SDK upgrade guide
nRF Connect SDK 3.3 to nRF Connect SDK 3.4: what needs attention
Migratorisk's knowledge base lists 55 documented changes between nRF Connect SDK 3.3 and nRF Connect SDK 3.4 across 2 releases. 42 of them are rated likely to break code, configuration or builds that use them. Below is each change, what a scan also reviews on this path, and how to see which ones apply to your project.
Find which of these affect your firmware
Migratorisk scans your project on your own computer and reports only the changes your code, configuration and build actually touch. Your source code is not uploaded.
python -m pip install migratorisk migratorisk scan --project ./your-firmware --from ncs-3.3.0 --to ncs-3.4.0 --out report.html
Requires Python 3.12 or newer. Results are free and complete without sign-up; sharing a report with us is optional.
Set up the local scanOr answer a few questions insteadWhere the changes are
What changes between nRF Connect SDK 3.3 and nRF Connect SDK 3.4
Ordered by impact. Each item names the release that introduced it and links to the official source. A change only matters if your project uses what changed; the scan checks that.
Partition Manager is disabled by default in NCS 3.4
Partition Manager was deprecated in NCS 3.3 and is disabled by default in the next major release (3.4). Projects that use pm_static.yml or keep Partition Manager enabled must define their flash and RAM partitions in devicetree. Covers 5 names.
Devicetree compatibles microchip,ksz8463 and 2 more were removed
CONFIG_NET_DSA_DEPRECATED has been removed. The drivers for the compatibles microchip,ksz8463, microchip,ksz8794 and microchip,ksz8863 were removed, as they haven't been migrated to the new DSA subsystem. Covers 3 names.
Devicetree compatibles solomon,ssd1327fb and 2 more were renamed
solomon,ssd1327fb, solomon,ssd1306fb and solomon,ssd1309fb devicetree compatibles have been renamed solomon,ssd1327, solomon,ssd1306 and solomon,ssd1309 respectively, to harmonize with other display controllers and eliminate the zephyr-irrelevant fb suffix. Covers 3 names.
Kconfig options CONFIG_CAN_MAX_FILTER and 2 more were replaced
Removed CONFIG_CAN_MAX_FILTER, CONFIG_CAN_MAX_STD_ID_FILTER, CONFIG_CAN_MAX_EXT_ID_FILTER. These are replaced by the following driver-specific Kconfig symbols, some of which have had their default value increased to meet typical software needs:. Covers 3 names.
Kconfig options CONFIG_LINKER_USE_PINNED_SECTION and 1 more were removed
The __pinned_* attribute family and the CONFIG_LINKER_USE_PINNED_SECTION / CONFIG_LINKER_GENERIC_SECTIONS_PRESENT_AT_BOOT Kconfig options are gone. The kernel image is now always resident in physical memory; demand paging applies only to anonymous mappings created via k_mem_map and to symbols placed in the __ondemand_* linker sections via CONFIG_LINKER_USE_ONDEMAND_SECTION. Covers 2 names.
Kconfig options CONFIG_SDL_DISPLAY_DEFAULT_PIXEL_FORMAT_BGR_565 and 1 more were renamed
The Kconfig options CONFIG_SDL_DISPLAY_DEFAULT_PIXEL_FORMAT_BGR_565 and CONFIG_ST7789V_BGR565 have been renamed to CONFIG_SDL_DISPLAY_DEFAULT_PIXEL_FORMAT_RGB_565X and CONFIG_ST7789V_RGB565X respectively. Covers 2 names.
PDN library was removed
NCS 3.4 removes the deprecated PDN library; PDN management is provided by the LTE link control (lte_lc) library. Covers 2 names.
nRF Cloud REST library was removed
NCS 3.4 removes the nRF Cloud REST library and its samples; Nordic's samples moved to the nRF Cloud CoAP library. Covers 2 names.
API http_data_status was renamed
The enum for HTTP server transaction status has been renamed from http_data_status to http_transaction_status to better reflect its purpose.
API uvc_add_format was renamed
uvc_add_format has been renamed to uvc_device_add_format.
API uvc_set_video_dev was renamed
uvc_set_video_dev has been renamed to uvc_device_init.
CONFIG_NRF_SECURITY_ADVANCED was removed
NCS 3.4 removes the CONFIG_NRF_SECURITY_ADVANCED Kconfig option as part of the nRF Security rearrangement for Mbed TLS 4.
Devicetree compatible ilitek,ili9806e-dsi was renamed
The devicetree compatible ilitek,ili9806e-dsi was renamed. Use ilitek,ili9806e instead.
Devicetree compatible st,refresh was removed
st,stm32-xspi-psram and st,stm32-ospi-psram compatible nodes now need to include the st,refresh property to specify the PSRAM refresh rate in number of memory clock cycles. Hard-coded default values in drivers, of 320 (st,stm32-xspi-psram) and 129 (st,stm32-ospi-psram), have been removed.
Devicetree compatible waveshare,7inch-dsi-lcd-c was replaced
waveshare,7inch-dsi-lcd-c devicetree compatible has been replaced by waveshare,dsi2dpi, and CONFIG_WAVESHARE_7INCH_DSI_LCD_C option has been replaced by CONFIG_WAVESHARE_DSI2DPI.
Kconfig option CONFIG_ARCH_HAS_COHERENCE was renamed
Renamed CONFIG_ARCH_HAS_COHERENCE to CONFIG_CACHE_CAN_SAY_MEM_COHERENCE as the feature is cache related so move it under cache.
Kconfig option CONFIG_BT_TBS_SUPPORTED_FEATURES was removed
CONFIG_BT_TBS_SUPPORTED_FEATURES has been removed. Applications should use the defined macros BT_TBS_FEATURE_HOLD and BT_TBS_FEATURE_JOIN to set their supported features.
Kconfig option CONFIG_CAN_MAX_MB was replaced
Replaced Kconfig option CONFIG_CAN_MAX_MB for nxp,flexcan and nxp,flexcan-fd with per-instance a number-of-mb devicetree property.
Kconfig option CONFIG_CAN_MCUX_MCAN was renamed
Renamed the NXP LPC family MCAN driver Kconfig option CONFIG_CAN_MCUX_MCAN to CONFIG_CAN_NXP_LPC_MCAN as this driver is not based on the NXP MCUXpresso HAL.
Kconfig option CONFIG_CSPRNG_AVAILABLE was renamed
CONFIG_CSPRNG_AVAILABLE has been renamed to CONFIG_ENTROPY_NODE_ENABLED.
Kconfig option CONFIG_ETH_SAM_GMAC_MAC_I2C_EEPROM was removed
Removed CONFIG_ETH_SAM_GMAC_MAC_I2C_EEPROM.
Kconfig option CONFIG_ETH_SAM_GMAC_MAC_I2C_INT_ADDRESS was removed
Removed CONFIG_ETH_SAM_GMAC_MAC_I2C_INT_ADDRESS.
Kconfig option CONFIG_ETH_SAM_GMAC_MAC_I2C_INT_ADDRESS_SIZE was removed
Removed CONFIG_ETH_SAM_GMAC_MAC_I2C_INT_ADDRESS_SIZE.
Kconfig option CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS was removed
Previously deprecated CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS is now removed.
Kconfig option CONFIG_FLASH_AREA_CHECK_INTEGRITY_PSA was removed
CONFIG_FLASH_AREA_CHECK_INTEGRITY_PSA is also removed since there is now no alternative for the crypto library backend.
Kconfig option CONFIG_HAWKBIT_DDI_NO_SECURITY was removed
The deprecated Kconfig option CONFIG_HAWKBIT_DDI_NO_SECURITY has been removed.
Kconfig option CONFIG_JWT_SIGN_RSA_LEGACY was removed
Previously deprecated CONFIG_JWT_SIGN_RSA_LEGACY is removed. This removal occurred before the usual deprecation period of 2 releases because it has been agreed that Mbed TLS is an external module, so normal deprecation rules do not apply in this case.
