Is nrf connect 1.5.1 with zephyr v2.4.99 safe to use in production?

[Poorp]

Hi

I'm a bit unsure as to how to interpret the documentation. It's my understanding that zephyr v2.4.99 is an unstable development release. But it seems to be the only release available with the nrf connect sdk .

So a few questions:

1) As you just released nrf connect sdk 1.5.1 it is my understanding that another release, based on a stable zephyr version e.g 2.5.0, can't be expected for several months. If so we won't be able to wait for it as we are getting ready to ship.

1) Is the zephyr version included with the nrf connect sdk (v2.4.99-ncs2) stable enough for production use? Or should we be using v2.4.0-ncs2 or another version entirely? If the later how to we tell which nrf connect sdk versions are compatible with that version of zephyr?

3) Does zephyr v2.4.99-ncs2 have patches for the below cve:s. If not do you know where I can find a description of them? The embargo date has passed, but I can't seem to find any info on them.

• CVE-2021-3323: Under embargo until 2021-04-14

• CVE-2021-3321: Under embargo until 2021-04-14

• CVE-2021-3320: Under embargo until 2021-04-14

  https://docs.zephyrproject.org/latest/releases/release-notes-2.5.html
  
  
  Thanks in advance
  /poorp

[Didrik Rokhaug]

Hi,

 

1) Is the zephyr version included with the nrf connect sdk (v2.4.99-ncs2) stable enough for production use? Or should we be using v2.4.0-ncs2 or another version entirely? If the later how to we tell which nrf connect sdk versions are compatible with that version of zephyr?

 It should be safe to use all the NCS releases (at least from v1.0.0 and up) in production, though there might be some features in the release that is not considered production ready yet.

In this particular case, I believe the reason Zephyr 2.5.0 isn't in NCS 1.5.0 (whihc 1.5.1 is based on), is that the Zephyr release got delayed a bit at the end of the release process. But, Zephyr v2.4.99-ncs2 should be very close to Zephyr 2.5.0.

 

3) Does zephyr v2.4.99-ncs2 have patches for the below cve:s. If not do you know where I can find a description of them? The embargo date has passed, but I can't seem to find any info on them.

 I will have to come back to you later regarding this.

Best regards,

Didrik