diff --git a/go.mod b/go.mod
index abe27e48..b562187b 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/Azure/go-autorest/tracing v0.6.1
 	github.com/alitto/pond/v2 v2.7.1
 	github.com/dlclark/regexp2 v1.12.0
-	github.com/docker/cli v29.7.2+incompatible
+	github.com/docker/cli v29.8.0+incompatible
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/google/uuid v1.6.0
 	github.com/moby/term v0.5.0
diff --git a/go.sum b/go.sum
index f4cbdbb0..dffb58df 100644
--- a/go.sum
+++ b/go.sum
@@ -27,8 +27,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/cli v29.7.2+incompatible h1:dlkwallR8XqfeVnA2ELEhdwvb4lsSwuB4IgsG8Q9cLY=
-github.com/docker/cli v29.7.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.8.0+incompatible h1:ih0c2jq/nN7QfES8zIfwSzIhRScjs4ehER+kZ60aeSk=
+github.com/docker/cli v29.8.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.6.4 h1:axCks+yV+2MR3/kZhAmy07yC56WZ2Pwu/fKWtKuZB0o=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
 github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
diff --git a/vendor/github.com/docker/cli/cli/config/config.go b/vendor/github.com/docker/cli/cli/config/config.go
index 5a637805..a7ea0acd 100644
--- a/vendor/github.com/docker/cli/cli/config/config.go
+++ b/vendor/github.com/docker/cli/cli/config/config.go
@@ -7,7 +7,6 @@ import (
 	"os/user"
 	"path/filepath"
 	"runtime"
-	"strings"
 	"sync"
 
 	"github.com/docker/cli/cli/config/configfile"
@@ -98,9 +97,11 @@ func SetDir(dir string) {
 
 // Path returns the path to a file relative to the config dir
 func Path(p ...string) (string, error) {
-	path := filepath.Join(append([]string{Dir()}, p...)...)
-	if !strings.HasPrefix(path, Dir()+string(filepath.Separator)) {
-		return "", fmt.Errorf("path %q is outside of root config directory %q", path, Dir())
+	root := Dir()
+	path := filepath.Join(append([]string{root}, p...)...)
+
+	if rel, err := filepath.Rel(root, path); err != nil || !filepath.IsLocal(rel) {
+		return "", fmt.Errorf("path %q is outside of root config directory %q", path, root)
 	}
 	return path, nil
 }
diff --git a/vendor/github.com/docker/cli/cli/config/configfile/file.go b/vendor/github.com/docker/cli/cli/config/configfile/file.go
index 26e148f0..e32b1e76 100644
--- a/vendor/github.com/docker/cli/cli/config/configfile/file.go
+++ b/vendor/github.com/docker/cli/cli/config/configfile/file.go
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package configfile
 
@@ -232,8 +232,7 @@ func (c *ConfigFile) Save() (retErr error) {
 		cfgFile = f
 	} else if os.IsNotExist(err) {
 		// extract the path from the error if the configfile does not exist or is a dangling symlink
-		var pathError *os.PathError
-		if errors.As(err, &pathError) {
+		if pathError, ok := errors.AsType[*os.PathError](err); ok {
 			cfgFile = pathError.Path
 		}
 	}
diff --git a/vendor/github.com/docker/cli/cli/config/memorystore/store.go b/vendor/github.com/docker/cli/cli/config/memorystore/store.go
index 44523d39..da1e94f4 100644
--- a/vendor/github.com/docker/cli/cli/config/memorystore/store.go
+++ b/vendor/github.com/docker/cli/cli/config/memorystore/store.go
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package memorystore
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index fc0b2459..bc594014 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -30,7 +30,7 @@ github.com/alitto/pond/v2/internal/linkedbuffer
 ## explicit; go 1.13
 github.com/dlclark/regexp2
 github.com/dlclark/regexp2/syntax
-# github.com/docker/cli v29.7.2+incompatible
+# github.com/docker/cli v29.8.0+incompatible
 ## explicit
 github.com/docker/cli/cli/config
 github.com/docker/cli/cli/config/configfile