Merge pull request #7325 from docker/dependabot/github_actions/codecov/codecov-action-7.1.1

build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1
2026-11-13 16:23:41 -04:00 · 2026-09-23 11:45:10 +02:00 · 2026-09-23 08:47:11 +00:00 · 2026-09-23 01:10:38 +02:00 · 2026-09-23 01:09:09 +02:00 · 2026-09-22 08:45:09 +00:00
835 changed files with 59791 additions and 17931 deletions
@@ -1,34 +1,37 @@
 <!--
-Make sure you've read and understood our contributing guidelines;
+Please make sure you've read and understood our contributing guidelines;
 https://github.com/docker/cli/blob/master/CONTRIBUTING.md
-** Make sure all your commits include a signature generated with `git commit -s` **
+Make sure commits are signed off (`git commit -s`) with your real name.
-If this is a bug fix, make sure your description includes "fixes #xxxx", or
+If the PR relates to an existing issue or PR, mention it at the top:
 "closes #xxxx"
-Provide the following information:
+- Fixes: https://github.com/docker/cli/issues/12345678
 - Replaces: https://github.com/docker/cli/pull/12345678
 - Follow up to: https://github.com/docker/cli/pull/12345678
 - Related to: https://github.com/docker/cli/issues/12345678
 -->
-**- What I did**
+## Summary
-**- How I did it**
+## Release notes (optional)
 **- How to verify it**
 **- Human readable description for the release notes**
 <!--
-Write a short (one line) summary that describes the changes in this
+One-sentence user-facing release note.
-pull request for inclusion in the changelog.
+Leave empty if the change is not changelog-worthy.
-It must be placed inside the below triple backticks section.
+Use present tense and imperative tone.
-NOTE: Only fill this section if changes introduced in this PR are user-facing.
+Good:
-The PR must have a relevant impact/ label.
+- Fix a panic when running `docker top` on a non-running Windows container.
 - Don't print warnings in `docker info` for broken symlinks in CLI plugin directories.
 Bad:
 - Refactor test TestFooWithBar
 - Fixed a panic when running docker top
 -->
 ```markdown changelog
 ```
-**- A picture of a cute animal (not mandatory but encouraged)**
+## A picture of a cute animal (not mandatory but encouraged)
@@ -29,7 +29,7 @@ on:
 jobs:
  prepare:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    outputs:
      matrix: ${{ steps.platforms.outputs.matrix }}
    steps:
@@ -49,7 +49,7 @@ jobs:
          echo ${{ steps.platforms.outputs.matrix }}
  build:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    needs:
      - prepare
    strategy:
@@ -65,10 +65,10 @@ jobs:
    steps:
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
      -
        name: Build
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
        with:
          targets: ${{ matrix.target }}
          set: |
@@ -99,7 +99,7 @@ jobs:
  bin-image:
    if: ${{ github.event_name != 'pull_request' && github.repository == 'docker/cli' }}
-    uses: docker/github-builder/.github/workflows/bake.yml@27ade872c1e2296e62ef15ab3b10d37665e57cf7 # v1.15.0
+    uses: docker/github-builder/.github/workflows/bake.yml@58cb9f5b71b1836d6f690c1e95effdeb9b98cb8a # v1.17.0
    permissions:
      contents: read # same as global permission
      id-token: write # for signing attestation(s) and authenticating to Docker Hub with GitHub OIDC Token
@@ -126,7 +126,7 @@ jobs:
          connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
  prepare-plugins:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    outputs:
      matrix: ${{ steps.platforms.outputs.matrix }}
    steps:
@@ -146,7 +146,7 @@ jobs:
          echo ${{ steps.platforms.outputs.matrix }}
  plugins:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    needs:
      - prepare-plugins
    strategy:
@@ -156,10 +156,10 @@ jobs:
    steps:
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
      -
        name: Build
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
        with:
          targets: plugins-cross
          set: |
@@ -34,7 +34,7 @@ on:
 jobs:
  codeql:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    timeout-minutes: 10
    env:
      DISABLE_WARN_OUTSIDE_CONTAINER: '1'
@@ -64,18 +64,18 @@ jobs:
        name: Update Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
-          go-version: "1.26.5"
+          go-version: "1.26.8"
          cache: false
      -
        name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
        with:
          languages: go
      -
        name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
      -
        name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
        with:
          category: "/language:go"
@@ -26,7 +26,7 @@ on:
 jobs:
  tests:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    strategy:
      fail-fast: false
      matrix:
@@ -51,7 +51,7 @@ jobs:
        name: Update daemon.json
        run: |
          if [ ! -f /etc/docker/daemon.json ]; then
-            # ubuntu 24.04 runners no longer have a default daemon.json present
+            # ubuntu runners no longer have a default daemon.json present
            sudo mkdir -p /etc/docker/
            echo '{"experimental": true}' | sudo tee /etc/docker/daemon.json
          else
@@ -65,7 +65,7 @@ jobs:
          docker info
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
      -
        name: Run ${{ matrix.target }}
        run: |
@@ -76,7 +76,7 @@ jobs:
          TESTFLAGS: -coverprofile=/tmp/coverage/coverage.txt
      -
        name: Send to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          files: ./build/coverage/coverage.txt
          token: ${{ secrets.CODECOV_TOKEN }}
@@ -11,13 +11,13 @@ permissions:
 jobs:
  review:
-    uses: docker/docker-agent-action/.github/workflows/review-pr.yml@baf90543d81f5de59751dfd10e6cf45e21a5a982 # v2.0.3
+    uses: docker/docker-agent-action/.github/workflows/review-pr.yml@3654ec391b070e247de2e2e3c1ff2519b6378b3a # v2.0.9
    permissions:
      contents: read # Read repository files and PR diffs
      pull-requests: write # Post review comments
      issues: write # Create security incident issues if secrets detected
      checks: write # (Optional) Show review progress as a check run
      id-token: write # Required for OIDC authentication to AWS Secrets Manager
-      actions: read # Download artifacts from trigger workflow
+      actions: write # Required since v2.0.3 — review-lock cache cleanup and feedback artifacts
    with:
      trigger-run-id: ${{ github.event_name == 'workflow_run' && format('{0}', github.event.workflow_run.id) || '' }}
@@ -26,7 +26,7 @@ on:
 jobs:
  sync-release-branch:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    permissions:
      contents: write
      actions: write
@@ -116,7 +116,7 @@ jobs:
  push-release-branch:
    needs: sync-release-branch
    if: ${{ !inputs.dry_run && needs.sync-release-branch.outputs.has_changes == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    environment: docker-releases
    permissions:
      contents: write
@@ -26,19 +26,19 @@ on:
 jobs:
  ctn:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    steps:
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
      -
        name: Test
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
        with:
          targets: test-coverage
      -
        name: Send to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          files: ./build/coverage/coverage.txt
          token: ${{ secrets.CODECOV_TOKEN }}
@@ -68,7 +68,7 @@ jobs:
        name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
-          go-version: "1.26.5"
+          go-version: "1.26.8"
          cache: false
      -
        name: Test
@@ -82,7 +82,7 @@ jobs:
        shell: bash
      -
        name: Send to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          files: /tmp/coverage.txt
          working-directory: ${{ env.GOPATH }}/src/github.com/docker/cli
@@ -10,7 +10,7 @@ on:
 jobs:
  validate-milestone:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    timeout-minutes: 5
    steps:
      - name: Validate milestone matches VERSION
@@ -15,7 +15,7 @@ on:
 jobs:
  check-labels:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    timeout-minutes: 120 # guardrails timeout for the whole job
    steps:
      - name: Missing `area/` label
@@ -32,7 +32,7 @@ jobs:
        run: exit 0
  check-changelog:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    timeout-minutes: 120 # guardrails timeout for the whole job
    env:
      HAS_IMPACT_LABEL: ${{ contains(join(github.event.pull_request.labels.*.name, ','), 'impact/') }}
@@ -70,7 +70,7 @@ jobs:
          echo "$desc"
  check-pr-branch:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    timeout-minutes: 120 # guardrails timeout for the whole job
    env:
      PR_TITLE: ${{ github.event.pull_request.title }}
@@ -26,7 +26,7 @@ on:
 jobs:
  validate:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    strategy:
      fail-fast: false
      matrix:
@@ -38,13 +38,13 @@ jobs:
    steps:
      -
        name: Run
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
        with:
          targets: ${{ matrix.target }}
  # check that the generated Markdown and the checked-in files match
  validate-md:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    steps:
      -
        name: Checkout
@@ -66,7 +66,7 @@ jobs:
          fi
  validate-make:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    strategy:
      fail-fast: false
      matrix:
@@ -86,7 +86,7 @@ jobs:
          make -f docker.Makefile ${{ matrix.target }}
  validate-gocompat:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
    env:
      GOPATH: ${{ github.workspace }}
      GO111MODULE: off
@@ -101,7 +101,7 @@ jobs:
        name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
-          go-version: "1.26.5"
+          go-version: "1.26.8"
          cache: false
      -
        name: Run gocompat check
@@ -21,7 +21,7 @@ on:
 jobs:
  run:
-    uses: crazy-max/.github/.github/workflows/zizmor.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@f91220cba053bd54299ba645a599ee8ed436f222 # v1.11.0
    permissions:
      contents: read
      security-events: write
@@ -5,7 +5,7 @@ run:
  # which causes it to fallback to go1.17 semantics.
  #
  # TODO(thaJeztah): update "usetesting" settings to enable go1.24 features once our minimum version is go1.24
-  go: "1.26.5"
+  go: "1.26.8"
  timeout: 5m
@@ -267,7 +267,7 @@ Then you just add a line to every git commit message:
    Signed-off-by: Joe Smith <joe.smith@email.com>
-Use your real name (sorry, no pseudonyms or anonymous contributions.)
+Use a known identity (sorry, no anonymous contributions.)
 If you set your `user.name` and `user.email` git configs, you can sign your
 commit automatically with `git commit -s`.
@@ -8,7 +8,7 @@ ARG BASE_VARIANT=alpine
 ARG ALPINE_VERSION=3.23
 ARG BASE_DEBIAN_DISTRO=bookworm
-ARG GO_VERSION=1.26.5
+ARG GO_VERSION=1.26.8
 # XX_VERSION specifies the version of the xx utility to use.
 # It must be a valid tag in the docker.io/tonistiigi/xx image repository.
@@ -1 +1 @@
-29.7.2
+29.8.2
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 // Package hooks defines the contract between the Docker CLI and CLI plugin hook
 // implementations.
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package hooks
@@ -3,6 +3,7 @@ package manager
 import (
 	"os"
 	"path/filepath"
 	"slices"
 	"sync"
 	"testing"
@@ -45,7 +46,7 @@ func TestPluginStubCompletionRestoresOSArgs(t *testing.T) {
 	t.Cleanup(func() { os.Args = savedArgs })
 	originalArgs := []string{"docker", "image", "ls"}
-	os.Args = append([]string(nil), originalArgs...)
+	os.Args = slices.Clone(originalArgs)
 	_, directive := cmd.ValidArgsFunction(cmd, []string{"--all"}, "alp")
 	assert.Equal(t, directive, cobra.ShellCompDirectiveError)
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package manager
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package manager
@@ -1,3 +1,6 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package manager
 import (
@@ -6,7 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"sort"
+	slices "slices"
 	"strings"
 	"sync"
@@ -164,8 +167,8 @@ func ListPlugins(dockerCli config.Provider, rootcmd *cobra.Command) ([]Plugin, e
 		return nil, err
 	}
-	sort.Slice(plugins, func(i, j int) bool {
+	slices.SortFunc(plugins, func(a, b Plugin) int {
-		return sortorder.NaturalLess(plugins[i].Name, plugins[j].Name)
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 	return plugins, nil
@@ -1,3 +1,6 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package manager
 import (
@@ -167,8 +170,7 @@ func (p *Plugin) RunHook(ctx context.Context, hookData hooks.Request) ([]byte, e
 	out, err := pCmd.Output()
 	if err != nil {
-		var exitErr *exec.ExitError
+		if _, ok := errors.AsType[*exec.ExitError](err); ok {
 		if errors.As(err, &exitErr) {
 			return nil, wrapAsPluginError(err, "plugin hook subcommand exited unsuccessfully")
 		}
 		return nil, wrapAsPluginError(err, "failed to execute plugin hook subcommand: "+pCmd.String())
@@ -1,3 +1,6 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package plugin
 import (
@@ -97,8 +100,7 @@ func Run(makeCmd func(command.Cli) *cobra.Command, meta metadata.Metadata, ops .
 	plugin := makeCmd(dockerCLI)
 	if err := RunPlugin(dockerCLI, plugin, meta); err != nil {
-		var stErr cli.StatusError
+		if stErr, ok := errors.AsType[cli.StatusError](err); ok {
 		if errors.As(err, &stErr) {
 			// StatusError should only be used for errors, and all errors should
 			// have a non-zero exit status, so never exit with 0
 			if stErr.StatusCode == 0 { // FIXME(thaJeztah): this should never be used with a zero status-code. Check if we do this anywhere.
@@ -1,9 +1,12 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package cli
 import (
 	"fmt"
 	"os"
-	"sort"
+	"slices"
 	"strings"
 	"github.com/docker/cli/cli-plugins/metadata"
@@ -273,8 +276,8 @@ func topCommands(cmd *cobra.Command) []*cobra.Command {
 			cmds = append(cmds, sub)
 		}
 	}
-	sort.SliceStable(cmds, func(i, j int) bool {
+	slices.SortStableFunc(cmds, func(a, b *cobra.Command) int {
-		return sortorder.NaturalLess(cmds[i].Annotations["category-top"], cmds[j].Annotations["category-top"])
+		return sortorder.NaturalCompare(a.Annotations["category-top"], b.Annotations["category-top"])
 	})
 	return cmds
 }
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package command
@@ -316,7 +316,11 @@ func newAPIClientFromEndpoint(ep docker.Endpoint, configFile *configfile.ConfigF
 		opts = append(opts, withCustomHeaders)
 	}
 	opts = append(opts, extraOpts...)
-	return client.New(opts...)
+	apiClient, err := client.New(opts...)
 	if err != nil {
 		return nil, err
 	}
 	return apiClient, nil
 }
 func resolveDockerEndpoint(s store.Reader, contextName string) (docker.Endpoint, error) {
@@ -132,6 +132,15 @@ func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
 	assert.Equal(t, apiclient.ClientVersion(), expectedVersion)
 }
 func TestNewAPIClientFromFlagsWithInvalidAPIVersionFromEnv(t *testing.T) {
 	t.Setenv("DOCKER_API_VERSION", "1")
 	t.Setenv("DOCKER_HOST", ":2375")
 	apiClient, err := NewAPIClientFromFlags(&flags.ClientOptions{}, &configfile.ConfigFile{})
 	assert.ErrorContains(t, err, "invalid API version")
 	assert.Check(t, apiClient == nil)
 }
 type fakeClient struct {
 	client.Client
 	pingFunc   func() (client.PingResult, error)
@@ -3,9 +3,9 @@ package completion
 import (
 	"context"
 	"errors"
 	"sort"
 	"testing"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/image"
 	"github.com/moby/moby/api/types/network"
@@ -177,9 +177,10 @@ func TestCompleteEnvVarNames(t *testing.T) {
 	values, directives := EnvVarNames()(nil, nil, "")
 	assert.Check(t, is.Equal(directives&cobra.ShellCompDirectiveNoFileComp, cobra.ShellCompDirectiveNoFileComp), "Should not perform file completion")
 	sort.Strings(values)
 	expected := []string{"ENV_A", "ENV_B"}
-	assert.Check(t, is.DeepEqual(values, expected))
+	assert.Check(t, is.DeepEqual(values, expected, cmpopts.SortSlices(func(a, b string) bool {
 		return a < b
 	})))
 }
 func TestCompleteFileNames(t *testing.T) {
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package config
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package config
@@ -1,8 +1,11 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package config
 import (
 	"context"
-	"sort"
+	"slices"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
 	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -62,8 +66,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		}
 	}
-	sort.Slice(res.Items, func(i, j int) bool {
+	slices.SortFunc(res.Items, func(a, b swarm.Config) int {
-		return sortorder.NaturalLess(res.Items[i].Spec.Name, res.Items[j].Spec.Name)
+		return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 	})
 	configCtx := formatter.Context{
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package container
@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
 	"sort"
 	"strings"
 	"testing"
@@ -15,6 +14,7 @@ import (
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/internal/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/system"
 	"github.com/moby/moby/client"
@@ -284,12 +284,12 @@ func TestCreateContainerWithProxyConfig(t *testing.T) {
 		"ALL_PROXY=allProxy",
 		"all_proxy=allProxy",
 	}
 	sort.Strings(expected)
 	fakeCLI := test.NewFakeCli(&fakeClient{
 		createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
-			sort.Strings(options.Config.Env)
+			assert.DeepEqual(t, options.Config.Env, expected, cmpopts.SortSlices(func(a, b string) bool {
-			assert.DeepEqual(t, options.Config.Env, expected)
+				return a < b
 			}))
 			return client.ContainerCreateResult{}, nil
 		},
 	})
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package container
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package container
@@ -139,6 +139,7 @@ type containerOptions struct {
 	runtime             string
 	autoRemove          bool
 	init                bool
 	umask               opts.UmaskOpt
 	annotations         *opts.MapOpts
 	Image string
@@ -313,6 +314,9 @@ func addFlags(flags *pflag.FlagSet) *containerOptions {
 	flags.Var(&copts.shmSize, "shm-size", "Size of /dev/shm")
 	flags.StringVar(&copts.utsMode, "uts", "", "UTS namespace to use")
 	flags.StringVar(&copts.runtime, "runtime", "", "Runtime to use for this container")
 	flags.Var(&copts.umask, "umask", "Set umask for the container")
 	flags.SetAnnotation("umask", "version", []string{"1.56"})
 	flags.SetAnnotation("umask", "ostype", []string{"linux"})
 	flags.BoolVar(&copts.init, "init", false, "Run an init inside the container that forwards signals and reaps processes")
 	flags.SetAnnotation("init", "version", []string{"1.25"})
@@ -710,6 +714,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 		MaskedPaths:    maskedPaths,
 		ReadonlyPaths:  readonlyPaths,
 		Annotations:    copts.annotations.GetAll(),
 		Umask:          copts.umask.Value(),
 	}
 	if copts.autoRemove && !hostConfig.RestartPolicy.IsNone() {
@@ -154,6 +154,19 @@ func TestParseRunLinks(t *testing.T) {
 	}
 }
 func TestParseRunWithoutUmask(t *testing.T) {
 	_, hostConfig, _, err := parseRun([]string{"ubuntu", "bash"})
 	assert.NilError(t, err)
 	assert.Assert(t, hostConfig.Umask == nil)
 }
 func TestParseRunUmask(t *testing.T) {
 	_, hostConfig, _, err := parseRun([]string{"--umask", "0022", "ubuntu", "bash"})
 	assert.NilError(t, err)
 	assert.Assert(t, hostConfig.Umask != nil)
 	assert.Equal(t, uint32(0o22), *hostConfig.Umask)
 }
 func TestParseRunAttach(t *testing.T) {
 	tests := []struct {
 		input    string
@@ -1,10 +1,13 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package container
 import (
 	"context"
 	"fmt"
 	"net"
-	"sort"
+	"slices"
 	"strings"
 	"github.com/docker/cli/cli"
@@ -80,9 +83,7 @@ func runPort(ctx context.Context, dockerCli command.Cli, opts *portOptions) erro
 	}
 	if len(out) > 0 {
-		sort.Slice(out, func(i, j int) bool {
+		slices.SortFunc(out, sortorder.NaturalCompare)
 			return sortorder.NaturalLess(out[i], out[j])
 		})
 		_, _ = fmt.Fprintln(dockerCli.Out(), strings.Join(out, "\n"))
 	}
@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
 	"sort"
 	"sync"
 	"testing"
 	"github.com/docker/cli/internal/test"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -87,8 +87,9 @@ func TestRestart(t *testing.T) {
 			} else {
 				assert.Check(t, is.Nil(err))
 			}
-			sort.Strings(restarted)
+			assert.Check(t, is.DeepEqual(restarted, tc.restarted, cmpopts.SortSlices(func(a, b string) bool {
-			assert.Check(t, is.DeepEqual(restarted, tc.restarted))
+				return a < b
 			})))
 		})
 	}
 }
@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
 	"sort"
 	"sync"
 	"testing"
 	"github.com/docker/cli/internal/test"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 )
@@ -53,8 +53,10 @@ func TestRemoveForce(t *testing.T) {
 				assert.NilError(t, err)
 			}
 			assert.Equal(t, cli.ErrBuffer().String(), "")
-			sort.Strings(removed)
+			expected := []string{"mycontainer", "nosuchcontainer"}
-			assert.DeepEqual(t, removed, []string{"mycontainer", "nosuchcontainer"})
+			assert.DeepEqual(t, removed, expected, cmpopts.SortSlices(func(a, b string) bool {
 				return a < b
 			}))
 		})
 	}
 }
@@ -1,3 +1,6 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package container
 import (
@@ -169,8 +172,7 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 			}
 		}
 		if attachErr := <-cErr; attachErr != nil {
-			var escapeError term.EscapeError
+			if _, ok := errors.AsType[term.EscapeError](attachErr); ok {
 			if errors.As(attachErr, &escapeError) {
 				// The user entered the detach escape sequence.
 				return nil
 			}
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package container
@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
 	"sort"
 	"sync"
 	"testing"
 	"github.com/docker/cli/internal/test"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -88,8 +88,9 @@ func TestStop(t *testing.T) {
 			} else {
 				assert.Check(t, is.Nil(err))
 			}
-			sort.Strings(stopped)
+			assert.Check(t, is.DeepEqual(stopped, tc.stopped, cmpopts.SortSlices(func(a, b string) bool {
-			assert.Check(t, is.DeepEqual(stopped, tc.stopped))
+				return a < b
 			})))
 		})
 	}
 }
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package container
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package command
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package context
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package context
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package context
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package context
@@ -1,12 +1,12 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package context
 import (
 	"fmt"
 	"os"
-	"sort"
+	"slices"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -101,8 +101,8 @@ func runList(dockerCli command.Cli, opts *listOptions) error {
 			Error:   errMsg,
 		})
 	}
-	sort.Slice(contexts, func(i, j int) bool {
+	slices.SortFunc(contexts, func(a, b *formatter.ClientContext) int {
-		return sortorder.NaturalLess(contexts[i].Name, contexts[j].Name)
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 	if err := format(dockerCli, opts, contexts); err != nil {
 		return err
@@ -1,3 +1,6 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package context
 import (
@@ -69,8 +72,7 @@ func parseBool(config map[string]string, name string) (bool, error) {
 	}
 	res, err := strconv.ParseBool(strVal)
 	if err != nil {
-		var nErr *strconv.NumError
+		if nErr, ok := errors.AsType[*strconv.NumError](err); ok {
 		if errors.As(err, &nErr) {
 			return res, fmt.Errorf("%s: parsing %q: %w", name, nErr.Num, nErr.Err)
 		}
 		return res, fmt.Errorf("%s: %w", name, err)
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package command
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package command
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package command
@@ -1,7 +1,10 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package formatter
 import (
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -52,20 +55,20 @@ shared: {{.Shared}}
 }
 func buildCacheSort(buildCache []build.CacheRecord) {
-	sort.Slice(buildCache, func(i, j int) bool {
+	slices.SortFunc(buildCache, func(a, b build.CacheRecord) int {
 		lui, luj := buildCache[i].LastUsedAt, buildCache[j].LastUsedAt
 		switch {
-		case lui == nil && luj == nil:
+		case a.LastUsedAt == nil && b.LastUsedAt == nil:
-			return strings.Compare(buildCache[i].ID, buildCache[j].ID) < 0
+			return strings.Compare(a.ID, b.ID)
-		case lui == nil:
+		case a.LastUsedAt == nil:
-			return true
+			return -1
-		case luj == nil:
+		case b.LastUsedAt == nil:
-			return false
+			return 1
 		case lui.Equal(*luj):
 			return strings.Compare(buildCache[i].ID, buildCache[j].ID) < 0
 		default:
 			return lui.Before(*luj)
 		}
 		if c := a.LastUsedAt.Compare(*b.LastUsedAt); c != 0 {
 			return c
 		}
 		return strings.Compare(a.ID, b.ID)
 	})
 }
@@ -1,12 +1,13 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
 import (
 	"cmp"
 	"fmt"
 	"net"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -295,7 +296,7 @@ func (c *ContainerContext) Labels() string {
 	for k, v := range c.c.Labels {
 		joinLabels = append(joinLabels, k+"="+v)
 	}
-	sort.Strings(joinLabels)
+	slices.Sort(joinLabels)
 	return strings.Join(joinLabels, ",")
 }
@@ -395,9 +396,7 @@ func DisplayablePorts(ports []container.PortSummary) string {
 	var result []string
 	var hostMappings []string
 	var groupMapKeys []string
-	sort.Slice(ports, func(i, j int) bool {
+	slices.SortFunc(ports, comparePorts)
 		return comparePorts(ports[i], ports[j])
 	})
 	for _, port := range ports {
 		current := port.PrivatePort
@@ -452,18 +451,13 @@ func formGroup(key string, start, last uint16) string {
 	return group + "/" + groupType
 }
-func comparePorts(i, j container.PortSummary) bool {
+// comparePorts compares ports by private port, IP address, public port,
-	if i.PrivatePort != j.PrivatePort {
+// and protocol, in that order.
