The packaged internals of CGLIB, ByteBuddy, Javassist, and Hibernate's bytecode provider are excluded outright.
The packaged internals of runtime proxy-generation libraries, CGLIB, ByteBuddy,
Javassist, and Hibernate's own bytecode-provider modules, are excluded from both renaming
and nativization, matched by package prefix. This is the only sound static check available:
these libraries' actual proxy classes are generated dynamically at runtime and never exist
as .class file entries to match against directly.
Protecting a third-party proxy library's own plumbing has no value for customer
intellectual property, and it is the riskiest code in a typical dependency tree to
mistranslate. These libraries do their own low-level bytecode generation, and a
mistranslation here tends to fail in ways that are hard to trace back to the actual
cause. Two pipeline-wide invariants, never add final where it wasn't already
present, never strip runtime-visible or runtime-invisible annotations, enforce this
without relying on framework-specific logic that a later pass could
violate.