The eclipse-temurin:21-jre-jammy base ships apt 2.4.14 (HIGH CVE-2026-109518, fixed in 2.4.15ubuntu0.1), which the CI Trivy gate blocks. Upgrade installed packages when building the image. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>