Is it enough to upgrade Java JDK/JRE if still compiling with an old java.version?

Question

I'm using an open-source project which still uses Java 8. It supports Java 11, but the pom.xml locks the compiled byte-code version to 8:

<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>
<java.version>8</java.version>

I would like to avoid using Java 8, for security risk reasons. Is it enough to compile and execute with Java 11, even though the byte-code is set to Java 8?

Answer 1

My understanding is that if you need security fixes, it's enough to upgrade your JDK to 21 and leave the compiler source/target at Java 8. But if you want to use the newest features, you also need to change the compiler target to 21.