I chose Alpine for the runtime image because it is smaller. That decision made my pipeline permanently unbuildable, and fixing it exposed two more failures hiding behind the first. This is the full chain, the redesign that resolved it, and the principle I now apply to every scanning gate I write.
I set <thymeleaf.version>3.1.4.RELEASE</thymeleaf.version>, rebuilt, and Trivy reported the same two critical CVEs in Thymeleaf 3.1.3. The property was not a typo and the build did not warn. Maven had read it, found nothing that consumed it, and moved on. This is what actually clears a transitive CVE in a Spring Boot project, and why the obvious mechanism works for some libraries and does nothing for others.