mutable arguments (key changes), null handling, and unbounded growth; use Caffeine with a size/TTL.

Validate in a BeanPostProcessor/SmartInitializingSingleton or an ApplicationRunner that scans beans for the annotation and throws IllegalStateException on invalid attributes, so the app refuses to start. At build time, an annotation processor can do the same with compiler errors.

• Spring Boot's @ConfigurationProperties + @Validated validate config binding at startup.
• Fail-fast avoids production surprises on first request.

Reflection gives no synchronization or visibility guarantees beyond those of the field itself. Field.set on a non-volatile field is a plain write; another thread may see a stale value. Field objects themselves are thread-safe to share for reads, but setAccessible state is per Field instance and a copy is returned by each getDeclaredField.

• Use VarHandle or AtomicXFieldUpdater for atomic updates.
• Field.set on a volatile field honours volatile semantics.

Avoid them when a plain interface, lambda or explicit code gives the same result with static checking.

• Reflection hides dependencies, bypasses encapsulation, defeats refactoring tools, hurts native image and obfuscation, and costs performance.
• Annotation-heavy "magic" (stacked @Transactional, @Async, @Cacheable on one method) creates ordering bugs and hard-to-debug proxies.
• Prefer: strategy/functional interfaces, ServiceLoader, build-time generation, explicit configuration (@Bean methods, functional bean registration).

Create the object via no-arg constructor, loop over fields, find the key, convert, and set.

static <T> T bind(Map<String, Object> m, Class<T> c) throws Exception {
    T o = c.getDeclaredConstructor().newInstance();
    for (Field f : c.getDeclaredFields()) {
        if (!m.containsKey(f.getName())) continue;
        f.setAccessible(true);
        Object v = m.get(f.getName());
        if (f.getType() == int.class && v instanceof String s) v = Integer.parseInt(s);
        f.set(o, v);
    }
    return o;
}

Pitfalls: type conversion (String -> int, enum, date, nested), final fields, setter logic bypassed, unknown keys silently ignored, IllegalArgumentException when types mismatch (Field.set unwraps/widens only).

Annotations placed on a field are not copied to generated getters/setters by default. Lombok's @Getter copies only some known annotations (e.g. @Nullable, Jackson ones in copyableAnnotations); Kotlin applies an annotation to the first applicable target (param, property, field) unless you write @get:/@field:.

data class U(@field:NotBlank val name: String)   // Kotlin: pick explicit target

For Lombok, add lombok.copyableAnnotations += com.app.MyAnno to lombok.config.

JUnit reads the @MethodSource("names") attribute and reflectively looks up a method by that name in the test class (or fully qualified Class#method), invokes it (static unless PER_CLASS lifecycle), and converts the returned Stream/Iterable/array into invocation arguments.

• With no name, it looks for a method with the same name as the test method.
• Argument conversion is implicit (String to enum, number widening) and explicit via ArgumentConverter.

Classic Spring (pre-AOT) processes annotations reflectively at startup. Micronaut uses annotation processors at compile time to generate bean definitions, with no reflection or runtime proxies. Quarkus runs a build-time augmentation step with Jandex indexing and bytecode recording; Spring 6 AOT moves closer to this model.

• Compile/build-time approach: faster startup, lower memory, native-image friendliness, fewer runtime surprises.
• Runtime approach: dynamic (profiles, conditions evaluated at startup), more flexible, easier ad-hoc debugging, but slower startup.