Changes in this release
==================

## New device-types

New supported devices:

* hp-x360-14a-cb0001xx-zork
* imx6ulz-lite-evk
* imx93-9x9-qsb
* jh7100-starfive-visionfive-v1
* mt8195-cherry-tomato-r2

## Security issues

Multiple security issues has been found and fixed in this release. The details will be shared in some weeks in order to give time for admins to upgrade.


## Debian support

The support for Debian Buster has been dropped as Debian Buster does not
provide support for the latest pyyaml versions.

This release also add support for Debian Bookworm.

## Action timeouts

Allow defining a timeout for an individual action in the block section.

This allows to override all the actions in a block at once, while still being
able to control single action timeouts within the same block.

```yaml
actions:
- deploy:
    timeout:
      minutes: 5
    timeouts:
      http-download:
        minutes: 1
```

## Interactive test action

In interactive test action, you can now user the server IP and Job ID in test
commands. The variables are `SERVER_IP` and `JOB_ID`.

This can be used with:

```yaml
- test:
    interactive:
    - name: network
      prompts: ["=> ", "/ # "]
      script:
      - command: ping {SERVER_IP}
```

## Settings

A new set of environment variable is taken into account when loading settings.
Every variables prefixed by `LAVA_YAML_SETTINGS_` will be yaml loaded and added
to the django settings.

For instance to define `Debug` to `True`:

```shell
LAVA_YAML_SETTINGS_DEBUG=true
```

This will be useful when deploying using docker-compose or k8s.

## Test definitions

This release drop the TarRepoAction test definition action.
   
This feature was never used in LAVAv2 and has been replaced by the
UrlRepoAction since 2022.09.

Instead of providing the tar as base64 encoded in the job definition (that can
be huged), the user can provide a url to the tar that will be downloaded,
decompressed (if needed) and extracted.

## XMLRPC API

Lava uses XMLRPC for its system management endpoints, which is secured via HTTP
basic authentication. This adds `system.set_user_groups` taking a string email
address for the user, and an array of string group names which will be the
exact set of groups of which the user is a member.

This endpoint requires a token from a user with staff permissions in order to
access it.

Rgds