Hi folks,
The 2026.09 tag has been pushed to master on gitlab.com/lava/lava.
.deb packages have been built in GitLab CI and are published at
https://apt.lavasoftware.org/release
Docker images for amd64 and arm64 have been built in GitLab CI and
are available from
https://registry.gitlab.com/
and
https://hub.docker.com/u/lavasoftware
Changes in this release
==================
# Migrations
## New migrations
3 database migrations are applied by this release:
* lava_scheduler_app.0068_testjob_metadata
* lava_scheduler_app.0069_testjob_metadata_gin_index
* lava_scheduler_app.0070_increase_tag_name_max_length
These migrations should not create any downtime, as they can run while the
instance is running. However, if you are running a large LAVA deployment,
be aware that 0069_testjob_metadata_gin_index can take a lot of time on
instance with many TestJobs.
## Squashed migrations
Squash most lava_scheduler_app migrations into one. This will speedup the
initial migration for new instances.
# Distributions
This release is the last one to support django 4.2. The following version
will support django 5.2 and later.
The following release will drop support for Debian 12 (old stable) and add
support to Debian 14 (testing).
For Debian 13, the use of django from stable-backport will be required.
# Documentation
## AI/ML policy
An AI/ML policy
<https://lava.readthedocs.io/en/latest/developer/methodology/contribute.html…>
has been added to the project contributions guide.
* contributions with AI-created code require an "Assisted-by: LLM" line
before `Signed-off-by`; tool names stay optional and contributor-supplied,
so the project advertises no vendor
* Signed-off-by must be written by a human; AI tools must not generate or
prompt it
* contributors remain fully responsible: review, verification, GPLv2+/OSD
compatibility, and third-party licensing in LLM output all fall on the
submitter
* prohibit leaking confidential data (deployment data, device credentials,
tokens, customer jobs) to third-party services
* LLM use stays optional; no contributor is disadvantaged for declining
## SECURITY.md
Document the LAVA security posture
<https://gitlab.com/lava/lava/-/blob/master/SECURITY.md?ref_type=heads>.
Security issues should be sent to Linaro Product Security Incident Response
Team.
# Device-types
## New device-types
* rename imx91-11x11-frdm-imx91s to imx91-11x11-frdm-s
* imx93w-evk
* imx93w-frdm
* imx941-15x15-lpddr4-evk
* imx942-15x15-lpddr4-evk
* imx943-orangebox
* imx95-15x15-lpddr5-frdm
* imx95-19x19-frdm-pro
## imx8/9
Adjust load addresses to allow for bigger kernels. Default size for kernel
can be too small with some defconfigs. Mainly reduce dtb area to allow
larger kernels
## Musca
Add support for `flasher` deploy method and `minimal` boot.
# Dispatcher
## Artifact download
Allow to specify the filename of an artifact during deployment.
The file gets its name from the last part of the URL path. Some URLs have
no name there. A redirect endpoint saves every image as `download`, so they
overwrite each other.
Add an optional filename. It is the name we download, so the compression
suffix goes the same way as it does for a name from the URL. It must be a
plain file name, so a job cannot write outside the download directory.
```yaml
rootfs:
url: https://example.com/download?id=42
filename: rootfs.tar.xz
compression: xz
```
## Extra files for tftp
Specifies a dictionary of additional files to make available on the TFTP
server.
This may be used to support board specific requirements for additional
firmware, test scripts, or anything else that does not fit into one of the
above file types.
```yaml
- deploy:
to: tftp
extra_files:
test_scripts:
url: http://example.com/test_scripts.itb
```
See the tftp documentation
<https://lava.readthedocs.io/en/latest/technical-references/job-definition/a…>
.
## Job tags
Export job tags as `LAVA_JOB_TAGS` environment variable. See injected
variables in the documentation
<https://lava.readthedocs.io/en/latest/technical-references/job-definition/e…>
.
## multi-part cpio archives
Modern mkinitramfs (v0.146+) concatenates multiple cpio archives into a
single initramfs file: an uncompressed cpio with kernel modules followed by
a compressed cpio with the rest of the initrd. Allow LAVA to make use of
such cpio archives.
# Server
## gevent support to gunicorn
Allow to use gevent worker class with gunicorn. By default gunicorn is
using gthread, switching to gevent is a matter of adding
`GUNICORN_WORKER_CLASS=gevent` to the docker environment variables.
## Public job window
Allow to make private job pages older than a given threshold. This is
intended for public LAVA instances being enumerated by crawlers, where the
scraped pages are the same pages people use and only the age of the
reference job distinguishes the traffic.
Update the settings to specify the public job window. Every jobs older will
only be visible to authenticated users:
```yaml
PUBLIC_JOB_WINDOW_DAYS: 30
```
See the private instance documentation
<https://lava.readthedocs.io/en/latest/technical-references/authorization.ht…>
.
## SQLite
LAVA server can now use sqlite as database backend. This is a good way to
try LAVA quickly using uv. To start a full LAVA instance locally, just run:
```shell
export DATABASE_URL=sqlite:///db.sqlite
uv run --frozen --extra server -- manage.py migrate &
uv run --frozen --extra server -- manage.py lava-publisher --log-file - -u
$USER -g $USER &
uv run --frozen --extra server -- manage.py lava-scheduler --log-file - -u
$USER -g $USER &
uv run --frozen --extra server -- manage.py runserver &
uv run --frozen --extra server -- manage.py shell &
sudo uv run --frozen --extra dispatcher -- lava_dispatcher/worker.py --url
http://localhost:8000 --log-file - --token WORKER_TOKEN --ws-url
http://localhost:8001/ws/ &
```
## TestJob metadata
TestJob metadata used to be saved into the database and queryable from the
web interface. The support has been broken since 2020 and fixed in this
release. You can import metadata for existing TestJob using `lava-server
manage jobs backfill-metadata`.
You can then filter TestJob by metadata parameter in the rest api with
`metadata__<key>` query string:
```
/api/v0.2/jobs/?metadata__build_id=1234
/api/v0.2/jobs/?metadata__branch__startswith=release/
```
Rgds
--
Rémi Duraffort
Principal Tech Lead
LAVA Tech Lead
Automation Software Team
Linaro
