Changelog for nRF Connect SDK v3.4.99

The most relevant changes that are present on the main branch of the nRF Connect SDK, as compared to the latest official release, are tracked in this file.

Note

This file is a work in progress and might not cover all relevant changes.

Known issues

Known issues are only tracked for the latest official release. See known issues for nRF Connect SDK v3.4.0 for the list of issues valid for the latest release.

Changelog

The following sections provide detailed lists of changes by component.

IDE, OS, and tool support

  • Updated documentation build requirements to replace m2r2 with myst-parser. See the Requirements reference page for the updated tool list.

Board support

  • Added support for the nRF93M1 DK, including a Zephyr cellular modem driver for the nRF93M1 Cat-1 bis LTE module. The board uses the nRF93M1 module with the nRF54L15 as the host MCU.

Build and configuration system

Bootloaders and DFU

  • Added:

    • The hidden CONFIG_NCS_MCUBOOT_ENCRYPTION_HMAC_SHA256 Kconfig option to select HMAC-SHA256 with X25519 for compatibility with existing projects that use it. The option is hidden and requires addition of a Kconfig override in your project. This is intentional as HMAC-SHA512 is recommended over HMAC-SHA256.

    • The nRF54L Series bootloader RRAM protection documentation page to explaining the memory protection features of the bootloader on the nRF54L Series.

    • Support for the application core of the nRF54LS05A SoC to MCUboot and secure boot sysbuild, including the secure boot locking and immutable region handling features aligned with the nRF54LS05B SoC

  • Removed support for Device Firmware Update (DFU) of the nRF70 Series firmware patch, together with the SB_CONFIG_DFU_MULTI_IMAGE_PACKAGE_WIFI_FW_PATCH, SB_CONFIG_DFU_ZIP_WIFI_FW_PATCH, and CONFIG_NRF_WIFI_FW_PATCH_DFU Kconfig options. See the Migration notes for nRF Connect SDK v3.5.0 (Working draft) for details.

  • Updated MCUboot to feed the watchdog more aggressively during the following time-consuming operations, to prevent a watchdog timeout:

    • Full slot erase procedures.

    • Swap-move algorithm in the move sectors up loop and in the sectors swap loop.

    • Image hash calculation procedure in the hash calculation loop.

  • Fixed:

    • MCUboot build failure with image encryption when the ECDSA P-256 signature was enabled on devices based on SoCs with the CryptoCell 310 peripheral, such as the nRF52840 SoC and the nRF9160 SiP. These configurations now use PSA Crypto instead of the cc310 backend, which supports only signature verification.

    • MCUboot serial recovery issue on the nRF5340 SoC where the direct upload of the network core image failed when MCUboot was configured for single-slot mode (CONFIG_SINGLE_APPLICATION_SLOT).

Developing with nRF91 Series

No changes since the latest nRF Connect SDK release.

Developing with nRF93M1

Developing with nRF70 Series

No changes since the latest nRF Connect SDK release.

Developing with nRF54L Series

Developing with nRF54H Series

No changes since the latest nRF Connect SDK release.

Developing with nRF53 Series

  • Added a workaround for anomaly 166 on the nRF5340 devices and the CONFIG_SOC_NRF53_ANOMALY_166_WORKAROUND Kconfig option, which allows enabling the workaround. You can use the option also in builds with TF-M.

Developing with nRF52 Series

No changes since the latest nRF Connect SDK release.

Developing with Thingy:91 X

No changes since the latest nRF Connect SDK release.

Developing with Thingy:91

No changes since the latest nRF Connect SDK release.

Developing with Thingy:53

No changes since the latest nRF Connect SDK release.

Developing with PMICs

No changes since the latest nRF Connect SDK release.

Developing with Front-End Modules

  • Removed support for the nRF2220 Front-End Module (FEM).

Developing with custom boards

No changes since the latest nRF Connect SDK release.

Security

  • Added:

    • The CONFIG_TFM_LOG_NS_MEMORY_LAYOUT Kconfig option, which allows printing the configuration of the Secure Attribution Unit (SAU) and the Memory Protection Controller (MPC) during the initialization of TF-M on the nRF54L Series devices. See also TF-M logging for more information.

    • Support for the SHAKE-128 and SHAKE-256 eXtendable Output Functions (XOF) in the CRACEN driver.

    • Support for signature verification with ML-DSA-44, ML-DSA-65, and ML-DSA-87 when using the CRACEN driver.

  • Updated:

    • Oberon PSA Crypto from v2.0.0 to v2.1.0. The new version has minor updates in internal APIs, restructures the directory hierarchy, and improves native support for built-in keys.

    • nrf_cc3xx_platform and nrf_cc3xx_mbedcrypto libraries to version v0.9.23. Improved PSA driver error reporting and fixed an issue that caused incorrect authentication tag generation in GCM when multiple calls to psa_aead_update_ad() were made.

Security libraries

No changes since the latest nRF Connect SDK release.

Mbed TLS

Trusted Firmware-M (TF-M)

Protocols

This section provides detailed lists of changes by protocol. See Samples for lists of changes for the protocol-related samples.

Bluetooth® LE

Bluetooth Mesh

DECT NR+

  • Added DECT NR+ L2 Ethernet sink mode for IPv6 bridging over an Ethernet uplink:

    • Delegated /96 prefix and ULA on DECT NR+

    • ND proxy on behalf of associated PT devices

    • Optional DHCPv6 client

    • Upstream routing through the default router link-local address

  • Updated by improving half-closed association recovery in the nRF91 DECT driver and L2 stack (DLC discard timer, RD_NOT_FOUND, L2 table full). The dect_net_l2_child_association_created() function now returns int; check for -ENOSPC and release the MAC association. The dect_settings structure is extended with DECT_SETTINGS_WRITE_SCOPE_DLC write scope and rach_conf_resp_win_length field.

  • Fixed the DLC TX transaction ID wrap on retry and made the cluster RACH response window length configurable through dect sett.

Enhanced ShockBurst (ESB)

No changes since the latest nRF Connect SDK release.

Gazell

No changes since the latest nRF Connect SDK release.

Matter

  • Moved all Matter samples, shared sample infrastructure, devicetree partition files, and Matter-specific snippets from sdk-nrf to the separate Matter add-on repository (ncs-matter). The Matter bridge and Thingy:53 weather station reference applications are also relocated into the add-on. See Migrating Matter projects from sdk-nrf to Matter add-on for the migration guide.

Matter fork

No changes since the latest nRF Connect SDK release.

nRF IEEE 802.15.4 radio driver

No changes since the latest nRF Connect SDK release.

Thread

No changes since the latest nRF Connect SDK release.

Wi-Fi®

  • Updated the Connection Manager Wi-Fi connectivity layer to defer the connect request to its dedicated work queue (wifi_conn_wq) instead of running it synchronously in the context of the caller of conn_mgr_if_connect(). This allows the stacks of the application, shell, and Connection Manager monitor threads to be reduced, as they no longer need to accommodate the Wi-Fi connect call chain.

Applications

This section provides detailed lists of changes by application.

Connectivity bridge

No changes since the latest nRF Connect SDK release.

High-Performance Framework (HPF)

  • Added support for the nRF54LC10A SoC.

IPC radio firmware

No changes since the latest nRF Connect SDK release.

Matter bridge

nRF Audio (formerly nRF5340 Audio)

  • Added:

    • A generalized audio time module that provides a unified interface for retrieving the current time in microseconds across a SoC. The module uses the GRTC timer on nRF54L Series devices and the audio sync timer on other devices.

    • Experimental support for the nRF54LM20 SoC in the nRF Audio applications. The support is limited to the unicast client app application with USB as audio source, which can be built for the nrf54lm20dk/nrf54lm20a/cpuapp board target. The support is experimental and not yet fully tested, so it is not recommended for production use.

  • Removed:

    • prj_release.conf files from all nRF Audio applications and from the buildprog tool. You must now explicitly specify which configurations to include in a release build. See Building the application for more information.

    • The CONFIG_BT_BAP_UNICAST_CONFIGURABLE option from the unicast client and server applications. This option was not useful because the unicast server range settings overwrite the bitrate configuration.

nRF Desktop

  • Added:

    • Support for the nrf54lc10dk/nrf54lc10a/cpuapp and nrf54ls05dk/nrf54ls05a/cpuapp board targets.

    • The release_fast_pair build type for the nrf54ls05dk/nrf54ls05a/cpuapp and nrf54ls05dk/nrf54ls05b/cpuapp board targets. The configuration acts as a HID mouse with Fast Pair support. It uses MCUboot in direct-xip mode with software-based image signature verification.

    • Optional support for dongles with HID SCI, configurable through the CONFIG_DESKTOP_HID_FORWARD_HID_SCI_ENABLE Kconfig option. The HID forward module module now uses APP_EVENT_SUBSCRIBE_FIRST to subscribe to the ble_discovery_complete_event event. The module updates event data to ensure all other modules are notified about the SCI support.

    • HID Shorter Connection Intervals (SCI) support on the peripheral side. The HID Service module module enables support for the feature in the underlying HID GATT Service. The Bluetooth LE latency module module handles HID SCI mode change requests and the related connection parameter updates. Enable the feature with the CONFIG_DESKTOP_HIDS_SCI_ENABLE Kconfig option.

    • The hid_sci and release_hid_sci build types for the nrf54l15dk/nrf54l15/cpuapp board target. The configurations act as a HID mouse peripheral with HID SCI support.

  • Removed:

    • Partition Manager support from the nRF Desktop application.

Thingy:53: Matter weather station

Installer (MCUboot Firmware Loader installer)

No changes since the latest nRF Connect SDK release.

Samples

This section provides detailed lists of changes by sample.

Bluetooth samples

Bluetooth Mesh samples

Bluetooth Fast Pair samples

Cellular samples

Cryptography samples

  • Added:

    • Support for the nRF54LC10A SoC (with and without TF-M) in the crypto samples.

    • The Crypto: ML-DSA sample.

Debug samples

No changes since the latest nRF Connect SDK release.

DFU samples

DECT NR+ samples

  • nRF91x1: DECT NR+ Shell sample:

    • Added:

      • Configurable auto-connect with L4-driven trigger.

      • Optional mDNS/DNS-SD advertise (_dect-nr._udp) and dect discover shell command to browse and resolve DECT NR+ peers on the network.

      • Ethernet border router sink variant using a W5500 shield (arceli_eth_w5500 or seeed_w5500), with configuration and devicetree overlays for modem shared memory, static or random MAC, and optional DHCPv6.

      • Shared mDNS configuration overlay (mdns-common.conf) and Ethernet mDNS overlay (eth_mdns.conf) for DNS-SD on both dect0 and eth0.

    • Updated ping to use the Zephyr net_icmp API (IPv6).

    • Fixed the routing logs. They are now available through the shell backend only.

Enhanced ShockBurst samples

  • Added support for the nrf54lc10dk/nrf54lc10a/cpuapp, nrf54lc10dk/nrf54lc10a/cpuapp/ns, and nrf54ls05dk/nrf54ls05a/cpuapp board targets in all samples.

Gazell samples

No changes since the latest nRF Connect SDK release.

IronSide SE samples

No changes since the latest nRF Connect SDK release.

Keys samples

No changes since the latest nRF Connect SDK release.

Matter samples

  • Moved all Matter samples from nrf/samples/matter/ to the Matter add-on repository under ncs-matter/samples/. Sample paths no longer use the samples/matter/ prefix (for example, ncs-matter/samples/template replaces nrf/samples/matter/template). See Migrating Matter projects from sdk-nrf to Matter add-on for the full list of path changes, Kconfig renames, and build instructions.

  • Renamed Matter-specific Zephyr snippets in the add-on:

    • matter-debug → debug

    • matter-diagnostic-logs → diagnostic-logs

  • Updated Matter sample CMake integration to use ncs-matter/cmake/sample.cmake and the ZEPHYR_NCS_MATTER_MODULE_DIR variable instead of nrf/samples/matter/common/cmake/ helpers and ZEPHYR_NRF_MODULE_DIR.

  • Moved shared Matter sample code from nrf/samples/matter/common/ to ncs-matter/subsys/.

  • Moved Matter partition devicetree include files from nrf/dts/samples/matter/ to ncs-matter/dts/. Board overlays must use #include <nrf52840_partitions.dtsi> instead of #include <samples/matter/nrf52840_partitions.dtsi>.

Networking samples

  • Updated the TF-M configuration in nRF7002 DK networking samples by removing CONFIG_TFM_PROFILE_TYPE_SMALL (as it is not supported by the nRF Connect SDK). Instead, use the configurable profile (CONFIG_TFM_PROFILE_TYPE_NOT_SET), select the SFN backend (CONFIG_TFM_SFN) to save RAM and select memory-mapped iovecs (CONFIG_TFM_PSA_FRAMEWORK_HAS_MM_IOVEC) to reduce copying of client vectors during TLS handshakes.

  • Removed:

  • Download sample:

    • Added:

      • Support for mutual TLS (client X.509 certificate authentication), using the new CONFIG_SAMPLE_PROVISION_CLIENT_CERT Kconfig option.

      • A wifi-dtls.conf extra-conf file with example client certificate and CA trust chain for testing against the Eclipse Californium CoAP interop server.

    • Updated:

    • Fixed the HTTP file link, which was previously broken.

  • CoAP Client sample:

    • Added:

      • Support for mutual DTLS (client X.509 certificate authentication), using the new CONFIG_COAP_SAMPLE_DTLS Kconfig option

      • A wifi-dtls.conf extra-conf file with example client certificate and CA trust chain for testing against the Eclipse Californium CoAP interop server.

    • Fixed an issue with the sample’s IPv6 support, where the device crashes when trying to communicate over IPv6.

  • HTTP Server sample:

    • Fixed:

      • The pregenerated server and client TLS certificates. They had only a Common Name (CN) and no Subject Alternative Name (SAN). This caused hostname verification to fail with strict TLS clients (for example, Python’s ssl/requests, used by httpie) even though the certificate chain itself was valid. The certificates were regenerated with a SAN entry for httpserver.local.

      • The sample’s TLS credential provisioning. It silently kept stale credentials in persistent storage if they already existed, so replacing the certificate files and reflashing had no effect on the device. Credentials are now re-added if they already exist.

      • IPv6 address and multicast group limits. When the access point advertised both SLAAC and stateful DHCPv6, the default CONFIG_NET_IF_UNICAST_IPV6_ADDR_COUNT and CONFIG_NET_IF_MCAST_IPV6_ADDR_COUNT values were too low to hold all resulting addresses, causing Failed to configure DHCPv6 address and Cannot join solicit node address ... (-12) errors. Both Kconfig option values were increased.

NFC samples

No changes since the latest nRF Connect SDK release.

nRF5340 samples

No changes since the latest nRF Connect SDK release.

nRF93M1 DK samples

  • Added:

    • The nRF93M1 DK: Modem bypass sample that forwards the nRF93M1 modem UART to the USB CDC-ACM VCOM port for direct AT command access from a host PC.

    • The nRF93M1 DK: PPP shell sample that establishes a PPP connection between the nRF54L15 host core and the nRF93M1 modem over CMUX, with shell-driven network management and zperf support.

Peripheral samples

PMIC samples

No changes since the latest nRF Connect SDK release.

Protocol serialization samples

No changes since the latest nRF Connect SDK release.

SDFW samples

No changes since the latest nRF Connect SDK release.

Sensor samples

No changes since the latest nRF Connect SDK release.

SUIT samples

No changes since the latest nRF Connect SDK release.

Trusted Firmware-M (TF-M) samples

  • Added support for the nRF54LC10A SoC in the TF-M samples.

Thread samples

  • Added experimental support for the nRF54LC10A SoC to all Thread samples.

