apache/commons-lang #1783 (2026-09-08). The fix re-resolved an exact-match Method through getAccessibleMethod so a public declaration replaced one on a non-public class. The build was green and the reviewer found two bugs: a package-private subclass's public static method was replaced by its public parent's (static methods hide, they do not override), and a public interface's static method replaced an instance method of the same name on the implementing class (interface statics are not inherited, and reflection ignores the receiver when invoking one).
Proposed gate, step 4: when a diff changes which Member a reflection helper returns, print the static grid and require a test per cell: static on a non-public subclass hiding a public parent's; static interface method beside an instance method of the same name; the non-public JDK case; and the plain public case that must stay identical. Cheap version: a checklist keyed on java.lang.reflect imports in the diff.
apache/commons-lang #1783 (2026-09-08). The fix re-resolved an exact-match Method through getAccessibleMethod so a public declaration replaced one on a non-public class. The build was green and the reviewer found two bugs: a package-private subclass's public static method was replaced by its public parent's (static methods hide, they do not override), and a public interface's static method replaced an instance method of the same name on the implementing class (interface statics are not inherited, and reflection ignores the receiver when invoking one).
Proposed gate, step 4: when a diff changes which Member a reflection helper returns, print the static grid and require a test per cell: static on a non-public subclass hiding a public parent's; static interface method beside an instance method of the same name; the non-public JDK case; and the plain public case that must stay identical. Cheap version: a checklist keyed on java.lang.reflect imports in the diff.