From f0c21520aa5644370d1ed56e05702c35a95be721 Mon Sep 17 00:00:00 2001
From: guillempages <guillempages@users.noreply.github.com>
Date: Mon, 20 Apr 2026 13:56:56 +0200
Subject: [PATCH 01/19] [mipi_rgb] Add definitions for sunton displays (#15858)

---
 esphome/components/mipi_rgb/models/sunton.py | 51 ++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 esphome/components/mipi_rgb/models/sunton.py

diff --git a/esphome/components/mipi_rgb/models/sunton.py b/esphome/components/mipi_rgb/models/sunton.py
new file mode 100644
index 0000000000..a33625dfe4
--- /dev/null
+++ b/esphome/components/mipi_rgb/models/sunton.py
@@ -0,0 +1,51 @@
+from esphome.components.mipi import DriverChip
+from esphome.config_validation import UNDEFINED
+
+# fmt: off
+sunton = DriverChip(
+    "ESP32-8048S070",
+    swap_xy=UNDEFINED,
+    initsequence=(),
+    width=800,
+    height=480,
+    pclk_frequency="12.5MHz",
+    de_pin=41,
+    hsync_pin=39,
+    vsync_pin=40,
+    pclk_pin=42,
+    hsync_pulse_width=30,
+    hsync_back_porch=16,
+    hsync_front_porch=210,
+    vsync_pulse_width=13,
+    vsync_back_porch=10,
+    vsync_front_porch=22,
+    data_pins={
+        "red": [14, 21, 47, 48, 45],
+        "green": [9, 46, 3, 8, 16, 1],
+        "blue": [15, 7, 6, 5, 4],
+    },
+)
+
+sunton.extend(
+    "ESP32-8048S050",
+    swap_xy=UNDEFINED,
+    initsequence=(),
+    width=800,
+    height=480,
+    pclk_frequency="16MHz",
+    de_pin=40,
+    hsync_pin=39,
+    vsync_pin=41,
+    pclk_pin=42,
+    hsync_back_porch=8,
+    hsync_front_porch=8,
+    hsync_pulse_width=4,
+    vsync_back_porch=8,
+    vsync_front_porch=8,
+    vsync_pulse_width=4,
+    data_pins={
+        "red": [45, 48, 47, 21, 14],
+        "green": [5, 6, 7, 15, 16, 4],
+        "blue": [8, 3, 46, 9, 1],
+    },
+)

From 7321e6e52fc9a19e4c02de406088f04e7ec077ca Mon Sep 17 00:00:00 2001
From: Thomas Rupprecht <rupprecht.thomas@gmail.com>
Date: Mon, 20 Apr 2026 15:10:05 +0200
Subject: [PATCH 02/19] [rtttl] allow any control parameters order and default
 value fallback (#14438)

Co-authored-by: J. Nick Koston <nick@koston.org>
Co-authored-by: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
---
 esphome/components/rtttl/rtttl.cpp | 98 +++++++++++++++---------------
 tests/components/rtttl/common.yaml | 16 +++++
 2 files changed, 66 insertions(+), 48 deletions(-)

diff --git a/esphome/components/rtttl/rtttl.cpp b/esphome/components/rtttl/rtttl.cpp
index 01f5aad810..08d902b4be 100644
--- a/esphome/components/rtttl/rtttl.cpp
+++ b/esphome/components/rtttl/rtttl.cpp
@@ -294,57 +294,59 @@ void Rtttl::play(std::string rtttl) {
   }
   ESP_LOGD(TAG, "Playing song %.*s", (int) this->position_, this->rtttl_.c_str());
 
-  // Get default duration
-  this->position_ = this->rtttl_.find("d=", this->position_);
-  if (this->position_ == std::string::npos) {
-    ESP_LOGE(TAG, "Missing 'd='");
-    return;
-  }
-  this->position_ += 2;
-  num = this->get_integer_();
-  if (num == 1 || num == 2 || num == 4 || num == 8 || num == 16 || num == 32) {
-    this->default_note_denominator_ = num;
-  } else {
-    ESP_LOGE(TAG, "Invalid default duration: %d", num);
-    return;
-  }
-
-  // Get default octave
-  this->position_ = this->rtttl_.find("o=", this->position_);
-  if (this->position_ == std::string::npos) {
-    ESP_LOGE(TAG, "Missing 'o=");
-    return;
-  }
-  this->position_ += 2;
-  num = this->get_integer_();
-  if (num >= MIN_OCTAVE && num <= MAX_OCTAVE) {
-    this->default_octave_ = num;
-  } else {
-    ESP_LOGE(TAG, "Invalid default octave: %d", num);
-    return;
-  }
-
-  // Get BPM
-  this->position_ = this->rtttl_.find("b=", this->position_);
-  if (this->position_ == std::string::npos) {
-    ESP_LOGE(TAG, "Missing b=");
-    return;
-  }
-  this->position_ += 2;
-  num = this->get_integer_();
-  if (num >= 4) {  // Below 4 is not realistic and would cause a integer overflow
-    bpm = num;
-  } else {
-    ESP_LOGE(TAG, "Invalid BPM: %d", num);
-    return;
-  }
-
-  this->position_ = this->rtttl_.find(':', this->position_);
-  if (this->position_ == std::string::npos) {
+  size_t name_end_position = this->position_;
+  size_t control_end = this->rtttl_.find(':', name_end_position + 1);
+  if (control_end == std::string::npos) {
     ESP_LOGE(TAG, "Missing second ':'");
     return;
   }
-  this->position_++;
+
+  // Get default duration
+  size_t pos = this->rtttl_.find("d=", name_end_position);
+  if (pos == std::string::npos || pos >= control_end) {
+    ESP_LOGW(TAG, "Missing 'd='; use default duration %d", this->default_note_denominator_);
+  } else {
+    this->position_ = pos + 2;
+    num = this->get_integer_();
+    if (num == 1 || num == 2 || num == 4 || num == 8 || num == 16 || num == 32) {
+      this->default_note_denominator_ = num;
+    } else {
+      ESP_LOGE(TAG, "Invalid default duration: %d", num);
+      return;
+    }
+  }
+
+  // Get default octave
+  pos = this->rtttl_.find("o=", name_end_position);
+  if (pos == std::string::npos || pos >= control_end) {
+    ESP_LOGW(TAG, "Missing 'o='; use default octave %d", this->default_octave_);
+  } else {
+    this->position_ = pos + 2;
+    num = this->get_integer_();
+    if (num >= MIN_OCTAVE && num <= MAX_OCTAVE) {
+      this->default_octave_ = num;
+    } else {
+      ESP_LOGE(TAG, "Invalid default octave: %d", num);
+      return;
+    }
+  }
+
+  // Get BPM
+  pos = this->rtttl_.find("b=", name_end_position);
+  if (pos == std::string::npos || pos >= control_end) {
+    ESP_LOGW(TAG, "Missing 'b='; use default BPM %d", bpm);
+  } else {
+    this->position_ = pos + 2;
+    num = this->get_integer_();
+    if (num >= 4) {  // Below 4 is not realistic and would cause a integer overflow
+      bpm = num;
+    } else {
+      ESP_LOGE(TAG, "Invalid BPM: %d", num);
+      return;
+    }
+  }
+
+  this->position_ = control_end + 1;
 
