The behavior of MetaClass#getProperties was changed for Groovy 4 as part of GROOVY-5169 (JSON serialization fix). It was mentioned in some of the discussion and notes that getProperties() did return private properties in some edge cases — I don't have examples at hand. With that in mind, it was recommended that callers check the modifiers of the MetaProperty instances and filter as necessary.
getProperties() was amended to exclude inaccessible (to the caller) and synthetic properties as part of GROOVY-10438 and GROOVY-10555. Since the caller is not propagated as thoroughly before Groovy 5, it is difficult to provide a good backport of the property filtering. And this also falls within the realm of metaclass breaking changes. ________________________________ From: James Daugherty <[email protected]> Sent: Monday, November 10, 2025 12:00 PM To: Groovy_Developers <[email protected]>; [email protected] <[email protected]> Subject: [EXT] private fields returned by properties in Groovy 4 External Email: Use caution with links and attachments. Hi Everyone, I opened https://urldefense.com/v3/__https://issues.apache.org/jira/browse/GROOVY-11799__;!!GFN0sa3rsbfR8OLyAw!fZIzdacaMb2b19GYD9RTQgd1vL7DxEEknudlIj-_Tb9374PSrRrWqZUbjdtH7aF3RgLS3O3vyGrg-nUYBi-_kKPrLiQ$ but thought I'd reach out to the mailing list on this one. It seems that Groovy 4 is including private fields as properties, which affects my own Grails application in multiple ways: 1. databinding (DataBindingLazyMetaPropertyMap in Grails) uses .properties to decide what to bind 2. json serialization is trying to serialize private fields that are recursive datastructures (Grails's Errors object). It seems this was fixed in Groovy 5 under https://urldefense.com/v3/__https://issues.apache.org/jira/browse/GROOVY-10438__;!!GFN0sa3rsbfR8OLyAw!fZIzdacaMb2b19GYD9RTQgd1vL7DxEEknudlIj-_Tb9374PSrRrWqZUbjdtH7aF3RgLS3O3vyGrg-nUYBi-_GJRYfa0$ but this wasn't back ported to Groovy 4. It also appears that this was reported under Groovy 4 via https://urldefense.com/v3/__https://issues.apache.org/jira/browse/GROOVY-10555__;!!GFN0sa3rsbfR8OLyAw!fZIzdacaMb2b19GYD9RTQgd1vL7DxEEknudlIj-_Tb9374PSrRrWqZUbjdtH7aF3RgLS3O3vyGrg-nUYBi-_cERjHiw$ but it wasn't fixed. Can @Groovy_Developers help me understand why this wasn't backported? Is it possible we could get this fixed in 4.0.30? Regards, James
