It used simply be called password, not current_password - I wonder if the docs are anticipating an upcoming change that has not yet been implemented?
public function rules()
{
return [
'password' => 'password',
'new_password' => 'required|confirmed|min:8|string'
];
}