[2.13] fix cves in docker client library + go-jwt + bump golang version + bump base image

[thatmidwesterncoder]

Issue: rancher/rancher#55285

Parent Issue: rancher/rancher#55280

Bumping a few things to lower the CVE count, notably:

• docker/docker library
• go-jwt library
• golang version to latest minor
• bci version

[Copilot]

Pull request overview

This PR is a maintenance/security update for the rancher/machine build and runtime artifacts, intended to reduce the reported CVE count by updating the base image and key Go dependencies (Docker client library, JWT), and by bumping the Go toolchain patch version.

Changes:

• Bump SUSE BCI base image version used by package/Dockerfile from 15.6 to 15.7.
• Update github.com/docker/docker dependency to v28.5.2+incompatible and adjust Docker client code to use the newer pull options type.
• Update github.com/golang-jwt/jwt/v4 to v4.5.2 and bump the Go toolchain patch version (go1.24.7 → go1.24.12).

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
package/Dockerfile	Bumps the BCI base image version used for building/packaging.
libmachine/mcndockerclient/docker_client.go	Adjusts Docker ImagePull options type after Docker library bump.
go.mod	Updates Docker and JWT dependencies and bumps Go toolchain patch version; adds new indirect deps.
go.sum	Updates module checksums to match the dependency bumps.

Comments suppressed due to low confidence (1)

libmachine/mcndockerclient/docker_client.go:60

• cli.ImagePull returns a streamed response body that should be fully consumed and closed. Currently the code discards the reader and immediately proceeds to ContainerCreate, which can both leak resources and race with the pull (container creation may happen before the image is actually present).

	ctx := context.Background()

	_, err = cli.ImagePull(ctx, config.Image, image.PullOptions{})
	if err != nil {
		return fmt.Errorf("unable to pull image: %s", err)
	}

	resp, err := cli.ContainerCreate(ctx, config, hostConfig, nil, nil, name)
	if err != nil {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.