   // BPM usually expresses the number of quarter notes per minute
   this->wholenote_duration_ = 60 * 1000L * 4 / bpm;  // This is the time for whole note (in milliseconds)
diff --git a/tests/components/rtttl/common.yaml b/tests/components/rtttl/common.yaml
index 86b52ca3de..529713583b 100644
--- a/tests/components/rtttl/common.yaml
+++ b/tests/components/rtttl/common.yaml
@@ -3,6 +3,22 @@ esphome:
     then:
       - rtttl.play: 'siren:d=8,o=5,b=100:d,e,d,e,d,e,d,e'
       - rtttl.stop
+      # Test all note features: all notes, denominators (1,2,4,8,16,32), sharp (#), octaves (4-7), dotted (.), note gap (c5,c5), pause (p)
+      - rtttl.play: 'special:d=4,o=5,b=120:1c4,2d#5,4e6.,8f#7,16g4,32a5,8a#5,4b6,8h5,c5,c5,8p,2c4'
+      # Different orders of control parameters
+      - rtttl.play: 'test_odb:o=5,d=8,b=100:c'
+      - rtttl.play: 'test_bod:b=100,o=5,d=8:c'
+      - rtttl.play: 'test_bdo:b=100,d=8,o=5:c'
+      - rtttl.play: 'test_obd:o=5,b=100,d=8:c'
+      - rtttl.play: 'test_dbo:d=8,b=100,o=5:c'
+      # Missing parameters (use defaults)
+      - rtttl.play: 'test_no_d:o=5,b=100:c'
+      - rtttl.play: 'test_no_o:d=8,b=100:c'
+      - rtttl.play: 'test_no_b:d=8,o=5:c'
+      - rtttl.play: 'test_only_d:d=8:c'
+      - rtttl.play: 'test_only_o:o=5:c'
+      - rtttl.play: 'test_only_b:b=100:c'
+      - rtttl.play: 'test_empty::c'
 
 output:
   - platform: ${output_platform}

From 0dae41aa2209031a78c77387d85e27842ff3b9b9 Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Mon, 20 Apr 2026 23:13:42 +1000
Subject: [PATCH 03/19] [lvgl] Fix format of hello world page (#15868)

---
 esphome/components/lvgl/hello_world.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/esphome/components/lvgl/hello_world.yaml b/esphome/components/lvgl/hello_world.yaml
index bbbd34e30a..7bf068cc5d 100644
--- a/esphome/components/lvgl/hello_world.yaml
+++ b/esphome/components/lvgl/hello_world.yaml
@@ -89,10 +89,12 @@
                       id: hello_world_label_
                       text: "Hello World!"
                       align: center
-            - obj:
+            - container:
                 id: hello_world_qrcode_
                 outline_width: 0
                 border_width: 0
+                height: 100
+                width: 100
                 hidden: !lambda |-
                     return lv_obj_get_width(lv_screen_active()) < 300 && lv_obj_get_height(lv_screen_active()) < 400;
                 widgets:

From 9459f0426dcec99e412287faab1b612c433e01c4 Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Mon, 20 Apr 2026 23:14:15 +1000
Subject: [PATCH 04/19] [lvgl] Fix overloads for setting images on styles
 (#15864)

---
 esphome/components/lvgl/lvgl_esphome.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/esphome/components/lvgl/lvgl_esphome.h b/esphome/components/lvgl/lvgl_esphome.h
index 3ec1d247d8..146866f5bd 100644
--- a/esphome/components/lvgl/lvgl_esphome.h
+++ b/esphome/components/lvgl/lvgl_esphome.h
@@ -88,6 +88,12 @@ inline void lv_obj_set_style_bitmap_mask_src(lv_obj_t *obj, image::Image *image,
 inline void lv_obj_set_style_bg_image_src(lv_obj_t *obj, image::Image *image, lv_style_selector_t selector) {
   ::lv_obj_set_style_bg_image_src(obj, image->get_lv_image_dsc(), selector);
 }
+inline void lv_style_set_bg_image_src(lv_style_t *style, image::Image *image) {
+  ::lv_style_set_bg_image_src(style, image->get_lv_image_dsc());
+}
+inline void lv_style_set_bitmap_mask_src(lv_style_t *style, image::Image *image) {
+  ::lv_style_set_bitmap_mask_src(style, image->get_lv_image_dsc());
+}
 #endif  // USE_LVGL_IMAGE
 #ifdef USE_LVGL_ANIMIMG
 inline void lv_animimg_set_src(lv_obj_t *img, std::vector<image::Image *> images) {

From 73b8e8ac098955c8cdd3bb1f72e4ce7bf7372f4a Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Mon, 20 Apr 2026 23:15:51 +1000
Subject: [PATCH 05/19] [lvgl] Fix update of textarea attached to keyboard
 (#15866)

---
 esphome/components/lvgl/widgets/keyboard.py | 26 ++++++++++++---------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/esphome/components/lvgl/widgets/keyboard.py b/esphome/components/lvgl/widgets/keyboard.py
index 029ca5f684..c5628cee3c 100644
--- a/esphome/components/lvgl/widgets/keyboard.py
+++ b/esphome/components/lvgl/widgets/keyboard.py
@@ -52,19 +52,23 @@ class KeyboardType(WidgetType):
         if mode := config.get(CONF_MODE):
             await w.set_property(CONF_MODE, await KEYBOARD_MODES.process(mode))
         if textarea := config.get(CONF_TEXTAREA):
-            # If a textarea is configured, it must be generated before the keyboard can attach it.
-            # If not yet configured, defer the attachment code.
+            if not is_widget_completed(textarea):
+                # Can only happen for an initial config, where the keyboard is configured before the
+                # textarea, so it's ok to always emit into the global context
+                async def add_textarea():
+                    async with LvContext():
+                        await w.set_property(
+                            CONF_TEXTAREA,
+                            (await get_widgets(config, CONF_TEXTAREA))[0].obj,
+                        )
 
-            async def add_textarea():
-                async with LvContext():
-                    await w.set_property(
-                        CONF_TEXTAREA, (await get_widgets(config, CONF_TEXTAREA))[0].obj
-                    )
-
-            if is_widget_completed(textarea):
-                await add_textarea()
-            else:
                 CORE.add_job(add_textarea)
+            else:
+                # Handles updates in automations, and properly ordered initial config. Code is generated
+                # into the enclosing context (main or lambda)
+                await w.set_property(
+                    CONF_TEXTAREA, (await get_widgets(config, CONF_TEXTAREA))[0].obj
+                )
 
 
 keyboard_spec = KeyboardType()

From b72f5447c3fc4a0130ef56a74677b8fea0a25ab8 Mon Sep 17 00:00:00 2001
From: Rui Marinho <ruipmarinho@gmail.com>
Date: Mon, 20 Apr 2026 14:24:07 +0100
Subject: [PATCH 06/19] [modbus] Simplify payload size validation in
 modbus_helpers (#15838)

---
 esphome/components/modbus/modbus_helpers.cpp  | 114 +++++++++---------
 .../components/modbus/modbus_helpers_test.cpp |  22 ++++
 2 files changed, 79 insertions(+), 57 deletions(-)
 create mode 100644 tests/components/modbus/modbus_helpers_test.cpp

diff --git a/esphome/components/modbus/modbus_helpers.cpp b/esphome/components/modbus/modbus_helpers.cpp
index 77190b2846..89dc3c08bc 100644
--- a/esphome/components/modbus/modbus_helpers.cpp
+++ b/esphome/components/modbus/modbus_helpers.cpp
@@ -5,6 +5,29 @@ namespace esphome::modbus::helpers {
 
 static const char *const TAG = "modbus_helpers";
 
+static size_t required_payload_size(SensorValueType sensor_value_type) {
+  switch (sensor_value_type) {
+    case SensorValueType::U_WORD:
+    case SensorValueType::S_WORD:
+      return 2;
+    case SensorValueType::U_DWORD:
+    case SensorValueType::FP32:
+    case SensorValueType::U_DWORD_R:
+    case SensorValueType::FP32_R:
+    case SensorValueType::S_DWORD:
+    case SensorValueType::S_DWORD_R:
+      return 4;
+    case SensorValueType::U_QWORD:
+    case SensorValueType::S_QWORD:
+    case SensorValueType::U_QWORD_R:
+    case SensorValueType::S_QWORD_R:
+      return 8;
+    case SensorValueType::RAW:
+    default:
+      return 0;
+  }
+}
+
 void number_to_payload(std::vector<uint16_t> &data, int64_t value, SensorValueType value_type) {
   switch (value_type) {
     case SensorValueType::U_WORD:
@@ -47,93 +70,70 @@ int64_t payload_to_number(const std::vector<uint8_t> &data, SensorValueType sens
                           uint32_t bitmask) {
   int64_t value = 0;  // int64_t because it can hold signed and unsigned 32 bits
 