Wi-Fi samples

Other samples

Drivers

This section provides detailed lists of changes by driver.

SPI drivers

  • SPIM:

    • RTIO based device driver for SPIM has been introduced. This device driver is selected if CONFIG_SPI_RTIO is enabled.

Wi-Fi drivers

Flash drivers

No changes since the latest nRF Connect SDK release.

Libraries

This section provides detailed lists of changes by library.

Binary libraries

No changes since the latest nRF Connect SDK release.

Bluetooth libraries and services

Common Application Framework

Debug libraries

No changes since the latest nRF Connect SDK release.

DFU libraries

  • Added the Firmware loader settings library to pass the firmware loader Bluetooth advertising name from the main application to the firmware loader image using Settings storage.

Gazell libraries

No changes since the latest nRF Connect SDK release.

Modem libraries

  • Location library:

    • Updated the library to always use the chosen zephyr,wifi node instead of ncs,location-wifi to find the used Wi-Fi device.

  • Modem key management library:

Multiprotocol Service Layer libraries

No changes since the latest nRF Connect SDK release.

Libraries for networking

Libraries for NFC

  • Parser for messages and records:

    • Fixed an issue where parsing a malformed long-format NDEF record could produce an incorrect payload length. The parser now validates type, ID, and payload lengths against the remaining input buffer.

nRF RPC libraries

No changes since the latest nRF Connect SDK release.

Other libraries

  • Added the VTF monitoring subsystem for battery voltage, temperature, and frequency monitoring used by the nRF Wi-Fi subsystem.

  • RAM power-down library:

    • Added support for the nRF54LC10A SoC.

  • Hardware ID library:

    • Added UUID support for the nRF54L Series and the nRF5340 SoC.

Shell libraries

  • Fixed a potential lockup in the NUS shell transport after a Bluetooth disconnect.

sdk-nrfxlib

See the changelog for each library in the nrfxlib documentation for additional information.

Scripts

This section provides detailed lists of changes by script.

  • Software Bill of Materials script:

  • Added:

    • --package-download-format option to control the SPDX PackageDownloadLocation format.

    • --input-dir option to the west ncs-sbom command. It recursively adds all files in the given directory to the report, equivalent to --input-files DIR/**/*.

  • Updated:

    • The SPDX output format from SPDX-2.2 to SPDX-2.3.

    • The ScanCode Toolkit detector to support macOS on ARM64 and Linux aarch64.

Integrations

This section provides detailed lists of changes by integration.

Google Fast Pair integration

  • Removed the nRF53 Series-specific information from the Google Fast Pair integration guide, following the removal of the nRF52 and nRF53 Series support from the Fast Pair samples.

Memfault integration

  • Added support for setting the Memfault project key at runtime using the CONFIG_MEMFAULT_PROJECT_KEY_SETTINGS Kconfig option.

  • Updated Memfault to version 1.44.0. See the Memfault firmware SDK changelog for details.

  • Removed the CONFIG_MEMFAULT_NCS_PROVISION_CERTIFICATES Kconfig option from nRF91x targets. Certificate provisioning for nRF91x targets is now handled automatically by the Memfault firmware SDK. The option remains available for nRF7002 targets, which do not have automatic certificate provisioning.

  • Deprecated the CONFIG_MEMFAULT_NCS_PROJECT_KEY Kconfig option in favor of the Memfault SDK-native CONFIG_MEMFAULT_PROJECT_KEY option.

AVSystem integration

No changes since the latest nRF Connect SDK release.

nRF Cloud integration

  • Added:

    • A memfaultModemKey control key in the Device Shadow, enabling the Memfault modem FOTA project key to be provisioned at runtime through Device Shadow updates. This is applied using the memfault_zephyr_fota_modem_project_key_set() function and requires the CONFIG_MEMFAULT_FOTA_MODEM_UPDATE Kconfig option to be enabled.

    • The CONFIG_NRF_CLOUD_FOTA_POLL_JOB_CHECK_PROGRESS_THRESHOLD Kconfig option to the nRF Cloud FOTA polling helpers, allowing the progress-based FOTA job re-check to be configured or disabled.

  • Fixed a memory leak in the nRF Cloud FOTA polling helpers where the temporary job info returned by each FOTA job check was not released on all code paths.

CoreMark integration

No changes since the latest nRF Connect SDK release.

DULT integration

No changes since the latest nRF Connect SDK release.

MCUboot

The MCUboot fork in nRF Connect SDK (sdk-mcuboot) contains all commits from the upstream MCUboot repository up to and including 8d14eebfe0b7402ebdf77ce1b99ba1a3793670e9, with some nRF Connect SDK specific additions.

The code for integrating MCUboot into nRF Connect SDK is located in the ncs/nrf/modules/mcuboot folder.

The following list summarizes both the main changes inherited from upstream MCUboot and the main changes applied to the nRF Connect SDK specific additions:

  • Added:

    • Support for the nRF54LC10A and nRF54LS05A SoCs.

    • ECIES-P-256 encrypted image support when using CONFIG_BOOT_ECDSA_NRF_OBERON, with the ocrypto software backend used instead of TinyCrypt.

    • ECIES-P-256 encrypted image support for the CONFIG_BOOT_ECDSA_PSA path by auto-selecting the required PSA algorithms.

    • Support for multiple image verification keys compiled into MCUboot. The CONFIG_BOOT_SIGNATURE_KEY_FILE Kconfig option accepts a comma-separated list of PEM files. Only public key material is embedded in the bootloader image. This enables a production or development signing custody model in which, for example, an updatable development bootloader can boot images signed with either key while a production bootloader embeds only the production verification key. MCUboot imgtool adds the keyinfo subcommand and --name-suffix for getpub and getpubhash, which support the multiple keys embedded in the bootloader image.

  • Updated:

    • Made CONFIG_BOOT_ECDSA_NRF_OBERON the default ECDSA P-256 implementation for nRF54LS05A and nRF54LS05B.

    • The --header-size imgtool parameter to accept auto as a value and automatically calculate the smallest possible header.

    • The sysbuild signing scripts for nRF5340 network core to automatically use the smallest needed MCUboot image header instead of the CONFIG_ROM_START_OFFSET Kconfig value, which has to account for proper VTOR alignment. The size of network core firmware image signed for MCUboot is reduced by 480 bytes.

  • Restored the CONFIG_BOOT_ECDSA_NRF_OBERON Kconfig option (for the Crypto implementation support), which was marked as deprecated in the previous release.

Zephyr

The Zephyr fork in nRF Connect SDK (sdk-zephyr) contains all commits from the upstream Zephyr repository up to and including 7d46db352251f85a6bc7b5961fb8a86e2f3125e4, with some nRF Connect SDK specific additions.

For the list of upstream Zephyr commits (not including cherry-picked commits) incorporated into nRF Connect SDK since the most recent release, run the following command from the ncs/zephyr repository (after running west update):

git log --oneline 7d46db3522 ^684c9e8f32

For the list of nRF Connect SDK specific commits, including commits cherry-picked from upstream, run:

git log --oneline manifest-rev ^7d46db3522

The current nRF Connect SDK main branch is based on revision 7d46db3522 of Zephyr.

Note

For possible breaking changes and changes between the latest Zephyr release and the current Zephyr version, refer to the Zephyr release notes.

Additions specific to nRF Connect SDK

  • Updated the VERSION file to follow the common version format structure. The common version file format structure is extended with a VERSION_METADATA field for nRF Connect SDK.

zcbor

No changes since the latest nRF Connect SDK release.

Documentation

  • Added:

    • The Kconfig diff page, displaying differences between available Kconfig options across releases. To generate the new documentation page, set the KCONFIGDIFF CMake option to ON.

    • The API Reference documentation set to serve as an entry point to doxygen-generated API documentation for various components.

    • The page for each sample now contains an Open in VS Code button allowing to quickly open the sample and install required version of the nRF Connect SDK toolchain.

  • Updated: