Merge branch 'connorgilbert/spotbugs-java-8' into 'master'

Deprecation: Out-of-the-box Java 8 in SAST SpotBugs

See merge request gitlab-org/gitlab!80473

data/deprecations/14-8-sast-spotbugs-java-8.yml

+- name: "Out-of-the-box SAST support for Java 8"
+  announcement_milestone: "14.8"
+  announcement_date: "2022-02-22"
+  removal_milestone: "15.0"
+  removal_date: "2022-05-22"
+  breaking_change: true
+  reporter: connorgilbert
+  body: |  # Do not modify this line, instead modify the lines below.
+    The [GitLab SAST SpotBugs analyzer](https://gitlab.com/gitlab-org/security-products/analyzers/spotbugs) scans [Java, Scala, Groovy, and Kotlin code](https://docs.gitlab.com/ee/user/application_security/sast/#supported-languages-and-frameworks) for security vulnerabilities.
+    For technical reasons, the analyzer must first compile the code before scanning.
+    Unless you use the [pre-compilation strategy](https://docs.gitlab.com/ee/user/application_security/sast/#pre-compilation), the analyzer attempts to automatically compile your project's code.
+
+    In GitLab versions prior to 15.0, the analyzer image includes Java 8 and Java 11 runtimes to facilitate compilation.
+
+    In GitLab 15.0, we will:
+
+    - Remove Java 8 from the analyzer image to reduce the size of the image.
+    - Add Java 17 to the analyzer image to make it easier to compile with Java 17.
+
+    If you rely on Java 8 being present in the analyzer environment, you must take action as detailed in the [deprecation issue for this change](https://gitlab.com/gitlab-org/gitlab/-/issues/352549#breaking-change).
+# The following items are not published on the docs page, but may be used in the future.
+  stage: Secure
+  tiers: [Free, Silver, Gold, Core, Premium, Ultimate]
+  issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/352549

doc/update/deprecations.md

@@ -915,6 +915,29 @@ Unexpected behavior in a security feature is inherently dangerous, so we have de
 
 **Planned removal milestone: 15.0 (2022-05-22)**
 
+### Out-of-the-box SAST support for Java 8
+
+WARNING:
+This feature will be changed or removed in 15.0
+as a [breaking change](https://docs.gitlab.com/ee/development/contributing/#breaking-changes).
+Before updating GitLab, review the details carefully to determine if you need to make any
+changes to your code, settings, or workflow.
+
+The [GitLab SAST SpotBugs analyzer](https://gitlab.com/gitlab-org/security-products/analyzers/spotbugs) scans [Java, Scala, Groovy, and Kotlin code](https://docs.gitlab.com/ee/user/application_security/sast/#supported-languages-and-frameworks) for security vulnerabilities.
+For technical reasons, the analyzer must first compile the code before scanning.
+Unless you use the [pre-compilation strategy](https://docs.gitlab.com/ee/user/application_security/sast/#pre-compilation), the analyzer attempts to automatically compile your project's code.
+
+In GitLab versions prior to 15.0, the analyzer image includes Java 8 and Java 11 runtimes to facilitate compilation.
+
+In GitLab 15.0, we will:
+
+- Remove Java 8 from the analyzer image to reduce the size of the image.
+- Add Java 17 to the analyzer image to make it easier to compile with Java 17.
+
+If you rely on Java 8 being present in the analyzer environment, you must take action as detailed in the [deprecation issue for this change](https://gitlab.com/gitlab-org/gitlab/-/issues/352549#breaking-change).
+
+**Planned removal milestone: 15.0 (2022-05-22)**
+
 ### Querying Usage Trends via the `instanceStatisticsMeasurements` GraphQL node
 
 WARNING: