Merge pull request #7288 from thaJeztah/bump_jose

vendor: github.com/go-jose/go-jose/v4 v4.1.5

.github/workflows/codeql.yml

@@ -64,18 +64,18 @@ jobs:
         name: Update Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.7"
+          go-version: "1.26.8"
           cache: false
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: go
       -
         name: Autobuild
-        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:go"

.github/workflows/pr-review.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   review:
-    uses: docker/docker-agent-action/.github/workflows/review-pr.yml@b08367e7e9a471822464be2bb9fdaa1c0fb6061b # v2.0.4
+    uses: docker/docker-agent-action/.github/workflows/review-pr.yml@06e1767af06263c93d712449cbf859778d9392ee # v2.0.5
     permissions:
       contents: read # Read repository files and PR diffs
       pull-requests: write # Post review comments

.github/workflows/test.yml

@@ -68,7 +68,7 @@ jobs:
         name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.7"
+          go-version: "1.26.8"
           cache: false
       -
         name: Test

.github/workflows/validate.yml

@@ -101,7 +101,7 @@ jobs:
         name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.7"
+          go-version: "1.26.8"
           cache: false
       -
         name: Run gocompat check

.golangci.yml

@@ -5,7 +5,7 @@ run:
   # which causes it to fallback to go1.17 semantics.
   #
   # TODO(thaJeztah): update "usetesting" settings to enable go1.24 features once our minimum version is go1.24
-  go: "1.26.7"
+  go: "1.26.8"
 
   timeout: 5m
 

Dockerfile

@@ -8,7 +8,7 @@ ARG BASE_VARIANT=alpine
 ARG ALPINE_VERSION=3.23
 ARG BASE_DEBIAN_DISTRO=bookworm
 
-ARG GO_VERSION=1.26.7
+ARG GO_VERSION=1.26.8
 
 # XX_VERSION specifies the version of the xx utility to use.
 # It must be a valid tag in the docker.io/tonistiigi/xx image repository.

cli-plugins/hooks/hook_types.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 // Package hooks defines the contract between the Docker CLI and CLI plugin hook
 // implementations.

cli-plugins/hooks/template.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package hooks
 

cli-plugins/manager/cobra_test.go

@@ -3,6 +3,7 @@ package manager
 import (
 	"os"
 	"path/filepath"
+	"slices"
 	"sync"
 	"testing"
 
@@ -45,7 +46,7 @@ func TestPluginStubCompletionRestoresOSArgs(t *testing.T) {
 	t.Cleanup(func() { os.Args = savedArgs })
 
 	originalArgs := []string{"docker", "image", "ls"}
-	os.Args = append([]string(nil), originalArgs...)
+	os.Args = slices.Clone(originalArgs)
 
 	_, directive := cmd.ValidArgsFunction(cmd, []string{"--all"}, "alp")
 	assert.Equal(t, directive, cobra.ShellCompDirectiveError)

cli-plugins/manager/error.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package manager
 

cli-plugins/manager/hooks.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package manager
 

cli-plugins/manager/manager.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package manager
 
 import (
@@ -6,7 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"sort"
+	slices "slices"
 	"strings"
 	"sync"
 
@@ -164,8 +167,8 @@ func ListPlugins(dockerCli config.Provider, rootcmd *cobra.Command) ([]Plugin, e
 		return nil, err
 	}
 
-	sort.Slice(plugins, func(i, j int) bool {
-		return sortorder.NaturalLess(plugins[i].Name, plugins[j].Name)
+	slices.SortFunc(plugins, func(a, b Plugin) int {
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 
 	return plugins, nil

cli-plugins/manager/plugin.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package manager
 
 import (
@@ -167,8 +170,7 @@ func (p *Plugin) RunHook(ctx context.Context, hookData hooks.Request) ([]byte, e
 
 	out, err := pCmd.Output()
 	if err != nil {
-		var exitErr *exec.ExitError
-		if errors.As(err, &exitErr) {
+		if _, ok := errors.AsType[*exec.ExitError](err); ok {
 			return nil, wrapAsPluginError(err, "plugin hook subcommand exited unsuccessfully")
 		}
 		return nil, wrapAsPluginError(err, "failed to execute plugin hook subcommand: "+pCmd.String())

cli-plugins/plugin/plugin.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package plugin
 
 import (
@@ -97,8 +100,7 @@ func Run(makeCmd func(command.Cli) *cobra.Command, meta metadata.Metadata, ops .
 	plugin := makeCmd(dockerCLI)
 
 	if err := RunPlugin(dockerCLI, plugin, meta); err != nil {
-		var stErr cli.StatusError
-		if errors.As(err, &stErr) {
+		if stErr, ok := errors.AsType[cli.StatusError](err); ok {
 			// StatusError should only be used for errors, and all errors should
 			// have a non-zero exit status, so never exit with 0
 			if stErr.StatusCode == 0 { // FIXME(thaJeztah): this should never be used with a zero status-code. Check if we do this anywhere.

cli/cobra.go

@@ -1,9 +1,12 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package cli
 
 import (
 	"fmt"
 	"os"
-	"sort"
+	"slices"
 	"strings"
 
 	"github.com/docker/cli/cli-plugins/metadata"
@@ -273,8 +276,8 @@ func topCommands(cmd *cobra.Command) []*cobra.Command {
 			cmds = append(cmds, sub)
 		}
 	}
-	sort.SliceStable(cmds, func(i, j int) bool {
-		return sortorder.NaturalLess(cmds[i].Annotations["category-top"], cmds[j].Annotations["category-top"])
+	slices.SortStableFunc(cmds, func(a, b *cobra.Command) int {
+		return sortorder.NaturalCompare(a.Annotations["category-top"], b.Annotations["category-top"])
 	})
 	return cmds
 }

cli/command/cli.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 
@@ -316,7 +316,11 @@ func newAPIClientFromEndpoint(ep docker.Endpoint, configFile *configfile.ConfigF
 		opts = append(opts, withCustomHeaders)
 	}
 	opts = append(opts, extraOpts...)
-	return client.New(opts...)
+	apiClient, err := client.New(opts...)
+	if err != nil {
+		return nil, err
+	}
+	return apiClient, nil
 }
 
 func resolveDockerEndpoint(s store.Reader, contextName string) (docker.Endpoint, error) {

cli/command/cli_test.go

@@ -132,6 +132,15 @@ func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
 	assert.Equal(t, apiclient.ClientVersion(), expectedVersion)
 }
 
+func TestNewAPIClientFromFlagsWithInvalidAPIVersionFromEnv(t *testing.T) {
+	t.Setenv("DOCKER_API_VERSION", "1")
+	t.Setenv("DOCKER_HOST", ":2375")
+
+	apiClient, err := NewAPIClientFromFlags(&flags.ClientOptions{}, &configfile.ConfigFile{})
+	assert.ErrorContains(t, err, "invalid API version")
+	assert.Check(t, apiClient == nil)
+}
+
 type fakeClient struct {
 	client.Client
 	pingFunc   func() (client.PingResult, error)

cli/command/completion/functions_test.go

@@ -3,9 +3,9 @@ package completion
 import (
 	"context"
 	"errors"
-	"sort"
 	"testing"
 
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/image"
 	"github.com/moby/moby/api/types/network"
@@ -177,9 +177,10 @@ func TestCompleteEnvVarNames(t *testing.T) {
 	values, directives := EnvVarNames()(nil, nil, "")
 	assert.Check(t, is.Equal(directives&cobra.ShellCompDirectiveNoFileComp, cobra.ShellCompDirectiveNoFileComp), "Should not perform file completion")
 
-	sort.Strings(values)
 	expected := []string{"ENV_A", "ENV_B"}
-	assert.Check(t, is.DeepEqual(values, expected))
+	assert.Check(t, is.DeepEqual(values, expected, cmpopts.SortSlices(func(a, b string) bool {
+		return a < b
+	})))
 }
 
 func TestCompleteFileNames(t *testing.T) {

cli/command/config/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package config
 

cli/command/config/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package config
 

cli/command/config/ls.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package config
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -62,8 +66,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		}
 	}
 
-	sort.Slice(res.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(res.Items[i].Spec.Name, res.Items[j].Spec.Name)
+	slices.SortFunc(res.Items, func(a, b swarm.Config) int {
+		return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 	})
 
 	configCtx := formatter.Context{

cli/command/container/completion.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 

cli/command/container/create_test.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
-	"sort"
 	"strings"
 	"testing"
 
@@ -15,6 +14,7 @@ import (
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/internal/test"
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/system"
 	"github.com/moby/moby/client"
@@ -284,12 +284,12 @@ func TestCreateContainerWithProxyConfig(t *testing.T) {
 		"ALL_PROXY=allProxy",
 		"all_proxy=allProxy",
 	}
-	sort.Strings(expected)
 
 	fakeCLI := test.NewFakeCli(&fakeClient{
 		createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
-			sort.Strings(options.Config.Env)
-			assert.DeepEqual(t, options.Config.Env, expected)
+			assert.DeepEqual(t, options.Config.Env, expected, cmpopts.SortSlices(func(a, b string) bool {
+				return a < b
+			}))
 			return client.ContainerCreateResult{}, nil
 		},
 	})

cli/command/container/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 

cli/command/container/opts.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 
@@ -139,6 +139,7 @@ type containerOptions struct {
 	runtime             string
 	autoRemove          bool
 	init                bool
+	umask               opts.UmaskOpt
 	annotations         *opts.MapOpts
 
 	Image string
@@ -313,6 +314,9 @@ func addFlags(flags *pflag.FlagSet) *containerOptions {
 	flags.Var(&copts.shmSize, "shm-size", "Size of /dev/shm")
 	flags.StringVar(&copts.utsMode, "uts", "", "UTS namespace to use")
 	flags.StringVar(&copts.runtime, "runtime", "", "Runtime to use for this container")
+	flags.Var(&copts.umask, "umask", "Set umask for the container")
+	flags.SetAnnotation("umask", "version", []string{"1.56"})
+	flags.SetAnnotation("umask", "ostype", []string{"linux"})
 
 	flags.BoolVar(&copts.init, "init", false, "Run an init inside the container that forwards signals and reaps processes")
 	flags.SetAnnotation("init", "version", []string{"1.25"})
@@ -710,6 +714,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 		MaskedPaths:    maskedPaths,
 		ReadonlyPaths:  readonlyPaths,
 		Annotations:    copts.annotations.GetAll(),
+		Umask:          copts.umask.Value(),
 	}
 
 	if copts.autoRemove && !hostConfig.RestartPolicy.IsNone() {

cli/command/container/opts_test.go

@@ -154,6 +154,19 @@ func TestParseRunLinks(t *testing.T) {
 	}
 }
 
+func TestParseRunWithoutUmask(t *testing.T) {
+	_, hostConfig, _, err := parseRun([]string{"ubuntu", "bash"})
+	assert.NilError(t, err)
+	assert.Assert(t, hostConfig.Umask == nil)
+}
+
+func TestParseRunUmask(t *testing.T) {
+	_, hostConfig, _, err := parseRun([]string{"--umask", "0022", "ubuntu", "bash"})
+	assert.NilError(t, err)
+	assert.Assert(t, hostConfig.Umask != nil)
+	assert.Equal(t, uint32(0o22), *hostConfig.Umask)
+}
+
 func TestParseRunAttach(t *testing.T) {
 	tests := []struct {
 		input    string

cli/command/container/port.go

@@ -1,10 +1,13 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package container
 
 import (
 	"context"
 	"fmt"
 	"net"
-	"sort"
+	"slices"
 	"strings"
 
 	"github.com/docker/cli/cli"
@@ -80,9 +83,7 @@ func runPort(ctx context.Context, dockerCli command.Cli, opts *portOptions) erro
 	}
 
 	if len(out) > 0 {
-		sort.Slice(out, func(i, j int) bool {
-			return sortorder.NaturalLess(out[i], out[j])
-		})
+		slices.SortFunc(out, sortorder.NaturalCompare)
 		_, _ = fmt.Fprintln(dockerCli.Out(), strings.Join(out, "\n"))
 	}
 

cli/command/container/restart_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
-	"sort"
 	"sync"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -87,8 +87,9 @@ func TestRestart(t *testing.T) {
 			} else {
 				assert.Check(t, is.Nil(err))
 			}
-			sort.Strings(restarted)
-			assert.Check(t, is.DeepEqual(restarted, tc.restarted))
+			assert.Check(t, is.DeepEqual(restarted, tc.restarted, cmpopts.SortSlices(func(a, b string) bool {
+				return a < b
+			})))
 		})
 	}
 }

cli/command/container/rm_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
-	"sort"
 	"sync"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 )
@@ -53,8 +53,10 @@ func TestRemoveForce(t *testing.T) {
 				assert.NilError(t, err)
 			}
 			assert.Equal(t, cli.ErrBuffer().String(), "")
-			sort.Strings(removed)
-			assert.DeepEqual(t, removed, []string{"mycontainer", "nosuchcontainer"})
+			expected := []string{"mycontainer", "nosuchcontainer"}
+			assert.DeepEqual(t, removed, expected, cmpopts.SortSlices(func(a, b string) bool {
+				return a < b
+			}))
 		})
 	}
 }

cli/command/container/start.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package container
 
 import (
@@ -169,8 +172,7 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 			}
 		}
 		if attachErr := <-cErr; attachErr != nil {
-			var escapeError term.EscapeError
-			if errors.As(attachErr, &escapeError) {
+			if _, ok := errors.AsType[term.EscapeError](attachErr); ok {
 				// The user entered the detach escape sequence.
 				return nil
 			}

cli/command/container/stats.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 

cli/command/container/stop_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
-	"sort"
 	"sync"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -88,8 +88,9 @@ func TestStop(t *testing.T) {
 			} else {
 				assert.Check(t, is.Nil(err))
 			}
-			sort.Strings(stopped)
-			assert.Check(t, is.DeepEqual(stopped, tc.stopped))
+			assert.Check(t, is.DeepEqual(stopped, tc.stopped, cmpopts.SortSlices(func(a, b string) bool {
+				return a < b
+			})))
 		})
 	}
 }

cli/command/container/tty.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 

cli/command/context.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 

cli/command/context/completion.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 

cli/command/context/create.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 

cli/command/context/create_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 

cli/command/context/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 

cli/command/context/list.go

@@ -1,12 +1,12 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 
 import (
 	"fmt"
 	"os"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -101,8 +101,8 @@ func runList(dockerCli command.Cli, opts *listOptions) error {
 			Error:   errMsg,
 		})
 	}
-	sort.Slice(contexts, func(i, j int) bool {
-		return sortorder.NaturalLess(contexts[i].Name, contexts[j].Name)
+	slices.SortFunc(contexts, func(a, b *formatter.ClientContext) int {
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 	if err := format(dockerCli, opts, contexts); err != nil {
 		return err

cli/command/context/options.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package context
 
 import (
@@ -69,8 +72,7 @@ func parseBool(config map[string]string, name string) (bool, error) {
 	}
 	res, err := strconv.ParseBool(strVal)
 	if err != nil {
-		var nErr *strconv.NumError
-		if errors.As(err, &nErr) {
+		if nErr, ok := errors.AsType[*strconv.NumError](err); ok {
 			return res, fmt.Errorf("%s: parsing %q: %w", name, nErr.Num, nErr.Err)
 		}
 		return res, fmt.Errorf("%s: %w", name, err)

cli/command/context_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 

cli/command/defaultcontextstore.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 

cli/command/defaultcontextstore_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 

cli/command/formatter/buildcache.go

@@ -1,7 +1,10 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package formatter
 
 import (
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -52,20 +55,20 @@ shared: {{.Shared}}
 }
 
 func buildCacheSort(buildCache []build.CacheRecord) {
-	sort.Slice(buildCache, func(i, j int) bool {
-		lui, luj := buildCache[i].LastUsedAt, buildCache[j].LastUsedAt
+	slices.SortFunc(buildCache, func(a, b build.CacheRecord) int {
 		switch {
-		case lui == nil && luj == nil:
-			return strings.Compare(buildCache[i].ID, buildCache[j].ID) < 0
-		case lui == nil:
-			return true
-		case luj == nil:
-			return false
-		case lui.Equal(*luj):
-			return strings.Compare(buildCache[i].ID, buildCache[j].ID) < 0
-		default:
-			return lui.Before(*luj)
+		case a.LastUsedAt == nil && b.LastUsedAt == nil:
+			return strings.Compare(a.ID, b.ID)
+		case a.LastUsedAt == nil:
+			return -1
+		case b.LastUsedAt == nil:
+			return 1
 		}
+
+		if c := a.LastUsedAt.Compare(*b.LastUsedAt); c != 0 {
+			return c
+		}
+		return strings.Compare(a.ID, b.ID)
 	})
 }
 

cli/command/formatter/container.go

@@ -1,12 +1,13 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 
 import (
+	"cmp"
 	"fmt"
 	"net"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -295,7 +296,7 @@ func (c *ContainerContext) Labels() string {
 	for k, v := range c.c.Labels {
 		joinLabels = append(joinLabels, k+"="+v)
 	}
-	sort.Strings(joinLabels)
+	slices.Sort(joinLabels)
 	return strings.Join(joinLabels, ",")
 }
 
@@ -395,9 +396,7 @@ func DisplayablePorts(ports []container.PortSummary) string {
 	var result []string
 	var hostMappings []string
 	var groupMapKeys []string
-	sort.Slice(ports, func(i, j int) bool {
-		return comparePorts(ports[i], ports[j])
-	})
+	slices.SortFunc(ports, comparePorts)
 
 	for _, port := range ports {
 		current := port.PrivatePort
@@ -452,18 +451,13 @@ func formGroup(key string, start, last uint16) string {
 	return group + "/" + groupType
 }
 
-func comparePorts(i, j container.PortSummary) bool {
-	if i.PrivatePort != j.PrivatePort {
-		return i.PrivatePort < j.PrivatePort
-	}
-
-	if i.IP != j.IP {
-		return i.IP.Less(j.IP)
-	}
-
-	if i.PublicPort != j.PublicPort {
-		return i.PublicPort < j.PublicPort
-	}
-
-	return i.Type < j.Type
+// comparePorts compares ports by private port, IP address, public port,
+// and protocol, in that order.
+func comparePorts(a, b container.PortSummary) int {
+	return cmp.Or(
+		cmp.Compare(a.PrivatePort, b.PrivatePort),
+		a.IP.Compare(b.IP),
+		cmp.Compare(a.PublicPort, b.PublicPort),
+		cmp.Compare(a.Type, b.Type),
+	)
 }

cli/command/formatter/container_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/custom.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/displayutils.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/reflect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/reflect_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/volume.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/volume_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/idresolver/idresolver.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package idresolver
 

cli/command/image/build.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package image
 
 import (
@@ -364,8 +367,7 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 
 	err = jsonstream.Display(ctx, response.Body, streams.NewOut(buildBuff), jsonstream.WithAuxCallback(aux))
 	if err != nil {
-		var jerr *jsonstream.JSONError
-		if errors.As(err, &jerr) {
+		if jerr, ok := errors.AsType[*jsonstream.JSONError](err); ok {
 			// If no error code is set, default to 1
 			if jerr.Code == 0 {
 				jerr.Code = 1

cli/command/image/build/internal/git/gitutils.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package git
 
 import (
@@ -7,6 +10,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"strings"
 
 	"github.com/moby/sys/symlink"
@@ -202,7 +206,7 @@ func (repo gitRepo) checkout(root string) (string, error) {
 }
 
 func (repo gitRepo) gitWithinDir(dir string, args ...string) ([]byte, error) {
-	args = append([]string{"-c", "protocol.file.allow=never"}, args...) // Block sneaky repositories from using repos from the filesystem as submodules.
+	args = slices.Concat([]string{"-c", "protocol.file.allow=never"}, args) // Block sneaky repositories from using repos from the filesystem as submodules.
 	cmd := exec.Command("git", args...)
 	cmd.Dir = dir
 	// Disable unsafe remote protocols.

cli/command/image/build_test.go

@@ -8,7 +8,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"sort"
+	"slices"
 	"testing"
 
 	"github.com/docker/cli/cli/streams"
@@ -211,6 +211,6 @@ func (f *fakeBuild) filenames(t *testing.T) []string {
 	for _, header := range h {
 		names = append(names, header.Name)
 	}
-	sort.Strings(names)
+	slices.Sort(names)
 	return names
 }

cli/command/image/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package image
 

cli/command/image/list.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package image
 

cli/command/image/push.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package image
 

cli/command/image/push_test.go

@@ -102,9 +102,11 @@ func TestRunPushRespectsNoColorForAuxNotes(t *testing.T) {
 				SelectedManifest:             ocispec.Descriptor{Digest: "sha256:2222222222222222222222222222222222222222222222222222222222222222"},
 			})
 			assert.NilError(t, err)
-			line := append([]byte(`{"aux":`), aux...)
-			line = append(line, '}', '\n')
-			return fakeStreamResult{ReadCloser: io.NopCloser(bytes.NewReader(line))}, nil
+			var buf bytes.Buffer
+			buf.WriteString(`{"aux":`)
+			buf.Write(aux)
+			buf.WriteString("}\n")
+			return fakeStreamResult{ReadCloser: io.NopCloser(&buf)}, nil
 		},
 	})
 	cli.Out().SetIsTerminal(true)

cli/command/image/tree.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package image
 

cli/command/inspect/inspector.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package inspect
 

cli/command/manifest/annotate.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package manifest
 

cli/command/network/create_test.go

@@ -189,8 +189,6 @@ func TestNetworkCreateWithFlags(t *testing.T) {
 // TestNetworkCreateIPv4 verifies behavior of the "--ipv4" option. This option
 // is an optional bool, and must default to "nil", not "true" or "false".
 func TestNetworkCreateIPv4(t *testing.T) {
-	boolPtr := func(val bool) *bool { return &val }
-
 	tests := []struct {
 		doc, name string
 		flags     []string
@@ -205,19 +203,19 @@ func TestNetworkCreateIPv4(t *testing.T) {
 			doc:      "IPv4 enabled",
 			name:     "ipv4-enabled",
 			flags:    []string{"--ipv4=true"},
-			expected: boolPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPv4 enabled (shorthand)",
 			name:     "ipv4-enabled-shorthand",
 			flags:    []string{"--ipv4"},
-			expected: boolPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPv4 disabled",
 			name:     "ipv4-disabled",
 			flags:    []string{"--ipv4=false"},
-			expected: boolPtr(false),
+			expected: new(false),
 		},
 	}
 
@@ -243,8 +241,6 @@ func TestNetworkCreateIPv4(t *testing.T) {
 // TestNetworkCreateIPv6 verifies behavior of the "--ipv6" option. This option
 // is an optional bool, and must default to "nil", not "true" or "false".
 func TestNetworkCreateIPv6(t *testing.T) {
-	strPtr := func(val bool) *bool { return &val }
-
 	tests := []struct {
 		doc, name string
 		flags     []string
@@ -259,19 +255,19 @@ func TestNetworkCreateIPv6(t *testing.T) {
 			doc:      "IPV6 enabled",
 			name:     "ipv6-enabled",
 			flags:    []string{"--ipv6=true"},
-			expected: strPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPV6 enabled (shorthand)",
 			name:     "ipv6-enabled-shorthand",
 			flags:    []string{"--ipv6"},
-			expected: strPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPV6 disabled",
 			name:     "ipv6-disabled",
 			flags:    []string{"--ipv6=false"},
-			expected: strPtr(false),
+			expected: new(false),
 		},
 	}
 

cli/command/network/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package network
 

cli/command/network/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package network
 

cli/command/network/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package network
 

cli/command/network/list.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package network
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -61,8 +65,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		}
 	}
 
-	sort.Slice(res.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(res.Items[i].Name, res.Items[j].Name)
+	slices.SortFunc(res.Items, func(a, b network.Summary) int {
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 
 	networksCtx := formatter.Context{

cli/command/node/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package node
 

cli/command/node/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package node
 

cli/command/node/list.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package node
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -73,8 +77,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		Output: dockerCLI.Out(),
 		Format: newFormat(format, options.quiet),
 	}
-	sort.Slice(res.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(res.Items[i].Description.Hostname, res.Items[j].Description.Hostname)
+	slices.SortFunc(res.Items, func(a, b swarm.Node) int {
+		return sortorder.NaturalCompare(a.Description.Hostname, b.Description.Hostname)
 	})
 	return formatWrite(nodesCtx, res, info)
 }

cli/command/node/update.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package node
 

cli/command/plugin/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package plugin
 

cli/command/plugin/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package plugin
 

cli/command/plugin/list.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package plugin
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/plugin"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -54,8 +58,8 @@ func runList(ctx context.Context, dockerCli command.Cli, options listOptions) er
 		return err
 	}
 
-	sort.Slice(resp.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(resp.Items[i].Name, resp.Items[j].Name)
+	slices.SortFunc(resp.Items, func(a, b plugin.Plugin) int {
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 
 	format := options.format

cli/command/secret/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package secret
 

cli/command/secret/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package secret
 

cli/command/secret/ls.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package secret
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -59,8 +63,8 @@ func runSecretList(ctx context.Context, dockerCLI command.Cli, options listOptio
 		}
 	}
 
-	sort.Slice(res.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(res.Items[i].Spec.Name, res.Items[j].Spec.Name)
+	slices.SortFunc(res.Items, func(a, b swarm.Secret) int {
+		return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 	})
 
 	secretCtx := formatter.Context{

cli/command/service/formatter.go

@@ -1,9 +1,13 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package service
 
 import (
+	"cmp"
 	"errors"
 	"fmt"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -615,8 +619,8 @@ func NewListFormat(source string, quiet bool) formatter.Format {
 // ListFormatWrite writes the context
 func ListFormatWrite(ctx formatter.Context, services client.ServiceListResult) error {
 	render := func(format func(subContext formatter.SubContext) error) error {
-		sort.Slice(services.Items, func(i, j int) bool {
-			return sortorder.NaturalLess(services.Items[i].Spec.Name, services.Items[j].Spec.Name)
+		slices.SortFunc(services.Items, func(a, b swarm.Service) int {
+			return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 		})
 		for _, service := range services.Items {
 			serviceCtx := &serviceContext{service: service}
@@ -775,17 +779,16 @@ func (c *serviceContext) Ports() string {
 		return ""
 	}
 
-	pr := portRange{}
-	ports := []string{}
-
-	servicePorts := c.service.Endpoint.Ports
-	sort.Slice(servicePorts, func(i, j int) bool {
-		if servicePorts[i].Protocol == servicePorts[j].Protocol {
-			return servicePorts[i].PublishedPort < servicePorts[j].PublishedPort
-		}
-		return servicePorts[i].Protocol < servicePorts[j].Protocol
+	// Sort by protocol first, then by published port.
+	slices.SortFunc(c.service.Endpoint.Ports, func(a, b swarm.PortConfig) int {
+		return cmp.Or(
+			cmp.Compare(a.Protocol, b.Protocol),
+			cmp.Compare(a.PublishedPort, b.PublishedPort),
+		)
 	})
 
+	var pr portRange
+	var ports []string
 	for _, p := range c.service.Endpoint.Ports {
 		if p.PublishMode == swarm.PortConfigPublishModeIngress {
 			prIsRange := pr.tEnd != pr.tStart

cli/command/service/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 

cli/command/service/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 

cli/command/service/inspect_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 

cli/command/service/internal/genericresource/parse.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 // Package genericresource is a local fork of SwarmKit's [genericresource] package,
 // without protobuf dependencies.

cli/command/service/logs.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package service
 
 import (
@@ -6,7 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -314,7 +317,7 @@ func (lw *logWriter) Write(buf []byte) (int, error) {
 			d = append(d, k+"="+details[k])
 		}
 		// then sort em
-		sort.Strings(d)
+		slices.Sort(d)
 		// then join and append
 		output = append(output, []byte(strings.Join(d, ","))...)
 		output = append(output, ' ')

cli/command/service/opts.go

@@ -1,15 +1,15 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"net/netip"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -737,15 +737,15 @@ func (options *serviceOptions) ToService(ctx context.Context, apiClient client.N
 	}
 
 	networks := convertNetworks(options.networks)
-	for i, net := range networks {
-		nwID, err := resolveNetworkID(ctx, apiClient, net.Target)
+	for i := range networks {
+		nwID, err := resolveNetworkID(ctx, apiClient, networks[i].Target)
 		if err != nil {
 			return service, err
 		}
 		networks[i].Target = nwID
 	}
-	sort.Slice(networks, func(i, j int) bool {
-		return networks[i].Target < networks[j].Target
+	slices.SortFunc(networks, func(a, b swarm.NetworkAttachmentConfig) int {
+		return cmp.Compare(a.Target, b.Target)
 	})
 
 	resources, err := options.resources.ToResourceRequirements(flags)

cli/command/service/progress/progress.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package progress
 

cli/command/service/update.go

@@ -1,16 +1,16 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"maps"
 	"net/netip"
 	"slices"
-	"sort"
 	"strings"
 	"time"
 
@@ -352,8 +352,10 @@ func updateService(ctx context.Context, apiClient client.NetworkAPIClient, flags
 	if err := updateIsolation(flagIsolation, &cspec.Isolation); err != nil {
 		return err
 	}
-	if err := updateMounts(flags, &cspec.Mounts); err != nil {
-		return err
+	if anyChanged(flags, flagMountAdd, flagMountRemove) {
+		if err := updateMounts(flags, &cspec.Mounts); err != nil {
+			return err
+		}
 	}
 
 	updateSysCtls(flags, &task.ContainerSpec.Sysctls)
@@ -635,7 +637,7 @@ func updatePlacementConstraints(flags *pflag.FlagSet, placement *swarm.Placement
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newConstraints)
+	slices.Sort(newConstraints)
 
 	placement.Constraints = newConstraints
 }
@@ -720,7 +722,7 @@ func updateSysCtls(flags *pflag.FlagSet, field *map[string]string) {
 }
 
 func updateUlimits(flags *pflag.FlagSet, ulimits []*container.Ulimit) []*container.Ulimit {
-	newUlimits := make(map[string]*container.Ulimit)
+	newUlimits := make(map[string]*container.Ulimit, len(ulimits))
 
 	for _, ulimit := range ulimits {
 		newUlimits[ulimit.Name] = ulimit
@@ -737,17 +739,9 @@ func updateUlimits(flags *pflag.FlagSet, ulimits []*container.Ulimit) []*contain
 			newUlimits[ulimit.Name] = ulimit
 		}
 	}
-	if len(newUlimits) == 0 {
-		return nil
-	}
-	limits := make([]*container.Ulimit, 0, len(newUlimits))
-	for _, ulimit := range newUlimits {
-		limits = append(limits, ulimit)
-	}
-	sort.SliceStable(limits, func(i, j int) bool {
-		return limits[i].Name < limits[j].Name
+	return slices.SortedFunc(maps.Values(newUlimits), func(a, b *container.Ulimit) int {
+		return cmp.Compare(a.Name, b.Name)
 	})
-	return limits
 }
 
 func updateEnvironment(flags *pflag.FlagSet, field *[]string) {
@@ -953,14 +947,12 @@ func updateMounts(flags *pflag.FlagSet, mounts *[]mount.Mount) error {
 			newMounts = append(newMounts, mnt)
 		}
 	}
-	sort.Slice(newMounts, func(i, j int) bool {
-		a, b := newMounts[i], newMounts[j]
-
-		if a.Source == b.Source {
-			return a.Target < b.Target
-		}
-
-		return a.Source < b.Source
+	// Sort mounts by source, then by target.
+	slices.SortFunc(newMounts, func(a, b mount.Mount) int {
+		return cmp.Or(
+			cmp.Compare(a.Source, b.Source),
+			cmp.Compare(a.Target, b.Target),
+		)
 	})
 	*mounts = newMounts
 	return nil
@@ -980,7 +972,7 @@ func updateGroups(flags *pflag.FlagSet, groups *[]string) error {
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newGroups)
+	slices.Sort(newGroups)
 
 	*groups = newGroups
 	return nil
@@ -1039,7 +1031,7 @@ func updateDNSConfig(flags *pflag.FlagSet, config **swarm.DNSConfig) error {
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newConfig.Search)
+	slices.Sort(newConfig.Search)
 
 	options := (*config).Options
 	if flags.Changed(flagDNSOptionAdd) {
@@ -1054,7 +1046,7 @@ func updateDNSConfig(flags *pflag.FlagSet, config **swarm.DNSConfig) error {
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newConfig.Options)
+	slices.Sort(newConfig.Options)
 
 	*config = newConfig
 	return nil
@@ -1107,12 +1099,8 @@ portLoop:
 		}
 	}
 
-	// Sort the PortConfig to avoid unnecessary updates
-	sort.Slice(newPorts, func(i, j int) bool {
-		// We convert PortConfig into `port/protocol`, e.g., `80/tcp`
-		// In updatePorts we already filter out with map so there is duplicate entries
-		return portConfigToString(&newPorts[i]) < portConfigToString(&newPorts[j])
-	})
+	// Sort the PortConfig to avoid unnecessary updates.
+	slices.SortFunc(newPorts, swarm.PortConfig.Compare)
 	*portConfig = newPorts
 	return nil
 }
@@ -1348,8 +1336,8 @@ func updateNetworks(ctx context.Context, apiClient client.NetworkAPIClient, flag
 		}
 	}
 
