From a5b5b4bf69274c2dfc20360a3b6122664bcdbc5e Mon Sep 17 00:00:00 2001
From: Duda Nogueira <dudanogueira@gmail.com>
Date: Thu, 22 Oct 2026 14:47:50 +0200
Subject: [PATCH] Upgrade Weaviate to 1.39.13

Weaviate 1.39.13 is built with Go 1.26.10, which rejects certificate
chains containing the leaked eMudhra intermediates (CVE-2026-111943).
Add a note to the packaged compose file that existing weaviatedata
volumes must be upgraded one minor version at a time.
---
 docker/docker-compose.dev.yml | 2 +-
 llmstack/docker-compose.yml   | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/docker/docker-compose.dev.yml b/docker/docker-compose.dev.yml
index 0a79bafd9a3..d157d54fe7b 100644
--- a/docker/docker-compose.dev.yml
+++ b/docker/docker-compose.dev.yml
@@ -74,7 +74,7 @@ services:
     env_file:
       - .env.dev
   weaviate:
-    image: semitechnologies/weaviate:1.25.7
+    image: semitechnologies/weaviate:1.39.13
     ports:
       - 28080:8080
     volumes:
diff --git a/llmstack/docker-compose.yml b/llmstack/docker-compose.yml
index 2ebf74d4dc3..088717718b3 100644
--- a/llmstack/docker-compose.yml
+++ b/llmstack/docker-compose.yml
@@ -106,7 +106,10 @@ services:
       POSTGRES_USER: ${DATABASE_USERNAME:-llmstack}
       POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-llmstack}
   weaviate:
-    image: semitechnologies/weaviate:1.25.7
+    # Weaviate supports upgrading one minor version at a time. If the weaviatedata
+    # volume was created by an older Weaviate (e.g. 1.25.x), step through each minor
+    # release first: https://docs.weaviate.io/deploy/migration
+    image: semitechnologies/weaviate:1.39.13
     volumes:
       - weaviatedata:/var/lib/weaviate
     environment: