SDK upgrade guide
nRF Connect SDK 2.7 to nRF Connect SDK 2.8: what needs attention
Migratorisk's knowledge base lists 22 documented changes between nRF Connect SDK 2.7 and nRF Connect SDK 2.8 across 2 releases. 15 of them are rated likely to break code, configuration or builds that use them. Below is each change, what a scan also reviews on this path, and how to see which ones apply to your project.
Find which of these affect your firmware
Migratorisk scans your project on your own computer and reports only the changes your code, configuration and build actually touch. Your source code is not uploaded.
python -m pip install migratorisk migratorisk scan --project ./your-firmware --from ncs-2.7.0 --to ncs-2.8.0 --out report.html
Requires Python 3.12 or newer. Results are free and complete without sign-up; sharing a report with us is optional.
Set up the local scanOr answer a few questions insteadWhere the changes are
What changes between nRF Connect SDK 2.7 and nRF Connect SDK 2.8
Ordered by impact. Each item names the release that introduced it and links to the official source. A change only matters if your project uses what changed; the scan checks that.
lte_lc init and fallback APIs were removed
NCS 2.8 removes lte_lc_init(), lte_lc_deinit(), lte_lc_init_and_connect(_async)(), LTE_LC_ON_CFUN and CONFIG_LTE_NETWORK_USE_FALLBACK. Covers 4 names.
CRACEN seed option renamed and CFB/OFB cipher modes removed
NCS 2.8 renames CONFIG_CRACEN_LOAD_KMU_SEED to CONFIG_CRACEN_IKG_SEED_LOAD and removes CONFIG_MBEDTLS_CIPHER_MODE_CFB and CONFIG_MBEDTLS_CIPHER_MODE_OFB. Covers 3 names.
Kconfig options CONFIG_MBEDTLS_MAC_MD4_ENABLED and 2 more were removed
The Kconfig options CONFIG_MBEDTLS_MAC_MD4_ENABLED, CONFIG_MBEDTLS_CIPHER_ARC4_ENABLED and CONFIG_MBEDTLS_CIPHER_BLOWFISH_ENABLED were removed because they are no more supported in Mbed TLS. Covers 3 names.
Kconfig options CONFIG_ESPI_SLAVE and 1 more were renamed
The macros ESPI_SLAVE_TO_MASTER and ESPI_MASTER_TO_SLAVE were renamed to ESPI_TARGET_TO_CONTROLLER and ESPI_CONTROLLER_TO_TARGET respectively to reflect the new terminology in eSPI 1.5 specification. Covers 2 names.
at_parser_cmd_type_get was renamed
NCS 2.8 renames at_parser_cmd_type_get() to at_parser_at_cmd_type_get() and deprecates the AT command parser library in favour of the AT parser. Covers 2 names.
API ESPI_MASTER_TO_SLAVE was renamed
The macros ESPI_SLAVE_TO_MASTER and ESPI_MASTER_TO_SLAVE were renamed to ESPI_TARGET_TO_CONTROLLER and ESPI_CONTROLLER_TO_TARGET respectively to reflect the new terminology in eSPI 1.5 specification.
API uart_rpi_pico was removed
The Raspberry Pi UART driver uart_rpi_pico has been removed. Use uart_pl011 (arm,pl011) instead.
CONFIG_SECURE_BOOT_DEBUG was removed
NCS 2.8 removes CONFIG_SECURE_BOOT_DEBUG; NSIB (b0/b0n) now uses the logging subsystem.
Kconfig option CONFIG_CAN_AUTO_BUS_OFF_RECOVERY was renamed
The Kconfig CONFIG_CAN_AUTO_BUS_OFF_RECOVERY was renamed (and inverted) to CONFIG_CAN_MANUAL_RECOVERY_MODE, which is disabled by default. This Kconfig option enables support for the can_recover API function and a new manual recovery mode (see the next bullet).
Kconfig option CONFIG_MBEDTLS_MAC_ALL_ENABLED was removed
The CONFIG_MBEDTLS_MAC_ALL_ENABLED Kconfig option has been removed. Its equivalent is the combination of CONFIG_MBEDTLS_HASH_ALL_ENABLED and CONFIG_MBEDTLS_CMAC.
Kconfig option CONFIG_MODEM_CHAT_LOG_BUFFER was renamed
The CONFIG_MODEM_CHAT_LOG_BUFFER Kconfig option was renamed to CONFIG_MODEM_CHAT_LOG_BUFFER_SIZE.
Kconfig option CONFIG_SOC_IT82202_AX was renamed
ITE: Rename all SoC variant Kconfig options, e.g., CONFIG_SOC_IT82202_AX is renamed to CONFIG_SOC_IT82202AX. All symbols are renamed as follows: SOC_IT81202BX, SOC_IT81202CX, SOC_IT81302BX, SOC_IT81302CX, SOC_IT82002AW, SOC_IT82202AX, SOC_IT82302AX. And, rename the SOC_SERIES_ITE_IT8XXX2 to SOC_SERIES_IT8XXX2.
Kconfig option CONFIG_WS2812_STRIP_DRIVER was removed
The CONFIG_WS2812_STRIP_DRIVER kconfig option has been removed. Previously, when using CONFIG_WS2812_STRIP_SPI, CONFIG_WS2812_STRIP_I2S, CONFIG_WS2812_STRIP_GPIO, or CONFIG_WS2812_STRIP_RPI_PICO_PIO, one of them had to be selected with CONFIG_WS2812_STRIP_DRIVER, but this is no longer necessary. Please set each option directly.