-  if (offset > data.size()) {
-    ESP_LOGE(TAG, "not enough data for value");
+  // Validate offset against the buffer for all types, including RAW/unsupported, so
+  // a malformed or misconfigured frame still produces an error log.
+  if (static_cast<size_t>(offset) > data.size()) {
+    ESP_LOGE(TAG, "not enough data for value type=%u offset=%u size=%zu", static_cast<unsigned int>(sensor_value_type),
+             static_cast<unsigned int>(offset), data.size());
+    return value;
+  }
+
+  const size_t required_size = required_payload_size(sensor_value_type);
+  if (required_size == 0) {
+    return value;
+  }
+
+  if (data.size() - offset < required_size) {
+    ESP_LOGE(TAG, "not enough data for value type=%u offset=%u size=%zu required=%zu",
+             static_cast<unsigned int>(sensor_value_type), static_cast<unsigned int>(offset), data.size(),
+             required_size);
     return value;
   }
 
-  size_t size = data.size() - offset;
-  bool error = false;
   switch (sensor_value_type) {
     case SensorValueType::U_WORD:
-      if (size >= 2) {
-        value = mask_and_shift_by_rightbit(get_data<uint16_t>(data, offset),
-                                           bitmask);  // default is 0xFFFF ;
-      } else {
-        error = true;
-      }
+      value = mask_and_shift_by_rightbit(get_data<uint16_t>(data, offset), bitmask);  // default is 0xFFFF ;
       break;
     case SensorValueType::U_DWORD:
     case SensorValueType::FP32:
-      if (size >= 4) {
-        value = get_data<uint32_t>(data, offset);
-        value = mask_and_shift_by_rightbit((uint32_t) value, bitmask);
-      } else {
-        error = true;
-      }
+      value = get_data<uint32_t>(data, offset);
+      value = mask_and_shift_by_rightbit((uint32_t) value, bitmask);
       break;
     case SensorValueType::U_DWORD_R:
     case SensorValueType::FP32_R:
-      if (size >= 4) {
-        value = get_data<uint32_t>(data, offset);
-        value = static_cast<uint32_t>(value & 0xFFFF) << 16 | (value & 0xFFFF0000) >> 16;
-        value = mask_and_shift_by_rightbit((uint32_t) value, bitmask);
-      } else {
-        error = true;
-      }
+      value = get_data<uint32_t>(data, offset);
+      value = static_cast<uint32_t>(value & 0xFFFF) << 16 | (value & 0xFFFF0000) >> 16;
+      value = mask_and_shift_by_rightbit((uint32_t) value, bitmask);
       break;
     case SensorValueType::S_WORD:
-      if (size >= 2) {
-        value = mask_and_shift_by_rightbit(get_data<int16_t>(data, offset),
-                                           bitmask);  // default is 0xFFFF ;
-      } else {
-        error = true;
-      }
+      value = mask_and_shift_by_rightbit(get_data<int16_t>(data, offset), bitmask);  // default is 0xFFFF ;
       break;
     case SensorValueType::S_DWORD:
-      if (size >= 4) {
-        value = mask_and_shift_by_rightbit(get_data<int32_t>(data, offset), bitmask);
-      } else {
-        error = true;
-      }
+      value = mask_and_shift_by_rightbit(get_data<int32_t>(data, offset), bitmask);
       break;
     case SensorValueType::S_DWORD_R: {
-      if (size >= 4) {
-        value = get_data<uint32_t>(data, offset);
-        // Currently the high word is at the low position
-        // the sign bit is therefore at low before the switch
-        uint32_t sign_bit = (value & 0x8000) << 16;
-        value = mask_and_shift_by_rightbit(
-            static_cast<int32_t>(((value & 0x7FFF) << 16 | (value & 0xFFFF0000) >> 16) | sign_bit), bitmask);
-      } else {
-        error = true;
-      }
+      value = get_data<uint32_t>(data, offset);
+      // Currently the high word is at the low position
+      // the sign bit is therefore at low before the switch
+      uint32_t sign_bit = (value & 0x8000) << 16;
+      value = mask_and_shift_by_rightbit(
+          static_cast<int32_t>(((value & 0x7FFF) << 16 | (value & 0xFFFF0000) >> 16) | sign_bit), bitmask);
     } break;
     case SensorValueType::U_QWORD:
     case SensorValueType::S_QWORD:
       // Ignore bitmask for QWORD
-      if (size >= 8) {
-        value = get_data<uint64_t>(data, offset);
-      } else {
-        error = true;
-      }
+      value = get_data<uint64_t>(data, offset);
       break;
     case SensorValueType::U_QWORD_R:
     case SensorValueType::S_QWORD_R: {
       // Ignore bitmask for QWORD
-      if (size >= 8) {
-        uint64_t tmp = get_data<uint64_t>(data, offset);
-        value = (tmp << 48) | (tmp >> 48) | ((tmp & 0xFFFF0000) << 16) | ((tmp >> 16) & 0xFFFF0000);
-      } else {
-        error = true;
-      }
+      uint64_t tmp = get_data<uint64_t>(data, offset);
+      value = (tmp << 48) | (tmp >> 48) | ((tmp & 0xFFFF0000) << 16) | ((tmp >> 16) & 0xFFFF0000);
     } break;
     case SensorValueType::RAW:
     default:
       break;
   }
-  if (error)
-    ESP_LOGE(TAG, "not enough data for value");
   return value;
 }
 }  // namespace esphome::modbus::helpers
diff --git a/tests/components/modbus/modbus_helpers_test.cpp b/tests/components/modbus/modbus_helpers_test.cpp
new file mode 100644
index 0000000000..e1b4fb2aa6
--- /dev/null
+++ b/tests/components/modbus/modbus_helpers_test.cpp
@@ -0,0 +1,22 @@
+#include <gtest/gtest.h>
+
+#include "esphome/components/modbus/modbus_helpers.h"
+
+namespace esphome::modbus::helpers {
+
+TEST(ModbusHelpersTest, PayloadToNumberRejectsOffsetAtEndOfBuffer) {
+  const std::vector<uint8_t> data{0x12, 0x34};
+  EXPECT_EQ(payload_to_number(data, SensorValueType::U_WORD, 2, 0xFFFFFFFF), 0);
+}
+
+TEST(ModbusHelpersTest, PayloadToNumberRejectsTruncatedMultiRegisterValue) {
+  const std::vector<uint8_t> data{0x12, 0x34, 0x56};
+  EXPECT_EQ(payload_to_number(data, SensorValueType::U_DWORD, 0, 0xFFFFFFFF), 0);
+}
+
+TEST(ModbusHelpersTest, PayloadToNumberDecodesValidWord) {
+  const std::vector<uint8_t> data{0x12, 0x34};
+  EXPECT_EQ(payload_to_number(data, SensorValueType::U_WORD, 0, 0xFFFFFFFF), 0x1234);
+}
+
+}  // namespace esphome::modbus::helpers

From 82656cb0cf1c051d428438e5f562f8de3541d1ca Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Mon, 20 Apr 2026 23:28:52 +1000
Subject: [PATCH 07/19] [mipi_dsi] Add Seeed reTerminal d1001 display (#15867)

