Hi folks,

The 2026.09 tag has been pushed to master on gitlab.com/lava/lava. .deb packages have been built in GitLab CI and are published at

https://apt.lavasoftware.org/release

Docker images for amd64 and arm64 have been built in GitLab CI and are available from

https://registry.gitlab.com/

and

https://hub.docker.com/u/lavasoftware

Changes in this release ==================

# Migrations

## New migrations

3 database migrations are applied by this release:

* lava_scheduler_app.0068_testjob_metadata * lava_scheduler_app.0069_testjob_metadata_gin_index * lava_scheduler_app.0070_increase_tag_name_max_length

These migrations should not create any downtime, as they can run while the instance is running. However, if you are running a large LAVA deployment, be aware that 0069_testjob_metadata_gin_index can take a lot of time on instance with many TestJobs.

## Squashed migrations

Squash most lava_scheduler_app migrations into one. This will speedup the initial migration for new instances.

# Distributions

This release is the last one to support django 4.2. The following version will support django 5.2 and later.

The following release will drop support for Debian 12 (old stable) and add support to Debian 14 (testing). For Debian 13, the use of django from stable-backport will be required.

# Documentation

## AI/ML policy

An AI/ML policy https://lava.readthedocs.io/en/latest/developer/methodology/contribute.html#use-of-ai-and-llm-tools has been added to the project contributions guide.

* contributions with AI-created code require an "Assisted-by: LLM" line before `Signed-off-by`; tool names stay optional and contributor-supplied, so the project advertises no vendor * Signed-off-by must be written by a human; AI tools must not generate or prompt it * contributors remain fully responsible: review, verification, GPLv2+/OSD compatibility, and third-party licensing in LLM output all fall on the submitter * prohibit leaking confidential data (deployment data, device credentials, tokens, customer jobs) to third-party services * LLM use stays optional; no contributor is disadvantaged for declining

## SECURITY.md

Document the LAVA security posture https://gitlab.com/lava/lava/-/blob/master/SECURITY.md?ref_type=heads. Security issues should be sent to Linaro Product Security Incident Response Team.

# Device-types

## New device-types

* rename imx91-11x11-frdm-imx91s to imx91-11x11-frdm-s * imx93w-evk * imx93w-frdm * imx941-15x15-lpddr4-evk * imx942-15x15-lpddr4-evk * imx943-orangebox * imx95-15x15-lpddr5-frdm * imx95-19x19-frdm-pro

## imx8/9

Adjust load addresses to allow for bigger kernels. Default size for kernel can be too small with some defconfigs. Mainly reduce dtb area to allow larger kernels

## Musca

Add support for `flasher` deploy method and `minimal` boot.

# Dispatcher

## Artifact download

Allow to specify the filename of an artifact during deployment.

The file gets its name from the last part of the URL path. Some URLs have no name there. A redirect endpoint saves every image as `download`, so they overwrite each other.

Add an optional filename. It is the name we download, so the compression suffix goes the same way as it does for a name from the URL. It must be a plain file name, so a job cannot write outside the download directory.

```yaml rootfs: url: https://example.com/download?id=42 filename: rootfs.tar.xz compression: xz ```

## Extra files for tftp

Specifies a dictionary of additional files to make available on the TFTP server. This may be used to support board specific requirements for additional firmware, test scripts, or anything else that does not fit into one of the above file types.

```yaml - deploy: to: tftp extra_files: test_scripts: url: http://example.com/test_scripts.itb ```

See the tftp documentation https://lava.readthedocs.io/en/latest/technical-references/job-definition/actions/deploy/to-tftp.html#extra_files .

## Job tags

Export job tags as `LAVA_JOB_TAGS` environment variable. See injected variables in the documentation https://lava.readthedocs.io/en/latest/technical-references/job-definition/environment.html#lava-injected-variables .

## multi-part cpio archives

Modern mkinitramfs (v0.146+) concatenates multiple cpio archives into a single initramfs file: an uncompressed cpio with kernel modules followed by a compressed cpio with the rest of the initrd. Allow LAVA to make use of such cpio archives.

# Server

## gevent support to gunicorn

Allow to use gevent worker class with gunicorn. By default gunicorn is using gthread, switching to gevent is a matter of adding `GUNICORN_WORKER_CLASS=gevent` to the docker environment variables.

## Public job window

Allow to make private job pages older than a given threshold. This is intended for public LAVA instances being enumerated by crawlers, where the scraped pages are the same pages people use and only the age of the reference job distinguishes the traffic.

Update the settings to specify the public job window. Every jobs older will only be visible to authenticated users:

```yaml PUBLIC_JOB_WINDOW_DAYS: 30 ```

See the private instance documentation https://lava.readthedocs.io/en/latest/technical-references/authorization.html#private-instance .

## SQLite

LAVA server can now use sqlite as database backend. This is a good way to try LAVA quickly using uv. To start a full LAVA instance locally, just run:

```shell export DATABASE_URL=sqlite:///db.sqlite uv run --frozen --extra server -- manage.py migrate & uv run --frozen --extra server -- manage.py lava-publisher --log-file - -u $USER -g $USER & uv run --frozen --extra server -- manage.py lava-scheduler --log-file - -u $USER -g $USER & uv run --frozen --extra server -- manage.py runserver & uv run --frozen --extra server -- manage.py shell & sudo uv run --frozen --extra dispatcher -- lava_dispatcher/worker.py --url http://localhost:8000 --log-file - --token WORKER_TOKEN --ws-url http://localhost:8001/ws/ & ```

## TestJob metadata

TestJob metadata used to be saved into the database and queryable from the web interface. The support has been broken since 2020 and fixed in this release. You can import metadata for existing TestJob using `lava-server manage jobs backfill-metadata`.

You can then filter TestJob by metadata parameter in the rest api with `metadata__<key>` query string:

``` /api/v0.2/jobs/?metadata__build_id=1234 /api/v0.2/jobs/?metadata__branch__startswith=release/ ```

Rgds