The Zephyr Project released Zephyr 4.5.0 on 28 October 2026. Zephyr is the open source real-time operating system behind a lot of IoT firmware, including Nordic's nRF Connect SDK and many sensor, gateway and wearable products. The release had contributions from 1,297 people, a record according to the project, and it will get fixes until 28 October 2027.

Networking

The IP stack is faster: up to 21% higher TCP throughput and up to 12% higher UDP throughput in the project's zperf loopback benchmark. The new protocols matter more for device makers:

  • QUIC and HTTP/3, with TLS 1.3 built in. The project notes that QUIC copes better with lossy links, which is normal for many IoT devices.
  • SSH server and client, so the Zephyr shell can be reached over an encrypted link. Until now it was available over UART, Telnet, WebSocket, MQTT and other backends.
  • Gateway features: IPv4 forwarding, NAT, the IPv6 router role and DHCPv6 prefix delegation. A Zephyr device can now route a downstream network itself, for example a gateway sharing a cellular uplink with the sensors behind it.
  • RTP for sending and receiving media streams over UDP.
  • An MCP server, so AI agents can discover and call tools a device exposes. In the release blog, a board exposes one tool per sensor, and adding a sensor to the devicetree adds a tool on the next build.

Drivers for home and building hardware

Zephyr 4.5 brings new driver classes. DALI (Digital Addressable Lighting Interface) is the bus used for dimmable lighting in offices and many building installations. Pulse IO generates and captures timed digital edges, which is what addressable LED strips and infrared transceivers need. There are also APIs for buzzers, clock monitoring, hardware multiplexers and the LIN automotive bus. The release adds 178 boards and 29 shields.

SBOMs and the Cyber Resilience Act

The release blog headline mentions "SBOMs for the CRA". Zephyr can now generate SPDX 3 software bills of materials that record how the image was built, which prebuilt libraries it links and package identifiers for matching against vulnerability databases. A revamped hardening tool reports findings with CWE references and can run in CI. PSA Crypto now uses hardware acceleration on selected Silicon Labs, NXP and STM32 chips.

That matters because the EU Cyber Resilience Act requires manufacturers of connected products to know what is inside their firmware. An SBOM produced by the build system is far easier to keep accurate than one assembled by hand.

Other changes

Zephyr 4.5 also adds two architectures, Infineon TriCore and the Qualcomm Hexagon DSP, an experimental GStreamer-style multimedia pipeline called mpipe, heap memory error detection and new tracing tools with Perfetto export.