Kconfig option CONFIG_MBEDTLS_ENTROPY_POLL_ZEPHYR was renamed
CONFIG_MBEDTLS_ENTROPY_POLL_ZEPHYR has been renamed to CONFIG_MBEDTLS_PSA_DRIVER_GET_ENTROPY.
Kconfig option CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT was replaced
CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT has been replaced by the underlying options it used to enable: CONFIG_MBEDTLS_PEM_PARSE_C, CONFIG_MBEDTLS_PEM_WRITE_C and CONFIG_MBEDTLS_BASE64_C.
Kconfig option CONFIG_MBEDTLS_SERVER_NAME_INDICATION was renamed
CONFIG_MBEDTLS_SERVER_NAME_INDICATION has been renamed to CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION.
Kconfig option CONFIG_MBEDTLS_TEST was renamed
CONFIG_MBEDTLS_TEST has been renamed to CONFIG_MBEDTLS_DEBUG_C.
Kconfig option CONFIG_NET_DSA_DEPRECATED was removed
CONFIG_NET_DSA_DEPRECATED has been removed. The drivers for the compatibles microchip,ksz8463, microchip,ksz8794 and microchip,ksz8863 were removed, as they haven't been migrated to the new DSA subsystem.
Kconfig option CONFIG_OPENTHREAD_CRYPTO_LEGACY_MBEDTLS_CONFIG was removed
Following Mbed TLS bump to version 4.1.0, legacy crypto support is no longer available in Zephyr. Therefore CONFIG_OPENTHREAD_CRYPTO_LEGACY_MBEDTLS_CONFIG has been removed. CONFIG_OPENTHREAD_CRYPTO_PSA_CONFIG was already the default choice for crypto support and it is now the only supported crypto option.
Kconfig option CONFIG_SETTINGS_TFM_ITS was renamed
CONFIG_SETTINGS_TFM_ITS has been renamed to CONFIG_SETTINGS_TFM_PSA.
Kconfig option CONFIG_SPI_STM32_USE_HW_SS was removed
The Kconfig option CONFIG_SPI_STM32_USE_HW_SS has been removed. SPI operation mode is now selected automatically based on devicetree configuration: instances with either of the cs-gpios or new st,soft-nss property operate in "Soft NSS" mode, while all other instances operate in "Hard NSS" mode.
Kconfig option CONFIG_SSD1327 was renamed
CONFIG_SSD1327 symbol has been renamed to CONFIG_SSD1327_5 to include SSD1325 as well.
Kconfig option CONFIG_VIDEO_HIMAX_HM01B0 was renamed
CONFIG_VIDEO_HIMAX_HM01B0 has been renamed to CONFIG_VIDEO_HM01B0.
Kconfig option CONFIG_VIDEO_OV7670 was replaced
CONFIG_VIDEO_OV7670 is now gone and replaced by CONFIG_VIDEO_OV767X. This allows supporting both the OV7670 and 0V7675.
Kconfig option CONFIG_WAVESHARE_7INCH_DSI_LCD_C was replaced
waveshare,7inch-dsi-lcd-c devicetree compatible has been replaced by waveshare,dsi2dpi, and CONFIG_WAVESHARE_7INCH_DSI_LCD_C option has been replaced by CONFIG_WAVESHARE_DSI2DPI.
Legacy mbedtls_ crypto APIs were removed (Mbed TLS 4.1)
NCS 3.4 updates Mbed TLS from 3.6.6 to 4.1.0, which removes the legacy, deprecated mbedcrypto APIs prefixed with mbedtls_. Cryptographic operations must use the PSA Crypto API.
Wi-Fi hostap legacy PSA crypto backend was removed
NCS 3.4 removes the older CONFIG_HOSTAP_CRYPTO_ALT_LEGACY_PSA backend; CONFIG_HOSTAP_CRYPTO_ALT_PSA remains.
board.yml entries must declare full_name
Zephyr 4.4 makes the full_name property of board entries in board.yml required; board lookup fails with 'Malformed board YAML file' otherwise.
MCUboot non-PSA signature backends are deprecated
NCS 3.4 deprecates CONFIG_BOOT_ECDSA_TINYCRYPT, CONFIG_BOOT_ECDSA_CC310, CONFIG_BOOT_ED25519_TINYCRYPT and CONFIG_BOOT_ED25519_MBEDTLS in favour of their PSA Crypto counterparts. (CONFIG_BOOT_ECDSA_NRF_OBERON was reinstated in 3.4.1.) Covers 4 names.
nRF Cloud client ID default changed from IMEI to device UUID
NCS 3.4 changes the default nRF Cloud client ID source from IMEI to the device UUID. Devices that relied on the IMEI default connect with a new client ID after the upgrade and appear as new, unprovisioned devices. Covers 4 names.
MCUboot matches images by header load address with DTS partitioning
With devicetree partitioning, NCS 3.4 MCUboot enables CONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRESS by default and matches images by ih_load_address. Images must be signed with imgtool --rom-fixed <partition_address>, which the NCS signing steps handle. Covers 2 names.
nRF Cloud P-GPS Kconfig ranges changed
NCS 3.4 limits CONFIG_NRF_CLOUD_PGPS_NUM_PREDICTIONS and CONFIG_NRF_CLOUD_PGPS_REPLACEMENT_THRESHOLD to the values nRF Cloud supports. Covers 2 names.
Fast Pair partition overlays need zephyr,mapped-partition
NCS 3.4 migrates Fast Pair partition overlays from fixed-partitions to zephyr,mapped-partition. This is mandatory on nRF53 Series targets, where the network core image otherwise links outside the valid flash range.
Global nRF HAL defines are deprecated
NCS 3.4 deprecates global HAL defines such as NRF52840_XXAA, NRF5340_XXAA_APPLICATION, NRF_APPLICATION and the ENABLE_APPROTECT family. Code must not reference them.
Haltium and Lumos platform names were replaced
NCS 3.4 replaces the Haltium and Lumos platform names with SOC_SERIES symbols. The old Kconfig options, sysbuild option, headers and macro remain as deprecated aliases for one release. Covers 5 names.
CONFIG_SRAM_SIZE and CONFIG_SRAM_BASE_ADDRESS are deprecated
NCS 3.4 deprecates setting CONFIG_SRAM_SIZE and CONFIG_SRAM_BASE_ADDRESS in favour of the zephyr,sram chosen devicetree node. It is a recommended change in 3.4 and becomes required in the next release. Covers 2 names.
CONFIG_FPROTECT replaced for MCUboot self-protection on nRF54L
In NCS 3.4, nRF Desktop and Fast Pair on nRF54L use CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX instead of CONFIG_FPROTECT to protect the MCUboot area.
CONFIG_NRF_SECURITY is now enabled automatically
In NCS 3.4, CONFIG_NRF_SECURITY no longer has a prompt and is enabled by CONFIG_PSA_CRYPTO, so setting it directly has no effect.
Devicetree compatible zephyr,code-partition is deprecated
Boards that use CONFIG_USE_DT_CODE_PARTITION or have a zephyr,code-partition chosen node set should now use the new zephyr,mapped-partition compatible.
Enable CONFIG_MBEDTLS only for TLS or X.509
From NCS 3.4, nRF Security uses Zephyr's Mbed TLS integration as-is (CONFIG_MBEDTLS_BUILTIN) with Oberon PSA Crypto (CONFIG_TF_PSA_CRYPTO_CUSTOM). CONFIG_MBEDTLS should be enabled only for TLS or X.509; cryptographic operations need only CONFIG_PSA_CRYPTO.
NCS 3.4.x is the last release line with nRF52 Series support
NCS 3.4.0 and its patch releases are the last NCS releases that include nRF52 Series support. 3.4 is a long-term support release, so nRF52 products should plan to stay on the 3.4.x line.
What a scan of this path also reviews
Beyond the documented changes, Migratorisk reviews these upgrade risks for nRF Connect SDK projects on this path. Each one is reported only when the project shows the trigger.
Custom nRF54/nRF53 board files need NCS 3.4 hardware model review
When it applies: Custom board files and devicetree review targets were found.
Why it matters: NCS 3.3 custom boards should be checked against NCS 3.4 hardware model, chosen-node, pinctrl, and devicetree compatibility guidance before source cleanup.
What to do: Review board directory layout, revision overlays, compatibles, chosen nodes, pinctrl assumptions, and network-core overlays.
Devicetree binding error found in NCS 3.3 to 3.4 build log
When it applies: Build log reports a devicetree binding failure.
Why it matters: Custom board and overlay binding failures should be fixed before interpreting later source API errors.
What to do: Fix custom board and overlay binding errors before treating source API findings as migration failures.
Undefined Kconfig symbol found in NCS 3.3 to 3.4 build log
When it applies: Build log reports an undefined Kconfig symbol after the upgrade attempt.
Why it matters: BLE, MCUboot, mcumgr, board, or nRF54-family symbols can shift dependencies between NCS 3.3 and 3.4.
What to do: Resolve undefined Kconfig symbols before chasing compiler or linker errors later in the log.
MCUboot include or symbol breakage found
When it applies: Build log shows MCUboot-related missing headers or undefined references.
Why it matters: Bootloader include paths, image confirmation, and ownership can still shift between NCS 3.3 and 3.4.
What to do: Resolve sysbuild and Kconfig ownership first, then review the exact MCUboot symbol or include reported in the log.
NCS 3.3 partition layout needs NCS 3.4 review
When it applies: Static partition data may encode OTA, settings, MCUboot, or external-flash assumptions.
Why it matters: NCS 3.3 to 3.4 upgrades can still expose partition ownership or image-size issues before source-level findings are meaningful.
What to do: Compare generated partition reports for MCUboot slots, settings, persistent storage, and external flash after the upgraded sysbuild build.
Signing key path is embedded in NCS 3.3 config
When it applies: A boot signing key path is configured in project files.
Why it matters: Signing configuration and production credentials should be sanitized in public fixtures and revalidated privately before an NCS 3.4 migration.
What to do: Remove private keys and credentials from shared fixtures and verify signing configuration in a private local validation run.
NCS 3.3 sysbuild configuration needs NCS 3.4 review
When it applies: Project has sysbuild, bootloader, or multi-image configuration while targeting NCS 3.4.
Why it matters: NCS 3.3 projects should verify MCUboot, network-core, and application image ownership before treating later build errors as independent migration work.
What to do: Review sysbuild ownership for MCUboot, network core, and application image settings before source cleanup.
West manifest references NCS 3.3 revisions
When it applies: west.yml references old NCS or Zephyr revisions.
Why it matters: Manifest revision drift can make the upgrade build unrepresentative before project-local migration work starts.
What to do: Update the workspace manifest intentionally, then rerun the scan against the upgraded build log.
NCS 3.3 source API review pattern found
When it applies: Source uses BLE, settings, flash map, or bootloader APIs that deserve review after the upgraded build is stable.
Why it matters: This evidence is review-only unless paired with a concrete upgraded build failure.
What to do: Review source API usage after west, sysbuild, partition, board, Kconfig, and devicetree issues are addressed.
NCS 3.3 Bluetooth API usage needs NCS 3.4 review
When it applies: Application source uses Bluetooth APIs that should be checked against the target NCS Bluetooth stack.
Why it matters: Large NCS jumps can expose changed Bluetooth defaults, dependencies, privacy behavior, and GATT/advertising assumptions.
What to do: Review Bluetooth initialization, advertising, scanning, connection, GATT, identity, and privacy usage after the upgraded build is stable.
NCS 3.3 DFU, MCUboot, and mcumgr API usage needs NCS 3.4 review
When it applies: Application source uses DFU, MCUboot, image-management, or SMP APIs.
Why it matters: NCS 3.x migrations often move image ownership into sysbuild and can expose changed bootloader, mcumgr, and DFU dependencies.
What to do: Review image confirmation, upgrade request, mcumgr/SMP transport, FOTA download, DFU target, and download client paths together with partition and sysbuild changes.
NCS 3.3 driver API usage needs NCS 3.4 review
When it applies: Application source uses Zephyr/Nordic driver-facing APIs.
Why it matters: Driver migrations can expose devicetree, pinctrl, power-management, and device readiness assumptions.
What to do: Review device acquisition, readiness checks, pinctrl/devicetree references, and board-specific driver configuration.
NCS 3.3 LTE and modem API usage needs NCS 3.4 review
When it applies: Application source uses Nordic modem, LTE, AT command, modem-info, or location APIs.
Why it matters: nRF91-era migrations can require modem library, LTE link controller, AT command, and location dependency review.
What to do: Review modem library initialization, LTE lifecycle, AT command calls, modem info reads, and GNSS/location flows against the target SDK.
NCS 3.3 network stack API usage needs NCS 3.4 review
When it applies: Application source uses socket, MQTT, CoAP, Thread/OpenThread, Wi-Fi, Nordic cloud, or date/time APIs.
Why it matters: Network migrations can require Kconfig, TLS/security, modem, Thread, Wi-Fi, and cloud dependency review.
What to do: Review network initialization, transport dependencies, TLS/security configuration, cloud flows, and protocol smoke tests.
NCS 3.3 device model and kernel runtime API usage needs NCS 3.4 review
When it applies: Application source uses device model, devicetree macros, partition manager APIs, runtime PM, kernel primitives, or Nordic app framework APIs.
Why it matters: These APIs are sensitive to devicetree, Kconfig, power-management, and generated-header changes across SDK upgrades.
What to do: Review generated devicetree access, device readiness, runtime PM, partition manager symbols, workqueue/thread/timer usage, and app framework event definitions.
NCS 3.3 crypto and TF-M API usage needs NCS 3.4 review
When it applies: Application source uses crypto, PSA, mbedTLS, TF-M, or security-adjacent serialization headers.
Why it matters: Security backend selection and TF-M integration can change dependencies, Kconfig, and runtime behavior across large NCS jumps.
What to do: Review crypto backend configuration, PSA initialization, TF-M calls, key storage, and secure/non-secure boundaries.
NCS 3.3 storage and flash API usage needs NCS 3.4 review
When it applies: Application source uses settings, NVS/ZMS, flash map, flash image, or filesystem APIs.
Why it matters: Storage behavior is tightly coupled to partition manager, MCUboot slots, settings placement, and filesystem dependencies.
What to do: Review persistent storage ownership, flash area IDs, image slots, settings handlers, and filesystem mount paths after partition migration.
First build-log migration error found
When it applies: Build log contains a first high-signal migration error.
Why it matters: Early Kconfig, devicetree, sysbuild, or partition failures often cause later cascading compiler and linker noise.
What to do: Fix this first error before treating later build-log lines as independent migration work.
VelocityCreate
Want us to handle the upgrade?
VelocityCreate can review your assessment, agree on the migration scope, and carry out the firmware changes and agreed verification. Discuss your deadline, hardware, and requirements with an embedded engineer.
Discuss my migrationBook a technical callThe initial discussion is free. Implementation is quoted separately.
Related upgrade paths
- nRF Connect SDK 2.9 to nRF Connect SDK 3.4
- nRF Connect SDK 2.6 to nRF Connect SDK 3.4
- nRF Connect SDK 3.2 to nRF Connect SDK 3.3
Generated from the rule catalog of Migratorisk 0.3.0. This is an automated summary of published SDK changes, not a review of your project, and it does not replace builds and device tests. How the scanner is validated.