Last week, I attended Open Source Summit Europe in Prague, focusing on the Zephyr Developer Summit, as a software tech lead at Kickmaker. The timing was good: Zephyr had just turned ten, and v4.5 was about to be released, so many of the talks covered what was coming in that version.
The conference opened with a “Zephyr at 10” talk looking back at the project’s first decade. The rest of the event made one thing clear: the question is shifting from whether Zephyr is ready for real products to what it takes to ship certified, connected products on it at scale.
Cybersecurity and certification
The EU Cyber Resilience Act (CRA) came up frequently. Reporting obligations for actively exploited vulnerabilities and severe incidents have applied since 11 September 2026, and full compliance is required from 11 December 2027. Zephyr is already making progress in this area: it can generate software bills of materials (SBOMs) in SPDX 3 format, which the CRA requires, and includes PURL and CPE identifiers where they apply.
On the safety side, the project is working toward certifying part of Zephyr as a Safety Element out of Context. Talks covered requirements traceability and how splitting the architecture into components can make certification easier. For manufacturers, this means compliance has to be part of the development process from the start.
Networking and hardware support
Zephyr continues to expand. Version 4.5 brings a major update to the network stack, including WireGuard, SSH, QUIC and HTTP/3, IPv4 forwarding and NAT, as well as better throughput.
On the hardware side, Zephyr increasingly targets MPU-class chips like the i.MX 9 family, while small MCUs remain a core target. One talk showed how Zephyr can run alongside Linux on heterogeneous SoCs, using OpenAMP and RPMsg, instead of replacing it. Another, from Infineon, covered the ongoing work on SMP support.
Development and testing tools
On the tooling side, native_sim featured throughout the conference. It was used to test the network stack, USB and other components without physical hardware. Another talk covered writing and using fake drivers to test modules in isolation.
Graphical devicetree and pin configuration, Zephelin for runtime tracing, and LLEXT for dynamic extensions were also covered, making day-to-day development smoother.
As Zephyr continues to evolve, staying up to date with the latest developments is essential to making informed technical choices. At Kickmaker, we make continuous learning part of our engineering approach, so we can bring relevant, up-to-date expertise to our clients’ projects.