---
 esphome/components/mipi_dsi/models/seeed.py   | 29 +++++++++++++++++++
 .../mipi_dsi/test_mipi_dsi_config.py          |  5 ++++
 2 files changed, 34 insertions(+)
 create mode 100644 esphome/components/mipi_dsi/models/seeed.py

diff --git a/esphome/components/mipi_dsi/models/seeed.py b/esphome/components/mipi_dsi/models/seeed.py
new file mode 100644
index 0000000000..290b0e07ee
--- /dev/null
+++ b/esphome/components/mipi_dsi/models/seeed.py
@@ -0,0 +1,29 @@
+from esphome.components.mipi import DriverChip
+import esphome.config_validation as cv
+
+# Standalone display
+# Product page: https://www.seeedstudio.com/reTerminal-D1001-p-6729.html
+DriverChip(
+    "SEEED-RETERMINAL-D1001",
+    height=1280,
+    width=800,
+    hsync_back_porch=20,
+    hsync_pulse_width=20,
+    hsync_front_porch=40,
+    vsync_back_porch=12,
+    vsync_pulse_width=4,
+    vsync_front_porch=30,
+    pclk_frequency="80MHz",
+    lane_bit_rate="1.5Gbps",
+    swap_xy=cv.UNDEFINED,
+    color_order="RGB",
+    enable_pin=[{"xl9535": None, "number": 0}, {"xl9535": None, "number": 7}],
+    reset_pin={"xl9535": None, "number": 2},
+    initsequence=(
+        (0xE0, 0x00),
+        (0xE1, 0x93),
+        (0xE2, 0x65),
+        (0xE3, 0xF8),
+        (0x80, 0x01),
+    ),
+)
diff --git a/tests/component_tests/mipi_dsi/test_mipi_dsi_config.py b/tests/component_tests/mipi_dsi/test_mipi_dsi_config.py
index 119bbf7fea..955e945526 100644
--- a/tests/component_tests/mipi_dsi/test_mipi_dsi_config.py
+++ b/tests/component_tests/mipi_dsi/test_mipi_dsi_config.py
@@ -7,6 +7,11 @@ import pytest
 
 from esphome import config_validation as cv
 from esphome.components.esp32 import KEY_BOARD, VARIANT_ESP32P4
+
+# Importing xl9535 registers its pin schema with pins.PIN_SCHEMA_REGISTRY so that
+# models (e.g. SEEED-RETERMINAL-D1001) that reference xl9535-backed pins in their
+# defaults can be validated by the mipi_dsi CONFIG_SCHEMA in this test.
+import esphome.components.xl9535  # noqa: F401
 from esphome.const import (
     CONF_DIMENSIONS,
     CONF_HEIGHT,

From 6af341bb5be6a3850bf16a9c01f49e24b60f5413 Mon Sep 17 00:00:00 2001
From: Elvin Luff <elvin@eelviny.me>
Date: Mon, 20 Apr 2026 14:34:31 +0100
Subject: [PATCH 08/19] [epaper_spi] Support SSD1683 and GDEY042T81 4.2 inch
 display (#13910)

---
 .../epaper_spi/epaper_spi_ssd1683.cpp         | 97 +++++++++++++++++++
 .../epaper_spi/epaper_spi_ssd1683.h           | 22 +++++
 .../components/epaper_spi/models/ssd1683.py   | 27 ++++++
 .../epaper_spi/test.esp32-s3-idf.yaml         | 16 +++
 4 files changed, 162 insertions(+)
 create mode 100644 esphome/components/epaper_spi/epaper_spi_ssd1683.cpp
 create mode 100644 esphome/components/epaper_spi/epaper_spi_ssd1683.h
 create mode 100644 esphome/components/epaper_spi/models/ssd1683.py

diff --git a/esphome/components/epaper_spi/epaper_spi_ssd1683.cpp b/esphome/components/epaper_spi/epaper_spi_ssd1683.cpp
new file mode 100644
index 0000000000..6fb7e1ac1a
--- /dev/null
+++ b/esphome/components/epaper_spi/epaper_spi_ssd1683.cpp
@@ -0,0 +1,97 @@
+#include "epaper_spi_ssd1683.h"
+
+#include <algorithm>
+
+#include "esphome/core/log.h"
+
+namespace esphome::epaper_spi {
+static constexpr const char *const TAG = "epaper_spi.mono";
+
+void EPaperSSD1683::refresh_screen(bool partial) {
+  ESP_LOGV(TAG, "Refresh screen");
+  this->cmd_data(0x3C, {partial ? (uint8_t) 0x80 : (uint8_t) 0x01});
+  // On partial update, set red RAM to inverse to remove BW ghosting
+  this->cmd_data(0x21, {partial ? (uint8_t) 0x80 : (uint8_t) 0x40, (uint8_t) 0x00});
+  // Set full update to 0xD7 for fast update, 0xF7 for normal
+  // Fast update flashes less and draws sooner but is in busy state for the same amount of time
+  // Manufacturer recommends not using fast update all the time, TODO expose this to the user
+  this->cmd_data(0x22, {partial ? (uint8_t) 0xFC : (uint8_t) 0xF7});
+  this->command(0x20);
+}
+
+// Puts the display into deep sleep mode 1, only way to get out is to reset the display
+// Mode 1 retains RAM while sleeping, necessary for future partial and window updates
+void EPaperSSD1683::deep_sleep() {
+  if (this->is_using_partial_update_()) {
+    ESP_LOGV(TAG, "Deep sleep mode 1");
+    this->cmd_data(0x10, {0x01});  // deep sleep, retain RAM
+  } else {
+    ESP_LOGV(TAG, "Deep sleep mode 2");
+    this->cmd_data(0x10, {0x03});  // deep sleep, lose RAM
+  }
+}
+
+void EPaperSSD1683::set_window() {
+  // if not using partial update, the display will go into deep sleep mode 2, so must rewrite entire
+  // buffer since the display RAM will not retain contents
+  if (!this->is_using_partial_update_()) {
+    this->x_low_ = 0;
+    this->x_high_ = this->width_;
+    this->y_low_ = 0;
+    this->y_high_ = this->height_;
+  }
+
+  // round x-coordinates to byte boundaries
+  this->x_low_ /= 8;
+  this->x_high_ += 7;
+  this->x_high_ /= 8;
+
+  this->cmd_data(0x44, {(uint8_t) this->x_low_, (uint8_t) (this->x_high_ - 1)});
+  this->cmd_data(0x45, {(uint8_t) this->y_low_, (uint8_t) (this->y_low_ / 256), (uint8_t) (this->y_high_ - 1),
+                        (uint8_t) ((this->y_high_ - 1) / 256)});
+  this->cmd_data(0x4E, {(uint8_t) this->x_low_});
+  this->cmd_data(0x4F, {(uint8_t) this->y_low_, (uint8_t) (this->y_low_ / 256)});
+}
+
+bool HOT EPaperSSD1683::transfer_data() {
+  auto start_time = millis();
+  if (this->current_data_index_ == 0) {
+    if (this->send_red_) {
+      // round to byte boundaries
+      this->set_window();
+    }
+    // for monochrome, we need to send red on every refresh to prevent dirty pixels
+    // when doing a partial refresh
+    this->command(this->send_red_ ? 0x26 : 0x24);
+    this->current_data_index_ = this->y_low_;  // actually current line
+  }
+  size_t row_length = this->x_high_ - this->x_low_;
+  FixedVector<uint8_t> bytes_to_send{};
+  bytes_to_send.init(row_length);
+  ESP_LOGV(TAG, "Writing %u bytes at line %zu at %ums", row_length, this->current_data_index_, (unsigned) millis());
+  this->start_data_();
+  while (this->current_data_index_ != this->y_high_) {
+    size_t data_idx = this->current_data_index_ * this->row_width_ + this->x_low_;
+    for (size_t i = 0; i != row_length; i++) {
+      bytes_to_send[i] = this->buffer_[data_idx++];
+    }
+    ++this->current_data_index_;
+    this->write_array(&bytes_to_send.front(), row_length);  // NOLINT
+    if (millis() - start_time > MAX_TRANSFER_TIME) {
+      // Let the main loop run and come back next loop
+      this->disable();
+      return false;
+    }
+  }
+
+  this->disable();
+  this->current_data_index_ = 0;
+  if (this->send_red_) {
+    this->send_red_ = false;
+    return false;
+  }
+  this->send_red_ = true;
+  return true;
+}
+
+}  // namespace esphome::epaper_spi
diff --git a/esphome/components/epaper_spi/epaper_spi_ssd1683.h b/esphome/components/epaper_spi/epaper_spi_ssd1683.h
new file mode 100644
index 0000000000..4532900dd1
--- /dev/null
+++ b/esphome/components/epaper_spi/epaper_spi_ssd1683.h
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "epaper_spi_mono.h"
+
+namespace esphome::epaper_spi {
+/**
+ * A class for Solomon SSD1683 epaper displays.
+ */
+class EPaperSSD1683 : public EPaperMono {
+ public:
+  EPaperSSD1683(const char *name, uint16_t width, uint16_t height, const uint8_t *init_sequence,
+                size_t init_sequence_length)
+      : EPaperMono(name, width, height, init_sequence, init_sequence_length) {}
+
+ protected:
+  void refresh_screen(bool partial) override;
+  void deep_sleep() override;
+  void set_window() override;
+  bool transfer_data() override;
+};
+
+}  // namespace esphome::epaper_spi
diff --git a/esphome/components/epaper_spi/models/ssd1683.py b/esphome/components/epaper_spi/models/ssd1683.py
new file mode 100644
index 0000000000..983f5bb382
--- /dev/null
+++ b/esphome/components/epaper_spi/models/ssd1683.py
@@ -0,0 +1,27 @@
+from esphome.const import CONF_DATA_RATE
+
+from . import EpaperModel
+
+
+class SSD1683(EpaperModel):
+    def __init__(self, name, class_name="EPaperSSD1683", data_rate="20MHz", **defaults):
+        defaults[CONF_DATA_RATE] = data_rate
+        super().__init__(name, class_name, **defaults)
+
+    # fmt: off
+    def get_init_sequence(self, config: dict):
+        _width, height = self.get_dimensions(config)
+        return (
+            (0x01, (height - 1) % 256, (height - 1) // 256, 0x00),    # Set column gate limit
+            (0x18, 0x80),    # Select internal Temp sensor
+            (0x11, 0x03),      # Set transform
+        )
+
+
+ssd1683 = SSD1683("ssd1683")
+
+goodisplay_gdey042t81 = ssd1683.extend(
+    "goodisplay-gdey042t81-4.2",
+    width=400,
+    height=300,
+)
diff --git a/tests/components/epaper_spi/test.esp32-s3-idf.yaml b/tests/components/epaper_spi/test.esp32-s3-idf.yaml
index bf6053c78b..8a420f299a 100644
--- a/tests/components/epaper_spi/test.esp32-s3-idf.yaml
+++ b/tests/components/epaper_spi/test.esp32-s3-idf.yaml
@@ -145,3 +145,19 @@ display:
       it.filled_rectangle(0, 0, it.get_width(), it.get_height(), Color::WHITE);
       it.circle(it.get_width() / 2, it.get_height() / 2, 30, Color::BLACK);
       it.circle(it.get_width() / 2, it.get_height() / 2, 20, Color(255, 0, 0));
+
+  - platform: epaper_spi
+    spi_id: spi_bus
+    model: goodisplay-gdey042t81-4.2
+    cs_pin:
+      allow_other_uses: true
+      number: GPIO5
+    dc_pin:
+      allow_other_uses: true
+      number: GPIO17
+    reset_pin:
+      allow_other_uses: true
+      number: GPIO16
+    busy_pin:
+      allow_other_uses: true
+      number: GPIO4

