SDK upgrade guide
nRF Connect SDK 2.6 to nRF Connect SDK 3.0: what needs attention
Migratorisk's knowledge base lists 54 documented changes between nRF Connect SDK 2.6 and nRF Connect SDK 3.0 across 7 releases. 38 of them are rated likely to break code, configuration or builds that use them. Below is each change, what a scan also reviews on this path, and how to see which ones apply to your project.
Find which of these affect your firmware
Migratorisk scans your project on your own computer and reports only the changes your code, configuration and build actually touch. Your source code is not uploaded.
python -m pip install migratorisk migratorisk scan --project ./your-firmware --from ncs-2.6.0 --to ncs-3.0.0 --out report.html
Requires Python 3.12 or newer. Results are free and complete without sign-up; sharing a report with us is optional.
Set up the local scanOr answer a few questions insteadWhere the changes are
What changes between nRF Connect SDK 2.6 and nRF Connect SDK 3.0
Ordered by impact. Each item names the release that introduced it and links to the official source. A change only matters if your project uses what changed; the scan checks that.
Kconfig options CONFIG_BT_MESH_TX_SEG_RETRANS_COUNT and 4 more were removed
Removed the CONFIG_BT_MESH_TX_SEG_RETRANS_COUNT, CONFIG_BT_MESH_TX_SEG_RETRANS_TIMEOUT_UNICAST, CONFIG_BT_MESH_TX_SEG_RETRANS_TIMEOUT_GROUP, CONFIG_BT_MESH_SEG_ACK_BASE_TIMEOUT, CONFIG_BT_MESH_SEG_ACK_PER_HOP_TIMEOUT, BT_MESH_SEG_ACK_PER_SEGMENT_TIMEOUT Kconfig options. Covers 5 names.
lte_lc init and fallback APIs were removed
NCS 2.8 removes lte_lc_init(), lte_lc_deinit(), lte_lc_init_and_connect(_async)(), LTE_LC_ON_CFUN and CONFIG_LTE_NETWORK_USE_FALLBACK. Covers 4 names.
CRACEN seed option renamed and CFB/OFB cipher modes removed
NCS 2.8 renames CONFIG_CRACEN_LOAD_KMU_SEED to CONFIG_CRACEN_IKG_SEED_LOAD and removes CONFIG_MBEDTLS_CIPHER_MODE_CFB and CONFIG_MBEDTLS_CIPHER_MODE_OFB. Covers 3 names.
Kconfig options CONFIG_MBEDTLS_MAC_MD4_ENABLED and 2 more were removed
The Kconfig options CONFIG_MBEDTLS_MAC_MD4_ENABLED, CONFIG_MBEDTLS_CIPHER_ARC4_ENABLED and CONFIG_MBEDTLS_CIPHER_BLOWFISH_ENABLED were removed because they are no more supported in Mbed TLS. Covers 3 names.
Devicetree compatibles microchip,mcp230xx and 1 more were removed
The devicetree bindings for the Microchip mcp23xxx series have been split up. Users of microchip,mcp230xx and microchip,mcp23sxx should change their devicetree compatible values to the specific chip variant, e.g. microchip,mcp23017. The ngpios devicetree property has been removed, since it is implied by the model name. Covers 2 names.
FEM tx gain functions replaced
NCS 2.7 replaces fem_tx_gain_set() with fem_tx_power_control_set() and fem_default_tx_gain_get() with fem_default_tx_output_power_get(). Covers 2 names.
Kconfig options CONFIG_BT_HCI_RESERVE and 1 more were removed
The CONFIG_BT_HCI_RESERVE and CONFIG_BT_HCI_RAW_RESERVE Kconfig options were removed. All buffers get by default one byte of headroom now, which HCI transport implementations can rely on (whether they need it or not). Covers 2 names.
Kconfig options CONFIG_ESPI_SLAVE and 1 more were renamed
The macros ESPI_SLAVE_TO_MASTER and ESPI_MASTER_TO_SLAVE were renamed to ESPI_TARGET_TO_CONTROLLER and ESPI_CONTROLLER_TO_TARGET respectively to reflect the new terminology in eSPI 1.5 specification. Covers 2 names.
Kconfig options CONFIG_MBEDTLS_TLS_VERSION_1_0 and 1 more were removed
The Kconfig options CONFIG_MBEDTLS_TLS_VERSION_1_0 and CONFIG_MBEDTLS_TLS_VERSION_1_1 have been removed because Mbed TLS doesn't support TLS 1.0 and 1.1 anymore since v3.0. Covers 2 names.
