Bump Java baseline from 17 to 21 for Grails 8

[jamesfredley]

Summary

Fixes the failing CI and RAT Report workflows on the 8.0.x branch (e.g. https://github.com/apache/grails-spring-security/actions/runs/25003047902 ) by aligning the Java baseline with the Grails 8 / Spring Boot 4 / Spring Framework 7 requirement of Java 21.

Root cause

buildSrc resolves grails-gradle-bom:8.0.0-SNAPSHOT, which now pulls Gradle plugins (cloud.wondrify:asset-pipeline-gradle, org.apache.grails:grails-gradle-plugins, org.apache.grails.gradle:grails-publish) compiled with Gradle module metadata that requires a JVM runtime of at least 21. Building under Java 17 fails during :buildSrc:compileGroovy with:

Could not resolve cloud.wondrify:asset-pipeline-gradle.

Dependency requires at least JVM runtime version 21. This build uses a Java 17 JVM.

This breaks both rat.yml (the run cited in the issue) and gradle.yml (CI) on every push/PR against 8.0.x.

Changes

• .github/workflows/gradle.yml: java-version: 17 -> 21 in all three jobs (coreTests, functionalTests, publish)
• .github/workflows/rat.yml: java-version: 17 -> 21
• .github/workflows/release.yml: JAVA_VERSION: 17.0.17 -> 21.0.10
• gradle.properties: javaVersion=17 -> 21 (drives compileJava.options.release via gradle/java-config.gradle, so produced bytecode now targets 21)
• .sdkmanrc: java=17.0.17-librca -> 21.0.10-librca (kept in sync with release.yml JAVA_VERSION per the comment in that file)
• etc/bin/Dockerfile: bellsoft/liberica-openjdk-debian:17.0.17 -> 21.0.10

Verification of the Liberica 21.0.10 pin

• SDKMAN: 21.0.10-librca is published in the SDKMAN Liberica catalog.
• Docker Hub: bellsoft/liberica-openjdk-debian:21.0.10 exists for both amd64 and arm64.

Scope notes

• This PR targets 8.0.x only. 7.0.x still resolves released grails-gradle-bom:7.0.7 artifacts that work on Java 17, so it is not affected.
• docs/src/docs/whatsNew.adoc and upgrading7x.adoc still mention "Java 17 baseline" because they describe Grails 7 history. Updating user-facing Grails 8 docs to call out the new Java 21 baseline is left to a follow-up so this PR stays a focused build/CI fix.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the project’s Java baseline to 21 to unblock CI/RAT workflows on 8.0.x now that Grails 8 / related Gradle plugin metadata requires a Java 21 runtime.

Changes:

• Bump build baseline from Java 17 to Java 21 via gradle.properties.
• Update GitHub Actions workflows to run with Java 21 for CI, RAT, and release jobs.
• Align local/dev and container tooling by updating .sdkmanrc and the test Docker image to Liberica/OpenJDK 21.0.10.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
gradle.properties	Raises javaVersion to 21, affecting compilation target baseline.
etc/bin/Dockerfile	Updates the container JVM image to OpenJDK 21.0.10.
.sdkmanrc	Pins local SDKMAN Java to Liberica 21.0.10.
.github/workflows/release.yml	Pins release workflow JVM to Liberica 21.0.10 for reproducibility.
.github/workflows/rat.yml	Updates RAT workflow to Java 21.
.github/workflows/gradle.yml	Updates CI jobs to Java 21.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

For reproducibility and to keep CI aligned with the pinned versions used elsewhere (e.g., release.yml uses JAVA_VERSION: 21.0.10 and .sdkmanrc pins 21.0.10-librca), consider pinning actions/setup-java to the same patch version (e.g., 21.0.10) instead of the floating major 21. This reduces the risk of CI behavior changing unexpectedly when a new 21.x patch is released.

[Copilot]

For reproducibility and to keep CI aligned with the pinned versions used elsewhere (e.g., release.yml uses JAVA_VERSION: 21.0.10 and .sdkmanrc pins 21.0.10-librca), consider pinning actions/setup-java to the same patch version (e.g., 21.0.10) instead of the floating major 21. This reduces the risk of CI behavior changing unexpectedly when a new 21.x patch is released.

[Copilot]

For reproducibility and to keep CI aligned with the pinned versions used elsewhere (e.g., release.yml uses JAVA_VERSION: 21.0.10 and .sdkmanrc pins 21.0.10-librca), consider pinning actions/setup-java to the same patch version (e.g., 21.0.10) instead of the floating major 21. This reduces the risk of CI behavior changing unexpectedly when a new 21.x patch is released.

[Copilot]

Same as CI: consider pinning java-version to the exact patch level used for releases (21.0.10) to keep RAT runs consistent over time and aligned with release.yml / .sdkmanrc.

Suggested change

	java-version: 21
	java-version: 21.0.10