My understanding is that if you need security fixes, it's enough to upgrade your JDK to 21 and leave the compiler source/target at Java 8. But if you want to use the newest features, you also need to change the compiler target to 21.