-	sort.Slice(newNetworks, func(i, j int) bool {
-		return newNetworks[i].Target < newNetworks[j].Target
+	slices.SortFunc(newNetworks, func(a, b swarm.NetworkAttachmentConfig) int {
+		return cmp.Compare(a.Target, b.Target)
 	})
 
 	spec.TaskTemplate.Networks = newNetworks
@@ -1523,10 +1511,6 @@ func capsList(caps map[string]bool) []string {
 	if caps[opts.AllCapabilities] {
 		return []string{opts.AllCapabilities}
 	}
-	out := make([]string, 0, len(caps))
-	for c := range caps {
-		out = append(out, c)
-	}
-	sort.Strings(out)
-	return out
+
+	return slices.Sorted(maps.Keys(caps))
 }

cli/command/service/update_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/netip"
-	"sort"
+	"slices"
 	"strconv"
 	"testing"
 	"time"
@@ -141,7 +141,7 @@ func TestUpdateEnvironment(t *testing.T) {
 	updateEnvironment(flags, &envs)
 	assert.Assert(t, is.Len(envs, 2))
 	// Order has been removed in updateEnvironment (map)
-	sort.Strings(envs)
+	slices.Sort(envs)
 	assert.Check(t, is.Equal("toadd=newenv", envs[0]))
 	assert.Check(t, is.Equal("tokeep=value", envs[1]))
 }
@@ -250,6 +250,32 @@ func TestUpdateMounts(t *testing.T) {
 	assert.Check(t, is.Equal("/tokeep", mounts[1].Target))
 }
 
+func TestUpdateServiceForcePreservesMountOrder(t *testing.T) {
+	flags := newUpdateCommand(nil).Flags()
+	assert.NilError(t, flags.Set("force", "true"))
+
+	spec := &swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{
+					{Type: mount.TypeVolume, Source: "z-volume", Target: "/data/z"},
+					{Type: mount.TypeVolume, Source: "a-volume", Target: "/data/a"},
+					{Type: mount.TypeVolume, Source: "m-volume", Target: "/data/m"},
+				},
+			},
+		},
+	}
+
+	err := updateService(context.Background(), nil, flags, spec)
+	assert.NilError(t, err)
+	assert.Equal(t, spec.TaskTemplate.ForceUpdate, uint64(1))
+	assert.DeepEqual(t, spec.TaskTemplate.ContainerSpec.Mounts, []mount.Mount{
+		{Type: mount.TypeVolume, Source: "z-volume", Target: "/data/z"},
+		{Type: mount.TypeVolume, Source: "a-volume", Target: "/data/a"},
+		{Type: mount.TypeVolume, Source: "m-volume", Target: "/data/m"},
+	})
+}
+
 func TestUpdateMountsWithDuplicateMounts(t *testing.T) {
 	flags := newUpdateCommand(nil).Flags()
 	flags.Set("mount-add", "type=volume,source=vol4,target=/toadd")
@@ -282,7 +308,7 @@ func TestUpdatePorts(t *testing.T) {
 	assert.Assert(t, is.Len(portConfigs, 2))
 	// Do a sort to have the order (might have changed by map)
 	targetPorts := []int{int(portConfigs[0].TargetPort), int(portConfigs[1].TargetPort)}
-	sort.Ints(targetPorts)
+	slices.Sort(targetPorts)
 	assert.Check(t, is.Equal(555, targetPorts[0]))
 	assert.Check(t, is.Equal(1000, targetPorts[1]))
 }

cli/command/stack/list.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package stack
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -52,8 +55,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, opts listOptions) error
 		Output: dockerCLI.Out(),
 		Format: format,
 	}
-	sort.Slice(stacks, func(i, j int) bool {
-		return sortorder.NaturalLess(stacks[i].Name, stacks[j].Name)
+	slices.SortFunc(stacks, func(a, b stackSummary) int {
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 	return stackWrite(stackCtx, stacks)
 }

cli/command/stack/loader.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package stack
 
@@ -10,7 +10,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
-	"sort"
+	"slices"
 	"strings"
 
 	"github.com/distribution/reference"
@@ -29,8 +29,7 @@ func loadComposeFile(streams command.Streams, opts deployOptions) (*composetypes
 
 	config, err := loader.Load(configDetails)
 	if err != nil {
-		var fpe *loader.ForbiddenPropertiesError
-		if errors.As(err, &fpe) {
+		if fpe, ok := errors.AsType[*loader.ForbiddenPropertiesError](err); ok {
 			// this error is intentionally formatted multi-line
 			return nil, fmt.Errorf("compose file contains unsupported options:\n\n%s\n", propertyWarnings(fpe.Properties)) //nolint:staticcheck // ignore ST1005
 		}
@@ -76,9 +75,9 @@ func getDictsFrom(configFiles []composetypes.ConfigFile) []map[string]any {
 func propertyWarnings(properties map[string]string) string {
 	msgs := make([]string, 0, len(properties))
 	for name, description := range properties {
-		msgs = append(msgs, fmt.Sprintf("%s: %s", name, description))
+		msgs = append(msgs, name+": "+description)
 	}
-	sort.Strings(msgs)
+	slices.Sort(msgs)
 	return strings.Join(msgs, "\n\n")
 }
 

cli/command/stack/remove.go

@@ -1,10 +1,14 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package stack
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -96,15 +100,11 @@ func runRemove(ctx context.Context, dockerCli command.Cli, opts removeOptions) e
 	return errors.Join(errs...)
 }
 