-		return i.PrivatePort < j.PrivatePort
+func comparePorts(a, b container.PortSummary) int {
-	}
+	return cmp.Or(
-
+		cmp.Compare(a.PrivatePort, b.PrivatePort),
-	if i.IP != j.IP {
+		a.IP.Compare(b.IP),
-		return i.IP.String() < j.IP.String()
+		cmp.Compare(a.PublicPort, b.PublicPort),
-	}
+		cmp.Compare(a.Type, b.Type),
-
+	)
 	if i.PublicPort != j.PublicPort {
 		return i.PublicPort < j.PublicPort
 	}
 	return i.Type < j.Type
 }
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
@@ -946,6 +946,24 @@ func TestDisplayablePorts(t *testing.T) {
 			},
 			expected: "80/tcp, 80/udp, 1024/tcp, 1024/udp, 12345/sctp, 1.1.1.1:1024->80/tcp, 1.1.1.1:1024->80/udp, 2.1.1.1:1024->80/tcp, 2.1.1.1:1024->80/udp, 1.1.1.1:80->1024/tcp, 1.1.1.1:80->1024/udp, 2.1.1.1:80->1024/tcp, 2.1.1.1:80->1024/udp", //nolint:revive // ignore line-length-limit (revive)
 		},
 		{
 			// host IPs are ordered numerically, not lexicographically:
 			// "10.0.0.2" sorts as a string before "9.0.0.1".
 			ports: []container.PortSummary{
 				{
 					IP:          netip.MustParseAddr("10.0.0.2"),
 					PublicPort:  8080,
 					PrivatePort: 80,
 					Type:        "tcp",
 				}, {
 					IP:          netip.MustParseAddr("9.0.0.1"),
 					PublicPort:  8081,
 					PrivatePort: 80,
 					Type:        "tcp",
 				},
 			},
 			expected: "9.0.0.1:8081->80/tcp, 10.0.0.2:8080->80/tcp",
 		},
 	}
 	for _, port := range cases {
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package formatter
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package idresolver
@@ -1,3 +1,6 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package image
 import (
@@ -364,8 +367,7 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 	err = jsonstream.Display(ctx, response.Body, streams.NewOut(buildBuff), jsonstream.WithAuxCallback(aux))
 	if err != nil {
-		var jerr *jsonstream.JSONError
+		if jerr, ok := errors.AsType[*jsonstream.JSONError](err); ok {
 		if errors.As(err, &jerr) {
 			// If no error code is set, default to 1
 			if jerr.Code == 0 {
 				jerr.Code = 1
@@ -1,3 +1,6 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package git
 import (
@@ -7,6 +10,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
 	"slices"
 	"strings"
 	"github.com/moby/sys/symlink"
@@ -202,7 +206,7 @@ func (repo gitRepo) checkout(root string) (string, error) {
 }
 func (repo gitRepo) gitWithinDir(dir string, args ...string) ([]byte, error) {
-	args = append([]string{"-c", "protocol.file.allow=never"}, args...) // Block sneaky repositories from using repos from the filesystem as submodules.
+	args = slices.Concat([]string{"-c", "protocol.file.allow=never"}, args) // Block sneaky repositories from using repos from the filesystem as submodules.
 	cmd := exec.Command("git", args...)
 	cmd.Dir = dir
 	// Disable unsafe remote protocols.
@@ -8,7 +8,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"sort"
+	"slices"
 	"testing"
 	"github.com/docker/cli/cli/streams"
@@ -211,6 +211,6 @@ func (f *fakeBuild) filenames(t *testing.T) []string {
 	for _, header := range h {
 		names = append(names, header.Name)
 	}
-	sort.Strings(names)
+	slices.Sort(names)
 	return names
 }
@@ -52,6 +52,14 @@ func TestNewHistoryCommandErrors(t *testing.T) {
 }
 func TestNewHistoryCommandSuccess(t *testing.T) {
 	// Set to UTC timezone as timestamps in output are
 	// printed in the current timezone
 	local := time.Local
 	time.Local = time.UTC
 	t.Cleanup(func() {
 		time.Local = local
 	})
 	testCases := []struct {
 		name             string
 		args             []string
@@ -118,9 +126,6 @@ func TestNewHistoryCommandSuccess(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			// Set to UTC timezone as timestamps in output are
 			// printed in the current timezone
 			t.Setenv("TZ", "UTC")
 			cli := test.NewFakeCli(&fakeClient{imageHistoryFunc: tc.imageHistoryFunc})
 			cmd := newHistoryCommand(cli)
 			cmd.SetOut(io.Discard)
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package image
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package image
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package image
@@ -102,9 +102,11 @@ func TestRunPushRespectsNoColorForAuxNotes(t *testing.T) {
 				SelectedManifest:             ocispec.Descriptor{Digest: "sha256:2222222222222222222222222222222222222222222222222222222222222222"},
 			})
 			assert.NilError(t, err)
-			line := append([]byte(`{"aux":`), aux...)
+			var buf bytes.Buffer
-			line = append(line, '}', '\n')
+			buf.WriteString(`{"aux":`)
-			return fakeStreamResult{ReadCloser: io.NopCloser(bytes.NewReader(line))}, nil
+			buf.Write(aux)
 			buf.WriteString("}\n")
 			return fakeStreamResult{ReadCloser: io.NopCloser(&buf)}, nil
 		},
 	})
 	cli.Out().SetIsTerminal(true)
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package image
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package inspect
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package manifest
@@ -48,27 +48,6 @@ func newManifestStore(dockerCLI command.Cli) store.Store {
 	return store.NewStore(filepath.Join(config.Dir(), "manifests"))
 }
 // authConfigKey is the key used to store credentials for Docker Hub. It is
 // a copy of [registry.IndexServer].
 //
 // [registry.IndexServer]: https://pkg.go.dev/github.com/docker/docker@v28.3.3+incompatible/registry#IndexServer
 const authConfigKey = "https://index.docker.io/v1/"
 // getAuthConfigKey special-cases using the full index address of the official
 // index as the AuthConfig key, and uses the (host)name[:port] for private indexes.
 //
 // It is similar to [registry.GetAuthConfigKey], but does not require on
 // [registrytypes.IndexInfo] as intermediate.
 //
 // [registry.GetAuthConfigKey]: https://pkg.go.dev/github.com/docker/docker@v28.3.3+incompatible/registry#GetAuthConfigKey
 // [registrytypes.IndexInfo]: https://pkg.go.dev/github.com/docker/docker@v28.3.3+incompatible/api/types/registry#IndexInfo
 func getAuthConfigKey(domainName string) string {
 	if domainName == "docker.io" || domainName == "index.docker.io" {
 		return authConfigKey
 	}
 	return domainName
 }
 // newRegistryClient returns a client for communicating with a Docker distribution
 // registry
 func newRegistryClient(dockerCLI command.Cli, allowInsecure bool) registryclient.RegistryClient {
@@ -78,8 +57,7 @@ func newRegistryClient(dockerCLI command.Cli, allowInsecure bool) registryclient
 	}
 	cfg := dockerCLI.ConfigFile()
 	resolver := func(ctx context.Context, domainName string) registry.AuthConfig {
-		configKey := getAuthConfigKey(domainName)
+		a, _ := cfg.GetAuthConfig(domainName)
 		a, _ := cfg.GetAuthConfig(configKey)
 		return registry.AuthConfig{
 			Username:      a.Username,
 			Password:      a.Password,
@@ -189,8 +189,6 @@ func TestNetworkCreateWithFlags(t *testing.T) {
 // TestNetworkCreateIPv4 verifies behavior of the "--ipv4" option. This option
 // is an optional bool, and must default to "nil", not "true" or "false".
 func TestNetworkCreateIPv4(t *testing.T) {
 	boolPtr := func(val bool) *bool { return &val }
 	tests := []struct {
 		doc, name string
 		flags     []string
@@ -205,19 +203,19 @@ func TestNetworkCreateIPv4(t *testing.T) {
 			doc:      "IPv4 enabled",
 			name:     "ipv4-enabled",
 			flags:    []string{"--ipv4=true"},
-			expected: boolPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPv4 enabled (shorthand)",
 			name:     "ipv4-enabled-shorthand",
 			flags:    []string{"--ipv4"},
-			expected: boolPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPv4 disabled",
 			name:     "ipv4-disabled",
 			flags:    []string{"--ipv4=false"},
-			expected: boolPtr(false),
+			expected: new(false),
 		},
 	}
@@ -243,8 +241,6 @@ func TestNetworkCreateIPv4(t *testing.T) {
 // TestNetworkCreateIPv6 verifies behavior of the "--ipv6" option. This option
 // is an optional bool, and must default to "nil", not "true" or "false".
 func TestNetworkCreateIPv6(t *testing.T) {
 	strPtr := func(val bool) *bool { return &val }
 	tests := []struct {
 		doc, name string
 		flags     []string
@@ -259,19 +255,19 @@ func TestNetworkCreateIPv6(t *testing.T) {
 			doc:      "IPV6 enabled",
 			name:     "ipv6-enabled",
 			flags:    []string{"--ipv6=true"},
-			expected: strPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPV6 enabled (shorthand)",
 			name:     "ipv6-enabled-shorthand",
 			flags:    []string{"--ipv6"},
-			expected: strPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPV6 disabled",
 			name:     "ipv6-disabled",
 			flags:    []string{"--ipv6=false"},
-			expected: strPtr(false),
+			expected: new(false),
 		},
 	}
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package network
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package network
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package network
@@ -1,8 +1,11 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package network
 import (
 	"context"
-	"sort"
+	"slices"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
 	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -61,8 +65,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		}
 	}
-	sort.Slice(res.Items, func(i, j int) bool {
+	slices.SortFunc(res.Items, func(a, b network.Summary) int {
-		return sortorder.NaturalLess(res.Items[i].Name, res.Items[j].Name)
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 	networksCtx := formatter.Context{
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package node
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package node
@@ -1,8 +1,11 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package node
 import (
 	"context"
-	"sort"
+	"slices"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
 	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -73,8 +77,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		Output: dockerCLI.Out(),
 		Format: newFormat(format, options.quiet),
 	}
-	sort.Slice(res.Items, func(i, j int) bool {
+	slices.SortFunc(res.Items, func(a, b swarm.Node) int {
-		return sortorder.NaturalLess(res.Items[i].Description.Hostname, res.Items[j].Description.Hostname)
+		return sortorder.NaturalCompare(a.Description.Hostname, b.Description.Hostname)
 	})
 	return formatWrite(nodesCtx, res, info)
 }
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package node
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package plugin
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package plugin
@@ -1,8 +1,11 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package plugin
 import (
 	"context"
-	"sort"
+	"slices"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
 	"github.com/moby/moby/api/types/plugin"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -54,8 +58,8 @@ func runList(ctx context.Context, dockerCli command.Cli, options listOptions) er
 		return err
 	}
-	sort.Slice(resp.Items, func(i, j int) bool {
+	slices.SortFunc(resp.Items, func(a, b plugin.Plugin) int {
-		return sortorder.NaturalLess(resp.Items[i].Name, resp.Items[j].Name)
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 	format := options.format
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package secret
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package secret
@@ -1,8 +1,11 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package secret
 import (
 	"context"
-	"sort"
+	"slices"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
 	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -59,8 +63,8 @@ func runSecretList(ctx context.Context, dockerCLI command.Cli, options listOptio
 		}
 	}
-	sort.Slice(res.Items, func(i, j int) bool {
+	slices.SortFunc(res.Items, func(a, b swarm.Secret) int {
-		return sortorder.NaturalLess(res.Items[i].Spec.Name, res.Items[j].Spec.Name)
+		return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 	})
 	secretCtx := formatter.Context{
@@ -1,9 +1,13 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package service
 import (
 	"cmp"
 	"errors"
 	"fmt"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -615,8 +619,8 @@ func NewListFormat(source string, quiet bool) formatter.Format {
 // ListFormatWrite writes the context
 func ListFormatWrite(ctx formatter.Context, services client.ServiceListResult) error {
 	render := func(format func(subContext formatter.SubContext) error) error {
-		sort.Slice(services.Items, func(i, j int) bool {
+		slices.SortFunc(services.Items, func(a, b swarm.Service) int {
-			return sortorder.NaturalLess(services.Items[i].Spec.Name, services.Items[j].Spec.Name)
+			return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 		})
 		for _, service := range services.Items {
 			serviceCtx := &serviceContext{service: service}
@@ -775,17 +779,16 @@ func (c *serviceContext) Ports() string {
 		return ""
 	}
-	pr := portRange{}
+	// Sort by protocol first, then by published port.
-	ports := []string{}
+	slices.SortFunc(c.service.Endpoint.Ports, func(a, b swarm.PortConfig) int {
-
+		return cmp.Or(
-	servicePorts := c.service.Endpoint.Ports
+			cmp.Compare(a.Protocol, b.Protocol),
-	sort.Slice(servicePorts, func(i, j int) bool {
+			cmp.Compare(a.PublishedPort, b.PublishedPort),
-		if servicePorts[i].Protocol == servicePorts[j].Protocol {
+		)
 			return servicePorts[i].PublishedPort < servicePorts[j].PublishedPort
 		}
 		return servicePorts[i].Protocol < servicePorts[j].Protocol
 	})
 	var pr portRange
 	var ports []string
 	for _, p := range c.service.Endpoint.Ports {
 		if p.PublishMode == swarm.PortConfigPublishModeIngress {
 			prIsRange := pr.tEnd != pr.tStart
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package service
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package service
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package service
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 // Package genericresource is a local fork of SwarmKit's [genericresource] package,
 // without protobuf dependencies.
@@ -1,3 +1,6 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
 //go:build go1.26
 package service
 import (
@@ -6,7 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
@@ -314,7 +317,7 @@ func (lw *logWriter) Write(buf []byte) (int, error) {
 			d = append(d, k+"="+details[k])
 		}
 		// then sort em
-		sort.Strings(d)
+		slices.Sort(d)
 		// then join and append
 		output = append(output, []byte(strings.Join(d, ","))...)
 		output = append(output, ' ')
@@ -1,15 +1,15 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package service
 import (
 	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"net/netip"
 	"slices"
 	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -737,15 +737,15 @@ func (options *serviceOptions) ToService(ctx context.Context, apiClient client.N
 	}
 	networks := convertNetworks(options.networks)
-	for i, net := range networks {
+	for i := range networks {
-		nwID, err := resolveNetworkID(ctx, apiClient, net.Target)
+		nwID, err := resolveNetworkID(ctx, apiClient, networks[i].Target)
 		if err != nil {
 			return service, err
 		}
 		networks[i].Target = nwID
 	}
-	sort.Slice(networks, func(i, j int) bool {
+	slices.SortFunc(networks, func(a, b swarm.NetworkAttachmentConfig) int {
-		return networks[i].Target < networks[j].Target
+		return cmp.Compare(a.Target, b.Target)
 	})
 	resources, err := options.resources.ToResourceRequirements(flags)
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package progress
@@ -1,16 +1,16 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 package service
 import (
 	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"maps"
 	"net/netip"
 	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -352,8 +352,10 @@ func updateService(ctx context.Context, apiClient client.NetworkAPIClient, flags
 	if err := updateIsolation(flagIsolation, &cspec.Isolation); err != nil {
 		return err
 	}
-	if err := updateMounts(flags, &cspec.Mounts); err != nil {
+	if anyChanged(flags, flagMountAdd, flagMountRemove) {
-		return err
+		if err := updateMounts(flags, &cspec.Mounts); err != nil {
 			return err
 		}
 	}
 	updateSysCtls(flags, &task.ContainerSpec.Sysctls)
@@ -635,7 +637,7 @@ func updatePlacementConstraints(flags *pflag.FlagSet, placement *swarm.Placement
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newConstraints)
+	slices.Sort(newConstraints)
 	placement.Constraints = newConstraints
 }
@@ -720,7 +722,7 @@ func updateSysCtls(flags *pflag.FlagSet, field *map[string]string) {
 }
 func updateUlimits(flags *pflag.FlagSet, ulimits []*container.Ulimit) []*container.Ulimit {
-	newUlimits := make(map[string]*container.Ulimit)
+	newUlimits := make(map[string]*container.Ulimit, len(ulimits))
 	for _, ulimit := range ulimits {
 		newUlimits[ulimit.Name] = ulimit
@@ -737,17 +739,9 @@ func updateUlimits(flags *pflag.FlagSet, ulimits []*container.Ulimit) []*contain
 			newUlimits[ulimit.Name] = ulimit
 		}
 	}
-	if len(newUlimits) == 0 {
+	return slices.SortedFunc(maps.Values(newUlimits), func(a, b *container.Ulimit) int {
-		return nil
+		return cmp.Compare(a.Name, b.Name)
 	}
 	limits := make([]*container.Ulimit, 0, len(newUlimits))
 	for _, ulimit := range newUlimits {
 		limits = append(limits, ulimit)
 	}
 	sort.SliceStable(limits, func(i, j int) bool {
 		return limits[i].Name < limits[j].Name
 	})
 	return limits
 }
 func updateEnvironment(flags *pflag.FlagSet, field *[]string) {
@@ -953,14 +947,12 @@ func updateMounts(flags *pflag.FlagSet, mounts *[]mount.Mount) error {
 			newMounts = append(newMounts, mnt)
 		}
 	}
-	sort.Slice(newMounts, func(i, j int) bool {
+	// Sort mounts by source, then by target.
-		a, b := newMounts[i], newMounts[j]
+	slices.SortFunc(newMounts, func(a, b mount.Mount) int {
-
+		return cmp.Or(
-		if a.Source == b.Source {
+			cmp.Compare(a.Source, b.Source),
-			return a.Target < b.Target
+			cmp.Compare(a.Target, b.Target),
-		}
+		)
 		return a.Source < b.Source
 	})
 	*mounts = newMounts
 	return nil
@@ -980,7 +972,7 @@ func updateGroups(flags *pflag.FlagSet, groups *[]string) error {
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newGroups)
+	slices.Sort(newGroups)
 	*groups = newGroups
 	return nil
@@ -1039,7 +1031,7 @@ func updateDNSConfig(flags *pflag.FlagSet, config **swarm.DNSConfig) error {
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newConfig.Search)
+	slices.Sort(newConfig.Search)
 	options := (*config).Options
 	if flags.Changed(flagDNSOptionAdd) {
@@ -1054,7 +1046,7 @@ func updateDNSConfig(flags *pflag.FlagSet, config **swarm.DNSConfig) error {
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newConfig.Options)
+	slices.Sort(newConfig.Options)
 	*config = newConfig
 	return nil
@@ -1107,12 +1099,8 @@ portLoop:
 		}
 	}
-	// Sort the PortConfig to avoid unnecessary updates
+	// Sort the PortConfig to avoid unnecessary updates.
-	sort.Slice(newPorts, func(i, j int) bool {
+	slices.SortFunc(newPorts, swarm.PortConfig.Compare)
 		// We convert PortConfig into `port/protocol`, e.g., `80/tcp`
 		// In updatePorts we already filter out with map so there is duplicate entries
 		return portConfigToString(&newPorts[i]) < portConfigToString(&newPorts[j])
 	})
 	*portConfig = newPorts
 	return nil
 }
@@ -1348,8 +1336,8 @@ func updateNetworks(ctx context.Context, apiClient client.NetworkAPIClient, flag
 		}
 	}
-	sort.Slice(newNetworks, func(i, j int) bool {
+	slices.SortFunc(newNetworks, func(a, b swarm.NetworkAttachmentConfig) int {
-		return newNetworks[i].Target < newNetworks[j].Target
+		return cmp.Compare(a.Target, b.Target)
 	})
 	spec.TaskTemplate.Networks = newNetworks
@@ -1523,10 +1511,6 @@ func capsList(caps map[string]bool) []string {
 	if caps[opts.AllCapabilities] {
 		return []string{opts.AllCapabilities}
 	}
-	out := make([]string, 0, len(caps))
+
-	for c := range caps {
+	return slices.Sorted(maps.Keys(caps))
 		out = append(out, c)
 	}
 	sort.Strings(out)
 	return out
 }
@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/netip"
-	"sort"
+	"slices"
 	"strconv"
 	"testing"
 	"time"
@@ -141,7 +141,7 @@ func TestUpdateEnvironment(t *testing.T) {
 	updateEnvironment(flags, &envs)
 	assert.Assert(t, is.Len(envs, 2))
 	// Order has been removed in updateEnvironment (map)
-	sort.Strings(envs)
+	slices.Sort(envs)
 	assert.Check(t, is.Equal("toadd=newenv", envs[0]))
 	assert.Check(t, is.Equal("tokeep=value", envs[1]))
 }
@@ -250,6 +250,32 @@ func TestUpdateMounts(t *testing.T) {
 	assert.Check(t, is.Equal("/tokeep", mounts[1].Target))
 }
 func TestUpdateServiceForcePreservesMountOrder(t *testing.T) {
 	flags := newUpdateCommand(nil).Flags()
 	assert.NilError(t, flags.Set("force", "true"))
 	spec := &swarm.ServiceSpec{
 		TaskTemplate: swarm.TaskSpec{
 			ContainerSpec: &swarm.ContainerSpec{
 				Mounts: []mount.Mount{
 					{Type: mount.TypeVolume, Source: "z-volume", Target: "/data/z"},
 					{Type: mount.TypeVolume, Source: "a-volume", Target: "/data/a"},
 					{Type: mount.TypeVolume, Source: "m-volume", Target: "/data/m"},
 				},
 			},
 		},
 	}
 	err := updateService(context.Background(), nil, flags, spec)
 	assert.NilError(t, err)
 	assert.Equal(t, spec.TaskTemplate.ForceUpdate, uint64(1))
 	assert.DeepEqual(t, spec.TaskTemplate.ContainerSpec.Mounts, []mount.Mount{
 		{Type: mount.TypeVolume, Source: "z-volume", Target: "/data/z"},
 		{Type: mount.TypeVolume, Source: "a-volume", Target: "/data/a"},
 		{Type: mount.TypeVolume, Source: "m-volume", Target: "/data/m"},
 	})
 }
 func TestUpdateMountsWithDuplicateMounts(t *testing.T) {
 	flags := newUpdateCommand(nil).Flags()
 	flags.Set("mount-add", "type=volume,source=vol4,target=/toadd")
@@ -282,7 +308,7 @@ func TestUpdatePorts(t *testing.T) {
 	assert.Assert(t, is.Len(portConfigs, 2))
 	// Do a sort to have the order (might have changed by map)
 	targetPorts := []int{int(portConfigs[0].TargetPort), int(portConfigs[1].TargetPort)}
-	sort.Ints(targetPorts)
+	slices.Sort(targetPorts)
 	assert.Check(t, is.Equal(555, targetPorts[0]))
 	assert.Check(t, is.Equal(1000, targetPorts[1]))
 }
--- a/Show More
+++ b/Show More