Kconfig options CONFIG_ZBUS_MSG_SUBSCRIBER_NET_BUF_DYNAMIC and 1 more were renamed
The CONFIG_ZBUS_MSG_SUBSCRIBER_NET_BUF_DYNAMIC and CONFIG_ZBUS_MSG_SUBSCRIBER_NET_BUF_STATIC zbus options are renamed. Instead, the new CONFIG_ZBUS_MSG_SUBSCRIBER_BUF_ALLOC_DYNAMIC and CONFIG_ZBUS_MSG_SUBSCRIBER_BUF_ALLOC_STATIC options should be used. Covers 2 names.
at_parser_cmd_type_get was renamed
NCS 2.8 renames at_parser_cmd_type_get() to at_parser_at_cmd_type_get() and deprecates the AT command parser library in favour of the AT parser. Covers 2 names.
API BT_AUDIO_BROADCAST_CODE_SIZE was removed
BT_AUDIO_BROADCAST_CODE_SIZE has been removed and BT_ISO_BROADCAST_CODE_SIZE should be used instead.
API ESPI_MASTER_TO_SLAVE was renamed
The macros ESPI_SLAVE_TO_MASTER and ESPI_MASTER_TO_SLAVE were renamed to ESPI_TARGET_TO_CONTROLLER and ESPI_CONTROLLER_TO_TARGET respectively to reflect the new terminology in eSPI 1.5 specification.
API NET_SOCKET_SERVICE_SYNC_DEFINE_STATIC was removed
The work_q parameter to NET_SOCKET_SERVICE_SYNC_DEFINE and NET_SOCKET_SERVICE_SYNC_DEFINE_STATIC has been removed as it was always ignored.
API ZSR_ALLOCA was renamed
Scratch registers ZSR_ALLOCA has been renamed to ZSR_A0SAVE.
API lorawan_set_battery_level_callback was renamed
The API to register a callback to provide battery level information to the LoRaWAN stack has been renamed from lorawan_set_battery_level_callback to lorawan_register_battery_level_callback and the return type is now void. This is more consistent with similar functions for downlink and data rate changed callbacks.
API uart_rpi_pico was removed
The Raspberry Pi UART driver uart_rpi_pico has been removed. Use uart_pl011 (arm,pl011) instead.
CONFIG_SECURE_BOOT_DEBUG was removed
NCS 2.8 removes CONFIG_SECURE_BOOT_DEBUG; NSIB (b0/b0n) now uses the logging subsystem.
Devicetree compatible litex,eth0 was renamed
The compatible of the LiteX ethernet controller has been renamed from litex,eth0 to litex,liteeth.
Devicetree compatible litex,uart0 was renamed
The compatible of the LiteX uart controller has been renamed from litex,uart0 to litex,uart.
Devicetree compatible microchip,mcp9808 was renamed
The existing driver for the Microchip MCP9808 temperature sensor transformed and renamed to support all JEDEC JC 42.4 compatible temperature sensors. It now uses the jedec,jc-42.4-temp compatible string instead to the microchip,mcp9808 string.
Devicetree compatible zephyr,native-posix-linux-can was renamed
The devicetree compatible was renamed from zephyr,native-posix-linux-can to zephyr,native-linux-can.
Kconfig option CONFIG_BT_RPMSG was renamed
The HCI implementation for both the Host and the Controller sides has been renamed for the IPC transport. The CONFIG_BT_RPMSG Kconfig option is now CONFIG_BT_HCI_IPC, and the zephyr,bt-hci-rpmsg-ipc Devicetree chosen is now zephyr,bt-hci-ipc. The existing sample has also been renamed, from samples/bluetooth/hci_rpmsg to samples/bluetooth/hci_ipc.
Kconfig option CONFIG_CAN_AUTO_BUS_OFF_RECOVERY was renamed
The Kconfig CONFIG_CAN_AUTO_BUS_OFF_RECOVERY was renamed (and inverted) to CONFIG_CAN_MANUAL_RECOVERY_MODE, which is disabled by default. This Kconfig option enables support for the can_recover API function and a new manual recovery mode (see the next bullet).
Kconfig option CONFIG_CAN_NATIVE_POSIX_LINUX was renamed
The main Kconfig option was renamed from CONFIG_CAN_NATIVE_POSIX_LINUX to CONFIG_CAN_NATIVE_LINUX.
Kconfig option CONFIG_COAP_OBSERVER_EVENTS was removed
CoAP observer events have moved from a callback function in a CoAP resource to the Network Events subsystem. The CONFIG_COAP_OBSERVER_EVENTS configuration option has been removed.
Kconfig option CONFIG_MBEDTLS_MAC_ALL_ENABLED was removed
The CONFIG_MBEDTLS_MAC_ALL_ENABLED Kconfig option has been removed. Its equivalent is the combination of CONFIG_MBEDTLS_HASH_ALL_ENABLED and CONFIG_MBEDTLS_CMAC.
Kconfig option CONFIG_MBEDTLS_SSL_EXPORT_KEYS was removed
The Kconfig option CONFIG_MBEDTLS_SSL_EXPORT_KEYS was removed because the corresponding build symbol was removed in Mbed TLS 3.1.0 and is now assumed to be enabled.
Kconfig option CONFIG_MCUBOOT_CMAKE_WEST_SIGN_PARAMS was removed
Removed the CONFIG_MCUBOOT_CMAKE_WEST_SIGN_PARAMS Kconfig option as west sign is no longer called by the build system when signing images for MCUboot.
Kconfig option CONFIG_MODEM_CHAT_LOG_BUFFER was renamed
The CONFIG_MODEM_CHAT_LOG_BUFFER Kconfig option was renamed to CONFIG_MODEM_CHAT_LOG_BUFFER_SIZE.
Kconfig option CONFIG_SOC_IT82202_AX was renamed
ITE: Rename all SoC variant Kconfig options, e.g., CONFIG_SOC_IT82202_AX is renamed to CONFIG_SOC_IT82202AX. All symbols are renamed as follows: SOC_IT81202BX, SOC_IT81202CX, SOC_IT81302BX, SOC_IT81302CX, SOC_IT82002AW, SOC_IT82202AX, SOC_IT82302AX. And, rename the SOC_SERIES_ITE_IT8XXX2 to SOC_SERIES_IT8XXX2.
Kconfig option CONFIG_SPI_NOR_IDLE_IN_DPD was removed
CONFIG_SPI_NOR_IDLE_IN_DPD has been removed from the CONFIG_SPI_NOR driver. An enhanced version of this functionality can be obtained by enabling pm-device-runtime on the device (Tunable with CONFIG_SPI_NOR_ACTIVE_DWELL_MS).
Kconfig option CONFIG_UART_LITEUART was renamed
LiteX: CONFIG_UART_LITEUART has been renamed to CONFIG_UART_LITEX.
Kconfig option CONFIG_WS2812_STRIP_DRIVER was removed
The CONFIG_WS2812_STRIP_DRIVER kconfig option has been removed. Previously, when using CONFIG_WS2812_STRIP_SPI, CONFIG_WS2812_STRIP_I2S, CONFIG_WS2812_STRIP_GPIO, or CONFIG_WS2812_STRIP_RPI_PICO_PIO, one of them had to be selected with CONFIG_WS2812_STRIP_DRIVER, but this is no longer necessary. Please set each option directly.
Kconfig option CONFIG_ZEPHYR_TRY_MASS_ERASE was removed
MCUboot's deprecated CONFIG_ZEPHYR_TRY_MASS_ERASE Kconfig option has been removed. If an erase is needed when flashing MCUboot, this should now be provided directly to the west command e.g. west flash --erase.
LwM2M carrier smartcard bootstrap option was removed
NCS 2.8 removes CONFIG_LWM2M_CARRIER_BOOTSTRAP_SMARTCARD; bootstrap from smartcard needs the UICC LwM2M library.
MQTT helper certificate file option replaced by a folder
NCS 2.7 replaces CONFIG_MQTT_HELPER_CERTIFICATES_FILE with CONFIG_MQTT_HELPER_CERTIFICATES_FOLDER, and provisioned certificates must be standard PEM files.
nRF70 and WPA supplicant Kconfig namespaces renamed
NCS 2.8 renames the nRF70 driver namespace from NRF700X to NRF70 and the WPA supplicant namespace from WPA_SUPP to WIFI_NM_WPA_SUPPLICANT, as both moved to upstream Zephyr.
lte_lc features now need module Kconfig options
NCS 2.8 splits lte_lc into modules; eDRX, PSM, RAI, modem sleep, TAU pre-warning, neighbour-cell, periodic search and connection evaluation APIs need their CONFIG_LTE_LC_*_MODULE option. Covers 10 names.
Bluetooth automatic advertiser resumption macros deprecated
Zephyr 4.0 deprecates BT_LE_ADV_OPT_CONNECTABLE, BT_LE_ADV_OPT_ONE_TIME and BT_LE_ADV_CONN (automatic advertiser resumption); later releases drop the related shorthand macros. Covers 4 names.
IPC radio is the default network-core image
NCS 2.7 builds ipc_radio as the default network/radio core image for multi-core SoCs instead of hci_ipc/hci_rpmsg, 802154_rpmsg or multiprotocol_rpmsg. Covers 4 names.
Matter factory data and OTA options moved to sysbuild
NCS 2.7 deprecates CONFIG_CHIP_FACTORY_DATA_BUILD, CONFIG_CHIP_FACTORY_DATA_MERGE_WITH_FIRMWARE and CONFIG_CHIP_OTA_IMAGE_FILE_NAME in favour of SB_CONFIG_MATTER_* sysbuild options. Covers 3 names.
Sysbuild assigns MCUboot image IDs
NCS 2.8 assigns MCUboot image IDs in sysbuild; applications, serial recovery and MCUmgr hooks must use the assigned IDs, which can differ from earlier releases. Covers 2 names.
ZMS legacy name-cache Kconfig options must be removed
NCS 3.0 says projects migrating the ZMS settings backend must remove CONFIG_SETTINGS_ZMS_NAME_CACHE and CONFIG_SETTINGS_ZMS_NAME_CACHE_SIZE from configuration files unless intentionally staying on the legacy backend. Covers 2 names.
dfu_application.zip format version changed
NCS 2.7 generates dfu_application.zip with format version 1 (new manifest and file names); DFU host tools must support it. Covers 2 names.
CRACEN microcode initialization moved to sysbuild
NCS 3.0 moves CRACEN initialization control from image-level CONFIG_CRACEN_LOAD_MICROCODE to sysbuild-level SB_CONFIG_CRACEN_MICROCODE_LOAD_ONCE.
Kconfig options CONFIG_DISABLE_SSBD and 1 more are deprecated
Kconfigs CONFIG_DISABLE_SSBD and CONFIG_ENABLE_EXTENDED_IBRS are deprecated. Use CONFIG_X86_DISABLE_SSBD and CONFIG_X86_ENABLE_EXTENDED_IBRS instead. Covers 2 names.
API z_arch_esf_t is deprecated
The named struct z_arch_esf_t is now deprecated. Use struct arch_esf instead.
Devicetree compatible zephyr,bt-hci is deprecated
A new HCI driver API was introduced and the old one deprecated. The new API follows the normal Zephyr driver model, with devicetree nodes, etc. The host now selects which driver instance to use as the controller by looking for a zephyr,bt-hci chosen property. The devicetree bindings for all HCI drivers derive from a common bt-hci.yaml base binding.
Kconfig option CONFIG_ARM64_ENABLE_FRAME_POINTER is deprecated
CONFIG_ARM64_ENABLE_FRAME_POINTER is deprecated. Use CONFIG_FRAME_POINTER instead.
Kconfig option CONFIG_NET_SOCKETS_POLL_MAX is deprecated
Deprecated the CONFIG_NET_SOCKETS_POLL_MAX option in favour of CONFIG_ZVFS_POLL_MAX.
Matter watchdog pause mode disabled by default
NCS 2.9 disables the Matter watchdog pause mode by default, so all Matter watchdog sources must be fed within the window.
Modem trace UART backend option deprecated
NCS 2.7 deprecates CONFIG_NRF_MODEM_LIB_TRACE_BACKEND_UART_ZEPHYR; use the nrf91-modem-trace-uart snippet.
nRF Cloud CoAP downloads enabled by default
NCS 2.8 enables CONFIG_NRF_CLOUD_COAP_DOWNLOADS by default for CoAP projects using FOTA polling or P-GPS, which needs a larger CONFIG_COAP_EXTENDED_OPTIONS_LEN_VALUE.
What a scan of this path also reviews
Beyond the documented changes, Migratorisk reviews these upgrade risks for nRF Connect SDK projects on this path. Each one is reported only when the project shows the trigger.
Custom board must be ported to hardware model v2
When it applies: The project contains a custom board definition and the selected path crosses NCS 2.7.0, which introduced hardware model v2.
Why it matters: Board directory layout, naming, board.yml and Kconfig files changed with hardware model v2, so v1 boards must be ported before other build errors are meaningful.
What to do: Port the custom board to hardware model v2 (board.yml, board directory layout, SoC and revision naming) before debugging application-level errors.
Devicetree binding error in build log
When it applies: The build log reports a devicetree binding error.
Why it matters: Bindings and compatibles change between releases; overlay and board errors must be fixed before source-level errors are meaningful.
What to do: Update overlays and board files to the target release bindings before addressing source errors.
Undefined Kconfig symbol in build log
When it applies: The build log reports an assignment to an undefined Kconfig symbol.
Why it matters: Symbols are renamed or removed between NCS releases; Kconfig errors stop the build before later problems appear.
What to do: Look up each undefined symbol in the migration notes of every release on the path and replace or remove it.
Multi-image (child image) build must move to sysbuild
When it applies: The project uses child image configuration and the selected path crosses NCS 2.7.0, where sysbuild replaces the child and parent image system.
Why it matters: MCUboot settings that are not moved to sysbuild are replaced by sysbuild defaults, which can make new firmware updates incompatible with images built by earlier NCS versions.
What to do: Move child_image/*.conf settings into sysbuild (sysbuild.conf and sysbuild/<image>.conf) and keep the MCUboot mode, signature type, key and slot layout identical to the field firmware.
MCUboot enabled in application config must move to sysbuild
When it applies: CONFIG_BOOTLOADER_MCUBOOT is set in an image configuration while the selected path crosses NCS 2.7.0.
Why it matters: From NCS 2.7.0 the bootloader is selected at sysbuild level (SB_CONFIG_BOOTLOADER_MCUBOOT); image-level MCUboot settings are otherwise overridden by sysbuild defaults.
What to do: Enable MCUboot with SB_CONFIG_BOOTLOADER_MCUBOOT in sysbuild.conf and carry over the MCUboot mode, signature type and key path at sysbuild level.
Verify OTA from the current field firmware
When it applies: The project uses MCUboot, so devices in the field keep their current bootloader after the upgrade.
Why it matters: The new application image must still be accepted by the existing bootloader (signature type, key, slot layout and image header).
What to do: Keep the signing key, signature type and slot layout unchanged and test an OTA update from the current production image to the upgraded image on hardware.
Static partition layout must stay identical across the upgrade
When it applies: pm_static.yml fixes the flash layout used by devices in the field.
Why it matters: Major-version jumps cross several releases of partition, bootloader and image-composition changes; any address change breaks OTA compatibility with devices in the field.
What to do: Compare the generated partition report before and after the upgrade and keep MCUboot slots, settings and storage partitions at the same addresses and sizes.
West manifest references an older SDK revision
When it applies: west.yml pins an NCS or Zephyr revision.
Why it matters: The manifest must point at the target release, and pinned module revisions must match it.
What to do: Update the sdk-nrf revision in west.yml to the target release tag, re-check pinned modules, then run west update.
Signing key configured in project files
When it applies: A signing key path is configured in the project.
Why it matters: The same key must keep signing upgraded images so bootloaders in the field accept them; production keys should not live in shared project files.
What to do: Confirm the production signing key and signature type are unchanged for the upgraded build and kept outside shared repositories.
Fix the first build error first
When it applies: The build log contains errors.
Why it matters: Later errors in an SDK upgrade are often caused by the first configuration or devicetree failure.
What to do: Resolve the first reported error, rebuild, and re-run the scan with the new build log.
VelocityCreate
Want us to handle the upgrade?
VelocityCreate can review your assessment, agree on the migration scope, and carry out the firmware changes and agreed verification. Discuss your deadline, hardware, and requirements with an embedded engineer.
Discuss my migrationBook a technical callThe initial discussion is free. Implementation is quoted separately.
Related upgrade paths
- nRF Connect SDK 2.9 to nRF Connect SDK 3.0
- nRF Connect SDK 2.6 to nRF Connect SDK 3.4
- nRF Connect SDK 2.5 to nRF Connect SDK 2.6
- nRF Connect SDK 2.6 to nRF Connect SDK 2.7
- nRF Connect SDK 3.0 to nRF Connect SDK 3.1
Generated from the rule catalog of Migratorisk 0.3.0. This is an automated summary of published SDK changes, not a review of your project, and it does not replace builds and device tests. How the scanner is validated.