From 94f30d5950e3d5aa3e49d31879ec394c30e63d45 Mon Sep 17 00:00:00 2001
From: Kevin Ahrendt <kevin.ahrendt@openhomefoundation.org>
Date: Mon, 20 Apr 2026 16:26:47 -0400
Subject: [PATCH 09/19] [micro_wake_word] Use ESPMicroSpeechFeatures from
 Espressif registry (v1.2.3) (#15879)

---
 .clang-tidy.hash                               | 2 +-
 esphome/components/micro_wake_word/__init__.py | 4 ++--
 esphome/idf_component.yml                      | 2 ++
 platformio.ini                                 | 2 --
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.clang-tidy.hash b/.clang-tidy.hash
index 72a9967590..02aa990809 100644
--- a/.clang-tidy.hash
+++ b/.clang-tidy.hash
@@ -1 +1 @@
-075ed2142432dc59883bb52db8ac11270f952851d6400deae080f5468c7cb592
+c65f1a0804a7765462d570c50891ac719260592df2c9cdfe88233fc346ac59e9
diff --git a/esphome/components/micro_wake_word/__init__.py b/esphome/components/micro_wake_word/__init__.py
index 5ab1e4bb80..22d2098de0 100644
--- a/esphome/components/micro_wake_word/__init__.py
+++ b/esphome/components/micro_wake_word/__init__.py
@@ -454,12 +454,12 @@ async def to_code(config):
     # Pin esp-nn for stable future builds (esp-tflite-micro depends on esp-nn)
     esp32.add_idf_component(name="espressif/esp-nn", ref="1.1.2")
 
+    esp32.add_idf_component(name="esphome/esp-micro-speech-features", ref="1.2.3")
+
     cg.add_build_flag("-DTF_LITE_STATIC_MEMORY")
     cg.add_build_flag("-DTF_LITE_DISABLE_X86_NEON")
     cg.add_build_flag("-DESP_NN")
 
-    cg.add_library("kahrendt/ESPMicroSpeechFeatures", "1.1.0")
-
     if vad_model := config.get(CONF_VAD):
         cg.add_define("USE_MICRO_WAKE_WORD_VAD")
 
diff --git a/esphome/idf_component.yml b/esphome/idf_component.yml
index f4e3e751ec..3637481c92 100644
--- a/esphome/idf_component.yml
+++ b/esphome/idf_component.yml
@@ -3,6 +3,8 @@ dependencies:
     version: "7.4.2"
   esphome/esp-audio-libs:
     version: 2.0.4
+  esphome/esp-micro-speech-features:
+    version: 1.2.3
   esphome/micro-decoder:
     version: 0.1.1
   esphome/micro-flac:
diff --git a/platformio.ini b/platformio.ini
index e2c7e2b097..d7b14944e4 100644
--- a/platformio.ini
+++ b/platformio.ini
@@ -155,7 +155,6 @@ lib_deps =
     makuna/NeoPixelBus@2.8.0             ; neopixelbus
     esphome/ESP32-audioI2S@2.3.0         ; i2s_audio
     droscy/esp_wireguard@0.4.5           ; wireguard
-    kahrendt/ESPMicroSpeechFeatures@1.1.0  ; micro_wake_word
 
 build_flags =
     ${common:arduino.build_flags}
@@ -177,7 +176,6 @@ framework = espidf
 lib_deps =
     ${common:idf.lib_deps}
     droscy/esp_wireguard@0.4.5              ; wireguard
-    kahrendt/ESPMicroSpeechFeatures@1.1.0   ; micro_wake_word
     tonia/HeatpumpIR@1.0.41                 ; heatpumpir
 build_flags =
     ${common:idf.build_flags}

From 213ab312d2d4f703056393eadc689fcfe0e42165 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Mon, 20 Apr 2026 16:27:34 -0400
Subject: [PATCH 10/19] [image] Fix rodata bloat for multi-frame RGB565+alpha
 animations (#15873)

---
 esphome/components/image/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/esphome/components/image/__init__.py b/esphome/components/image/__init__.py
index 7db50597e6..8375ab91d3 100644
--- a/esphome/components/image/__init__.py
+++ b/esphome/components/image/__init__.py
@@ -756,7 +756,7 @@ async def write_image(config, all_frames=False):
             for col in range(width):
                 encoder.encode(pixels[row * width + col])
             encoder.end_row()
-        encoder.end_image()
+    encoder.end_image()
 
     rhs = [HexInt(x) for x in encoder.data]
     prog_arr = cg.progmem_array(config[CONF_RAW_DATA_ID], rhs)

From a43ee15b567896cc932bb45da2d2de3fcdbd48ec Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Mon, 20 Apr 2026 22:33:48 -0400
Subject: [PATCH 11/19] [core] Fix Pvariable placement new losing subclass
 identity (#15881)

---
 esphome/cpp_generator.py                      | 50 ++++++++++++-------
 tests/component_tests/ili9xxx/__init__.py     |  0
 .../ili9xxx/config/ili9xxx_test.yaml          | 20 ++++++++
 tests/component_tests/ili9xxx/test_ili9xxx.py | 31 ++++++++++++
 4 files changed, 84 insertions(+), 17 deletions(-)
 create mode 100644 tests/component_tests/ili9xxx/__init__.py
 create mode 100644 tests/component_tests/ili9xxx/config/ili9xxx_test.yaml
 create mode 100644 tests/component_tests/ili9xxx/test_ili9xxx.py

diff --git a/esphome/cpp_generator.py b/esphome/cpp_generator.py
index cf90b878e1..c622207dac 100644
--- a/esphome/cpp_generator.py
+++ b/esphome/cpp_generator.py
@@ -606,33 +606,43 @@ def Pvariable(id_: ID, rhs: SafeExpType, type_: "MockObj" = None) -> "MockObj":
     if isinstance(rhs, MockObj) and rhs.is_new_expr:
         # For 'new' allocations, use placement new into static storage
         # to avoid heap fragmentation on embedded devices.
-        the_type = id_.type
+        #
+        # Storage must be sized and aligned for the actual instantiated class,
+        # which may be a subclass of id_.type (e.g. `cv.declare_id(BaseClass)`
+        # combined with `SubClass.new()` — used by ili9xxx, waveshare_epaper,
+        # etc. to select a model-specific constructor). Using id_.type would
+        # run the base-class default constructor instead, silently losing any
+        # subclass initialization. Template args live on the CallExpression
+        # and are re-emitted below.
+        call_expr = rhs.base
+        assert isinstance(call_expr, CallExpression), (
+            f"Expected CallExpression for placement new, got {type(call_expr)}"
+        )
+        actual_type = rhs.new_type if rhs.new_type is not None else id_.type
+        if call_expr.template_args is not None:
+            actual_type = f"{actual_type}{call_expr.template_args}"
+        pointer_type = id_.type
         # Extract component namespace from type for memory analysis attribution
-        component_ns = _extract_component_ns(str(the_type))
+        component_ns = _extract_component_ns(str(actual_type))
         storage_name = f"{component_ns}__{id_.id}__pstorage"
 
         # Declare aligned byte array for the object storage
         CORE.add_global(
             RawStatement(
-                f"alignas({the_type}) static unsigned char {storage_name}[sizeof({the_type})];"
+                f"alignas({actual_type}) static unsigned char {storage_name}[sizeof({actual_type})];"
             )
         )
+        # Pointer declaration uses id_.type to preserve the declared base-class
+        # pointer type for downstream callers (polymorphism through base ptr).
         CORE.add_global(
             AssignmentExpression(
-                f"static {the_type}",
+                f"static {pointer_type}",
                 "*const ",
                 id_,
-                MockObj(f"reinterpret_cast<{the_type} *>({storage_name})"),
+                MockObj(f"reinterpret_cast<{pointer_type} *>({storage_name})"),
             )
         )
-        # Extract args from the CallExpression and rebuild as placement new.
-        # Template args are already encoded in the_type (e.g. GlobalsComponent<int>),
-        # so we only pass the constructor args, not template_args.
-        call_expr = rhs.base
-        assert isinstance(call_expr, CallExpression), (
-            f"Expected CallExpression for placement new, got {type(call_expr)}"
-        )
-        placement_new = CallExpression(f"new({id_.id}) {the_type}", *call_expr.args)
+        placement_new = CallExpression(f"new({id_.id}) {actual_type}", *call_expr.args)
         CORE.add(ExpressionStatement(placement_new))
     else:
         decl = VariableDeclarationExpression(id_.type, "*", id_, static=True)
@@ -869,12 +879,16 @@ class MockObj(Expression):
     Mostly consists of magic methods that allow ESPHome's codegen syntax.
     """
 
-    __slots__ = ("base", "op", "is_new_expr")
+    __slots__ = ("base", "op", "is_new_expr", "new_type")
 
-    def __init__(self, base, op=".", is_new_expr=False) -> None:
+    def __init__(self, base, op=".", is_new_expr=False, new_type=None) -> None:
         self.base = base
         self.op = op
         self.is_new_expr = is_new_expr
+        # For `is_new_expr=True` objects, `new_type` holds the class name being
+        # constructed (e.g. "ili9xxx::ILI9XXXST7789V"). Needed by Pvariable so
+        # placement new uses the actual subclass rather than id_.type.
+        self.new_type = new_type
 
     def __getattr__(self, attr: str) -> "MockObj":
         # prevent python dunder methods being replaced by mock objects
@@ -889,7 +903,9 @@ class MockObj(Expression):
 
     def __call__(self, *args: SafeExpType) -> "MockObj":
         call = CallExpression(self.base, *args)
-        return MockObj(call, self.op, is_new_expr=self.is_new_expr)
+        return MockObj(
+            call, self.op, is_new_expr=self.is_new_expr, new_type=self.new_type
+        )
 
     def __str__(self):
         return str(self.base)
@@ -903,7 +919,7 @@ class MockObj(Expression):
 
     @property
     def new(self) -> "MockObj":
-        return MockObj(f"new {self.base}", "->", is_new_expr=True)
+        return MockObj(f"new {self.base}", "->", is_new_expr=True, new_type=self.base)
 
     def template(self, *args: SafeExpType) -> "MockObj":
         """Apply template parameters to this object."""
diff --git a/tests/component_tests/ili9xxx/__init__.py b/tests/component_tests/ili9xxx/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/component_tests/ili9xxx/config/ili9xxx_test.yaml b/tests/component_tests/ili9xxx/config/ili9xxx_test.yaml
new file mode 100644
index 0000000000..bc6148b8d8
--- /dev/null
+++ b/tests/component_tests/ili9xxx/config/ili9xxx_test.yaml
@@ -0,0 +1,20 @@
+esphome:
+  name: test
+
+esp32:
+  board: esp32dev
+  framework:
+    type: arduino
+
+spi:
+  clk_pin: GPIO18
+  mosi_pin: GPIO23
+
+display:
+  - platform: ili9xxx
+    id: tft_display
+    model: ST7789V
+    cs_pin: GPIO5
+    dc_pin: GPIO17
+    reset_pin: GPIO16
+    invert_colors: false
diff --git a/tests/component_tests/ili9xxx/test_ili9xxx.py b/tests/component_tests/ili9xxx/test_ili9xxx.py
new file mode 100644
index 0000000000..3919eb3823
--- /dev/null
+++ b/tests/component_tests/ili9xxx/test_ili9xxx.py
@@ -0,0 +1,31 @@
+"""Tests for the ili9xxx component."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from pathlib import Path
+
+
+def test_ili9xxx_placement_new_uses_model_subclass(
+    generate_main: Callable[[str | Path], str],
+    component_config_path: Callable[[str], Path],
+) -> None:
+    """Regression test for ili9xxx picking the right constructor under placement new.
+
+    ili9xxx declares the ID as the base ``ILI9XXXDisplay`` but constructs a
+    model-specific subclass (e.g. ``ILI9XXXST7789V``) via ``MODELS[...].new()``.
+    Pvariable must emit placement new for the subclass — otherwise the base
+    default constructor runs and the panel is left with a null init sequence
+    and 0x0 dimensions, producing a silent blank screen.
+    """
+    main_cpp = generate_main(component_config_path("ili9xxx_test.yaml"))
+
+    # Storage is sized for the subclass so the full object fits.
+    assert "sizeof(ili9xxx::ILI9XXXST7789V)" in main_cpp
+    assert "alignas(ili9xxx::ILI9XXXST7789V)" in main_cpp
+    # Pointer is declared as the base type for polymorphism.
+    assert "static ili9xxx::ILI9XXXDisplay *const tft_display" in main_cpp
+    # Placement new runs the subclass constructor — this is the actual regression fix.
+    assert "new(tft_display) ili9xxx::ILI9XXXST7789V()" in main_cpp
+    # Base-class default constructor must NOT be used.
+    assert "new(tft_display) ili9xxx::ILI9XXXDisplay()" not in main_cpp

