chore: pin release/snapshot JDK to 11

Building on a newer JDK without --release/jdkRelease lets code link
against APIs missing from Java 11. Keep the build JDK at the minimum
supported version and stop Renovate from proposing java-jdk bumps.
The PR matrix still covers 11, 17, 21 and 25.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: oryan-block

.github/workflows/release.yml

@@ -9,7 +9,7 @@ jobs:
       - name: Setup java
         uses: actions/setup-java@v6
         with:
-          java-version: '25'
+          java-version: '11'
           distribution: 'temurin'
       - name: Build with Maven
         run: mvn --batch-mode --update-snapshots verify
@@ -23,7 +23,7 @@ jobs:
       - name: Setup Maven Central
         uses: actions/setup-java@v6
         with:
-          java-version: '25'
+          java-version: '11'
           distribution: 'temurin'
           server-id: central
           server-username: MAVEN_USERNAME

.github/workflows/snapshot.yml

@@ -12,7 +12,7 @@ jobs:
       - name: Setup java
         uses: actions/setup-java@v6
         with:
-          java-version: '25'
+          java-version: '11'
           distribution: 'temurin'
       - name: Build with Maven
         run: mvn --batch-mode --update-snapshots verify
@@ -26,7 +26,7 @@ jobs:
       - name: Setup Maven Central
         uses: actions/setup-java@v6
         with:
-          java-version: '25'
+          java-version: '11'
           distribution: 'temurin'
           server-id: central
           server-username: MAVEN_USERNAME

renovate.json

@@ -30,6 +30,13 @@
         "org.springframework"
       ],
       "allowedVersions": "<6.0.0"
+    },
+    {
+      "description": "Release/snapshot builds use the minimum supported JDK",
+      "matchDepNames": [
+        "java-jdk"
+      ],
+      "enabled": false
     }
   ]
 }