The standard mvn verify command reaches passing tests on Java 21 but inherited spotbugs-maven-plugin 3.1.12.2 fails on JDK classfile major version 65 and SecurityManager restrictions. Java 8 remains the supported release toolchain. Track a separate build-tool compatibility update; avoid a parent/dependency upgrade within the conservative signing patch. Verify Java 21 runtime with tests/packaging and skip only the incompatible analyzer, and run full analysis on Java 8.