LwM2M carrier smartcard bootstrap option was removed
NCS 2.8 removes CONFIG_LWM2M_CARRIER_BOOTSTRAP_SMARTCARD; bootstrap from smartcard needs the UICC LwM2M library.
nRF70 and WPA supplicant Kconfig namespaces renamed
NCS 2.8 renames the nRF70 driver namespace from NRF700X to NRF70 and the WPA supplicant namespace from WPA_SUPP to WIFI_NM_WPA_SUPPLICANT, as both moved to upstream Zephyr.
lte_lc features now need module Kconfig options
NCS 2.8 splits lte_lc into modules; eDRX, PSM, RAI, modem sleep, TAU pre-warning, neighbour-cell, periodic search and connection evaluation APIs need their CONFIG_LTE_LC_*_MODULE option. Covers 10 names.
Sysbuild assigns MCUboot image IDs
NCS 2.8 assigns MCUboot image IDs in sysbuild; applications, serial recovery and MCUmgr hooks must use the assigned IDs, which can differ from earlier releases. Covers 2 names.
Kconfig options CONFIG_DISABLE_SSBD and 1 more are deprecated
Kconfigs CONFIG_DISABLE_SSBD and CONFIG_ENABLE_EXTENDED_IBRS are deprecated. Use CONFIG_X86_DISABLE_SSBD and CONFIG_X86_ENABLE_EXTENDED_IBRS instead. Covers 2 names.
API z_arch_esf_t is deprecated
The named struct z_arch_esf_t is now deprecated. Use struct arch_esf instead.
Devicetree compatible zephyr,bt-hci is deprecated
A new HCI driver API was introduced and the old one deprecated. The new API follows the normal Zephyr driver model, with devicetree nodes, etc. The host now selects which driver instance to use as the controller by looking for a zephyr,bt-hci chosen property. The devicetree bindings for all HCI drivers derive from a common bt-hci.yaml base binding.
Kconfig option CONFIG_ARM64_ENABLE_FRAME_POINTER is deprecated
CONFIG_ARM64_ENABLE_FRAME_POINTER is deprecated. Use CONFIG_FRAME_POINTER instead.
nRF Cloud CoAP downloads enabled by default
NCS 2.8 enables CONFIG_NRF_CLOUD_COAP_DOWNLOADS by default for CoAP projects using FOTA polling or P-GPS, which needs a larger CONFIG_COAP_EXTENDED_OPTIONS_LEN_VALUE.
What a scan of this path also reviews
Beyond the documented changes, Migratorisk reviews these upgrade risks for nRF Connect SDK projects on this path. Each one is reported only when the project shows the trigger.
Devicetree binding error in build log
When it applies: The build log reports a devicetree binding error.
Why it matters: Bindings and compatibles change between releases; overlay and board errors must be fixed before source-level errors are meaningful.
What to do: Update overlays and board files to the target release bindings before addressing source errors.
Undefined Kconfig symbol in build log
When it applies: The build log reports an assignment to an undefined Kconfig symbol.
Why it matters: Symbols are renamed or removed between NCS releases; Kconfig errors stop the build before later problems appear.
What to do: Look up each undefined symbol in the migration notes of every release on the path and replace or remove it.
Custom board needs the target release devicetree and Kconfig review
When it applies: The project contains custom board files.
Why it matters: Board files track SoC devicetree, pinctrl and Kconfig changes between releases even after the hardware model v2 port.
What to do: Compare the custom board against the matching Nordic DK board files in the target release (chosen nodes, pinctrl, partitions, SoC variant).
Verify OTA from the current field firmware
When it applies: The project uses MCUboot, so devices in the field keep their current bootloader after the upgrade.
Why it matters: The new application image must still be accepted by the existing bootloader (signature type, key, slot layout and image header).
What to do: Keep the signing key, signature type and slot layout unchanged and test an OTA update from the current production image to the upgraded image on hardware.
Static partition layout must stay identical across the upgrade
When it applies: pm_static.yml fixes the flash layout used by devices in the field.
Why it matters: Minor releases can change default partition sizes or image composition; any address change breaks OTA compatibility with devices in the field.
What to do: Compare the generated partition report before and after the upgrade and keep MCUboot slots, settings and storage partitions at the same addresses and sizes.
West manifest references an older SDK revision
When it applies: west.yml pins an NCS or Zephyr revision.
Why it matters: The manifest must point at the target release, and pinned module revisions must match it.
What to do: Update the sdk-nrf revision in west.yml to the target release tag, re-check pinned modules, then run west update.
Signing key configured in project files
When it applies: A signing key path is configured in the project.
Why it matters: The same key must keep signing upgraded images so bootloaders in the field accept them; production keys should not live in shared project files.
What to do: Confirm the production signing key and signature type are unchanged for the upgraded build and kept outside shared repositories.
Fix the first build error first
When it applies: The build log contains errors.
Why it matters: Later errors in an SDK upgrade are often caused by the first configuration or devicetree failure.
What to do: Resolve the first reported error, rebuild, and re-run the scan with the new build log.
VelocityCreate
Want us to handle the upgrade?
VelocityCreate can review your assessment, agree on the migration scope, and carry out the firmware changes and agreed verification. Discuss your deadline, hardware, and requirements with an embedded engineer.
Discuss my migrationBook a technical callThe initial discussion is free. Implementation is quoted separately.
Related upgrade paths
Generated from the rule catalog of Migratorisk 0.3.0. This is an automated summary of published SDK changes, not a review of your project, and it does not replace builds and device tests. How the scanner is validated.