-func sortServiceByName(services []swarm.Service) func(i, j int) bool {
-	return func(i, j int) bool {
-		return services[i].Spec.Name < services[j].Spec.Name
-	}
-}
-
 func removeServices(ctx context.Context, dockerCLI command.Cli, services []swarm.Service) bool {
+	slices.SortFunc(services, func(a, b swarm.Service) int {
+		return cmp.Compare(a.Spec.Name, b.Spec.Name)
+	})
 	var hasError bool
-	sort.Slice(services, sortServiceByName(services))
 	for _, service := range services {
 		_, _ = fmt.Fprintln(dockerCLI.Out(), "Removing service", service.Spec.Name)
 		if _, err := dockerCLI.Client().ServiceRemove(ctx, service.ID, client.ServiceRemoveOptions{}); err != nil {

cli/command/stack/services.go

@@ -1,9 +1,12 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package stack
 
 import (
 	"context"
 	"fmt"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -12,6 +15,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	cliopts "github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -68,8 +72,8 @@ func formatWrite(dockerCLI command.Cli, services client.ServiceListResult, opts
 		_, _ = fmt.Fprintln(dockerCLI.Err(), "Nothing found in stack:", opts.namespace)
 		return nil
 	}
-	sort.Slice(services.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(services.Items[i].Spec.Name, services.Items[j].Spec.Name)
+	slices.SortFunc(services.Items, func(a, b swarm.Service) int {
+		return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 	})
 
 	f := opts.format

cli/command/system/events.go

@@ -1,10 +1,14 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package system
 
 import (
 	"context"
 	"fmt"
 	"io"
-	"sort"
+	"maps"
+	"slices"
 	"strings"
 	"text/template"
 	"time"
@@ -133,18 +137,13 @@ func prettyPrintEvent(out io.Writer, event events.Message) error {
 	_, _ = fmt.Fprintf(out, "%s %s %s", event.Type, event.Action, event.Actor.ID)
 
 	if len(event.Actor.Attributes) > 0 {
-		keys := make([]string, 0, len(event.Actor.Attributes))
-		for k := range event.Actor.Attributes {
-			keys = append(keys, k)
-		}
-		sort.Strings(keys)
+		keys := slices.Sorted(maps.Keys(event.Actor.Attributes))
 		attrs := make([]string, 0, len(keys))
 		for _, k := range keys {
-			v := event.Actor.Attributes[k]
-			attrs = append(attrs, k+"="+v)
+			attrs = append(attrs, k+"="+event.Actor.Attributes[k])
 		}
 		_, _ = fmt.Fprintf(out, " (%s)", strings.Join(attrs, ", "))
 	}
-	_, _ = fmt.Fprint(out, "\n")
+	_, _ = fmt.Fprintln(out)
 	return nil
 }

cli/command/system/info.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package system
 
@@ -8,7 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"sort"
+	"slices"
 	"strings"
 
 	"github.com/docker/cli/cli"
@@ -468,11 +468,11 @@ func printSwarmInfo(output io.Writer, info system.Info) {
 	}
 	fprintln(output, "  Node Address:", info.Swarm.NodeAddr)
 	if len(info.Swarm.RemoteManagers) > 0 {
-		managers := []string{}
+		managers := make([]string, 0, len(info.Swarm.RemoteManagers))
 		for _, entry := range info.Swarm.RemoteManagers {
 			managers = append(managers, entry.Addr)
 		}
-		sort.Strings(managers)
+		slices.Sort(managers)
 		fprintln(output, "  Manager Addresses:")
 		for _, entry := range managers {
 			fprintf(output, "   %s\n", entry)

cli/command/system/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package system
 

cli/command/system/prune.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package system
 
@@ -8,7 +8,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"sort"
+	"slices"
 	"text/template"
 
 	"github.com/containerd/errdefs"
@@ -172,9 +172,7 @@ func dryRun(ctx context.Context, dockerCli command.Cli, options pruneOptions) (s
 				filters = append(filters, name+"="+v)
 			}
 		}
-		sort.Slice(filters, func(i, j int) bool {
-			return sortorder.NaturalLess(filters[i], filters[j])
-		})
+		slices.SortFunc(filters, sortorder.NaturalCompare)
 	}
 
 	var buffer bytes.Buffer

cli/command/system/pruner/pruner.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 // Package pruner registers "prune" functions to be included as part of
 // "docker system prune".

cli/command/system/version.go

@@ -1,11 +1,15 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package system
 
 import (
 	"context"
 	"fmt"
 	"io"
+	"maps"
 	"runtime"
-	"sort"
+	"slices"
 	"strconv"
 	"text/template"
 	"time"
@@ -87,7 +91,7 @@ type clientVersion struct {
 // serverVersion contains information about the Docker server host.
 // it's the client-side presentation of [client.ServerVersionResult].
 type serverVersion struct {
-	Platform      client.PlatformInfo       `json:",omitempty"`              // Platform is the platform (product name) the server is running on.
+	Platform      client.PlatformInfo       `json:"Platform"`                // Platform is the platform (product name) the server is running on.
 	Version       string                    `json:"Version"`                 // Version is the version of the daemon.
 	APIVersion    string                    `json:"ApiVersion"`              // APIVersion is the highest API version supported by the server.
 	MinAPIVersion string                    `json:"MinAPIVersion,omitempty"` // MinAPIVersion is the minimum API version the server supports.
@@ -252,10 +256,5 @@ func newVersionTemplate(templateFormat string) (*template.Template, error) {
 }
 
 func getDetailsOrder(v system.ComponentVersion) []string {
-	out := make([]string, 0, len(v.Details))
-	for k := range v.Details {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
+	return slices.Sorted(maps.Keys(v.Details))
 }