title: Why does it appear that OSGi-classloading is being bypassed?
body: <p>I am currently working on making some very OSGi-unfriendly 3rd-party libraries available to our OSGi-bundles. One of these libraries (which I have already turned into a bundle using bnd) manages to load classes that it should not be able to load (at least by OSGi-rules). Lets assume that bundle is called <code>Foo</code>, and the package from which it loads classes is called <code>bar</code>.</p>
  
  <p><code>Foo</code> has <code>bar</code> as optional import. This shouldn't matter though, since there is no bundle that exports <code>bar</code>. I am not using any boot-delegation. The <code>jar</code>-file that contains <code>bar</code> is on the application-classpath though (the OSGi-framework runs embedded in my application).</p>
  
  <p>Apparently <code>Foo</code> somehow bypasses the OSGi-classloading infrastructure. How can this be done? I am pretty sure that it does not use a custom class-loader, because there is just no reason for it to have one (no feature <code>Foo</code> offers would require such a thing). So, what standard, out-of-the-box methods could be used by a bundle to bypass OSGi-classloading?</p>