From 4cb7ea2584225f5ea919d4a5f3088f075484dc9c Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Tue, 21 Apr 2026 04:37:56 +0200
Subject: [PATCH 12/19] [light] Force-inline LightCall::set_flag_/clear_flag_
 (#15729)

---
 esphome/components/light/light_call.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/esphome/components/light/light_call.h b/esphome/components/light/light_call.h
index 88d29bd349..39953d0d20 100644
--- a/esphome/components/light/light_call.h
+++ b/esphome/components/light/light_call.h
@@ -222,7 +222,7 @@ class LightCall {
   inline bool get_save_() { return (this->flags_ & FLAG_SAVE) != 0; }
 
   // Helper to set flag - defaults to true for common case
-  void set_flag_(FieldFlags flag, bool value = true) {
+  void set_flag_(FieldFlags flag, bool value = true) ESPHOME_ALWAYS_INLINE {
     if (value) {
       this->flags_ |= flag;
     } else {
@@ -231,7 +231,7 @@ class LightCall {
   }
 
   // Helper to clear flag - reduces code size for common case
-  void clear_flag_(FieldFlags flag) { this->flags_ &= ~flag; }
+  void clear_flag_(FieldFlags flag) ESPHOME_ALWAYS_INLINE { this->flags_ &= ~flag; }
 
   // Helper to log unsupported feature and clear flag - reduces code duplication
   void log_and_clear_unsupported_(FieldFlags flag, const LogString *feature, bool use_color_mode_log);

From 0a0176d600e1b33159ad737df15640ee43cac525 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Tue, 21 Apr 2026 04:38:12 +0200
Subject: [PATCH 13/19] [core] raise WDT_FEED_INTERVAL_MS from 3 ms to 300 ms
 (#15846)

---
 esphome/core/application.cpp | 54 +++++++++++++++++++++------------
 esphome/core/application.h   | 59 ++++++++++++++++++++++++++++++------
 2 files changed, 84 insertions(+), 29 deletions(-)

diff --git a/esphome/core/application.cpp b/esphome/core/application.cpp
index 866edebbf6..e5e1b36a65 100644
--- a/esphome/core/application.cpp
+++ b/esphome/core/application.cpp
@@ -211,11 +211,16 @@ void Application::process_dump_config_() {
 
 void Application::feed_wdt() {
   // Cold entry: callers without a millis() timestamp in hand. Fetches the
-  // time and takes the same rate-limit path as feed_wdt_with_time().
+  // time and takes the same rate-limit paths as feed_wdt_with_time().
   uint32_t now = millis();
   if (now - this->last_wdt_feed_ > WDT_FEED_INTERVAL_MS) {
     this->feed_wdt_slow_(now);
   }
+#ifdef USE_STATUS_LED
+  if (now - this->last_status_led_service_ > STATUS_LED_DISPATCH_INTERVAL_MS) {
+    this->service_status_led_slow_(now);
+  }
+#endif
 }
 
 void HOT Application::feed_wdt_slow_(uint32_t time) {
@@ -223,27 +228,36 @@ void HOT Application::feed_wdt_slow_(uint32_t time) {
   // confirmed the WDT_FEED_INTERVAL_MS rate limit was exceeded.
   arch_feed_wdt();
   this->last_wdt_feed_ = time;
-#ifdef USE_STATUS_LED
-  if (status_led::global_status_led != nullptr) {
-    auto *sl = status_led::global_status_led;
-    uint8_t sl_state = sl->get_component_state() & COMPONENT_STATE_MASK;
-    if (sl_state == COMPONENT_STATE_LOOP_DONE) {
-      // status_led only transitions to LOOP_DONE from inside its own loop() (after the
-      // first idle-path dispatch), so its pin is already initialized by pre_setup() and
-      // its setup() has already run. Re-dispatch only if an error or warning bit has been
-      // set since; otherwise skip entirely.
-      if ((this->app_state_ & STATUS_LED_MASK) == 0)
-        return;
-      sl->enable_loop();
-    } else if (sl_state != COMPONENT_STATE_LOOP) {
-      // CONSTRUCTION/SETUP/FAILED: not our job — App::setup() drives the lifecycle.
-      return;
-    }
-    sl->loop();
-  }
-#endif
 }
 
+#ifdef USE_STATUS_LED
+void HOT Application::service_status_led_slow_(uint32_t time) {
+  // Callers (feed_wdt(), feed_wdt_with_time()) have already confirmed the
+  // STATUS_LED_DISPATCH_INTERVAL_MS rate limit was exceeded. Rate-limited
+  // separately from arch_feed_wdt() so the LED blink pattern stays readable
+  // (status_led error blink period is 250 ms) while HAL watchdog pokes can
+  // still run at the much coarser WDT_FEED_INTERVAL_MS cadence.
+  this->last_status_led_service_ = time;
+  if (status_led::global_status_led == nullptr)
+    return;
+  auto *sl = status_led::global_status_led;
+  uint8_t sl_state = sl->get_component_state() & COMPONENT_STATE_MASK;
+  if (sl_state == COMPONENT_STATE_LOOP_DONE) {
+    // status_led only transitions to LOOP_DONE from inside its own loop() (after the
+    // first idle-path dispatch), so its pin is already initialized by pre_setup() and
+    // its setup() has already run. Re-dispatch only if an error or warning bit has been
+    // set since; otherwise skip entirely.
+    if ((this->app_state_ & STATUS_LED_MASK) == 0)
+      return;
+    sl->enable_loop();
+  } else if (sl_state != COMPONENT_STATE_LOOP) {
+    // CONSTRUCTION/SETUP/FAILED: not our job — App::setup() drives the lifecycle.
+    return;
+  }
+  sl->loop();
+}
+#endif
+
 bool Application::any_component_has_status_flag_(uint8_t flag) const {
   // Walk all components (not just looping ones) so non-looping components'
   // status bits are respected. Only called from the slow-path clear helpers
diff --git a/esphome/core/application.h b/esphome/core/application.h
index 9252a47446..645caa2404 100644
--- a/esphome/core/application.h
+++ b/esphome/core/application.h
@@ -229,23 +229,50 @@ class Application {
 
   void schedule_dump_config() { this->dump_config_at_ = 0; }
 
-  /// Minimum interval between real arch_feed_wdt() calls. Chosen to keep the
-  /// rate of HAL pokes low while still being small enough that any plausible
-  /// watchdog timeout (seconds) has orders of magnitude of safety margin.
-  static constexpr uint32_t WDT_FEED_INTERVAL_MS = 3;
+  /// Minimum interval between real arch_feed_wdt() calls. Sized so the outer
+  /// feed in Application::loop() is effectively rate-limited across both the
+  /// normal ~62 Hz cadence and worst-case wake-storm scenarios (e.g. external
+  /// stacks like OpenThread posting frequent wake notifications). Component
+  /// loops and scheduler items still feed after every op, so any op exceeding
+  /// this threshold triggers a real feed naturally.
+  /// Safety margins vs. platform watchdog timeouts:
+  ///   - ESP32 task WDT default (5 s): ~16x
+  ///   - ESP8266 soft WDT (~1.6 s):    ~5x  <-- floor case; any future change
+  ///                                             must keep comfortable margin here
+  ///   - ESP8266 HW WDT (~6 s):        ~20x
+  static constexpr uint32_t WDT_FEED_INTERVAL_MS = 300;
 
   /// Feed the task watchdog. Cold entry — callers without a millis()
   /// timestamp in hand. Out of line to keep call sites tiny.
   void feed_wdt();
 
+#ifdef USE_STATUS_LED
+  /// Dispatch interval for the status LED update. Deliberately shorter than
+  /// WDT_FEED_INTERVAL_MS because the status LED error blink has a 250 ms
+  /// period (status_led.cpp:ERROR_PERIOD_MS) and a 150 ms on-window; the
+  /// dispatch cadence must be short enough to render that blink without
+  /// aliasing. Sampling every 100 ms yields an on/off observation inside
+  /// every error period with headroom for the 250 ms warning on-window.
+  static constexpr uint32_t STATUS_LED_DISPATCH_INTERVAL_MS = 100;
+#endif
+
   /// Feed the task watchdog, hot entry. Callers that already have a
   /// millis() timestamp pay only a load + sub + branch on the common
-  /// (no-op) path. The actual arch feed + status LED update live in
-  /// feed_wdt_slow_.
+  /// (no-op) path. The actual arch feed lives in feed_wdt_slow_.
+  /// When USE_STATUS_LED is compiled in, also gates a separate (shorter)
+  /// interval for dispatching status_led so the LED blink pattern stays
+  /// readable even though arch_feed_wdt pokes are now rate-limited at
+  /// WDT_FEED_INTERVAL_MS. The two rate limits are independent so raising
+  /// WDT_FEED_INTERVAL_MS does not distort the LED cadence.
   void ESPHOME_ALWAYS_INLINE feed_wdt_with_time(uint32_t time) {
     if (static_cast<uint32_t>(time - this->last_wdt_feed_) > WDT_FEED_INTERVAL_MS) [[unlikely]] {
       this->feed_wdt_slow_(time);
     }
+#ifdef USE_STATUS_LED
+    if (static_cast<uint32_t>(time - this->last_status_led_service_) > STATUS_LED_DISPATCH_INTERVAL_MS) [[unlikely]] {
+      this->service_status_led_slow_(time);
+    }
+#endif
   }
 
   void reboot();
@@ -410,11 +437,21 @@ class Application {
   /// Caller must ensure dump_config_at_ < components_.size().
   void __attribute__((noinline)) process_dump_config_();
 
-  /// Slow path for feed_wdt(): actually calls arch_feed_wdt(), updates
-  /// last_wdt_feed_, and re-dispatches the status LED. Out of line so the
-  /// inline wrapper stays tiny.
+  /// Slow path for feed_wdt(): actually calls arch_feed_wdt() and updates
+  /// last_wdt_feed_. Out of line so the inline wrapper stays tiny. Does NOT
+  /// touch status_led — that's gated separately via service_status_led_slow_
+  /// because the two rate limits have very different safe ranges (~ seconds
+  /// for WDT, < 250 ms for LED blink rendering).
   void feed_wdt_slow_(uint32_t time);
 
+#ifdef USE_STATUS_LED
+  /// Slow path for the status_led dispatch rate limit. Runs the status_led
+  /// component's loop() based on its state (LOOP / LOOP_DONE with status
+  /// bits set), and updates last_status_led_service_. Out of line to keep
+  /// the feed_wdt_with_time hot path a couple of load+branch sequences.
+  void service_status_led_slow_(uint32_t time);
+#endif
+
   /// Perform a delay while also monitoring socket file descriptors for readiness
 #ifdef USE_HOST
   // select() fallback path is too complex to inline (host platform)
@@ -468,6 +505,10 @@ class Application {
   uint32_t last_loop_{0};
   uint32_t loop_component_start_time_{0};
   uint32_t last_wdt_feed_{0};  // millis() of most recent arch_feed_wdt(); rate-limits feed_wdt() hot path
+#ifdef USE_STATUS_LED
+  // millis() of most recent status_led dispatch; rate-limits independently of last_wdt_feed_
+  uint32_t last_status_led_service_{0};
+#endif
 
 #ifdef USE_HOST
   int max_fd_{-1};  // Highest file descriptor number for select()

From 0d3a3552dadc74d8770fe9dd2f3e41402eac9c31 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Tue, 21 Apr 2026 04:39:49 +0200
Subject: [PATCH 14/19] [core] Move heap-allocating helpers to
 alloc_helpers.h/cpp (#15623)

---
 esphome/components/anova/anova_base.cpp       |   6 +-
 .../components/http_request/http_request.cpp  |   2 +-
 .../components/http_request/http_request.h    |   5 +-
 .../http_request/http_request_arduino.cpp     |   2 +-
 .../http_request/http_request_host.cpp        |   2 +-
 .../http_request/http_request_idf.cpp         |   2 +-
 esphome/core/alloc_helpers.cpp                | 229 +++++++++++++++++
 esphome/core/alloc_helpers.h                  | 128 +++++++++
 esphome/core/helpers.cpp                      | 189 +-------------
 esphome/core/helpers.h                        | 242 ++----------------
 script/ci-custom.py                           |  16 +-
 11 files changed, 417 insertions(+), 406 deletions(-)
 create mode 100644 esphome/core/alloc_helpers.cpp
 create mode 100644 esphome/core/alloc_helpers.h

diff --git a/esphome/components/anova/anova_base.cpp b/esphome/components/anova/anova_base.cpp
index fef4f1d852..a14dd728a8 100644
--- a/esphome/components/anova/anova_base.cpp
+++ b/esphome/components/anova/anova_base.cpp
@@ -2,6 +2,8 @@
 #include <cstdio>
 #include <cstring>
 
+#include "esphome/core/alloc_helpers.h"
+
 namespace esphome {
 namespace anova {
 
@@ -105,14 +107,14 @@ void AnovaCodec::decode(const uint8_t *data, uint16_t length) {
     }
     case READ_TARGET_TEMPERATURE:
     case SET_TARGET_TEMPERATURE: {
-      this->target_temp_ = parse_number<float>(str_until(buf, '\r')).value_or(0.0f);
+      this->target_temp_ = parse_number<float>(str_until(buf, '\r')).value_or(0.0f);  // NOLINT
       if (this->fahrenheit_)
         this->target_temp_ = ftoc(this->target_temp_);
       this->has_target_temp_ = true;
       break;
     }
     case READ_CURRENT_TEMPERATURE: {
-      this->current_temp_ = parse_number<float>(str_until(buf, '\r')).value_or(0.0f);
+      this->current_temp_ = parse_number<float>(str_until(buf, '\r')).value_or(0.0f);  // NOLINT
       if (this->fahrenheit_)
         this->current_temp_ = ftoc(this->current_temp_);
       this->has_current_temp_ = true;
diff --git a/esphome/components/http_request/http_request.cpp b/esphome/components/http_request/http_request.cpp
index 2c74638f12..d45208ed5d 100644
--- a/esphome/components/http_request/http_request.cpp
+++ b/esphome/components/http_request/http_request.cpp
@@ -22,7 +22,7 @@ void HttpRequestComponent::dump_config() {
 }
 
 std::string HttpContainer::get_response_header(const std::string &header_name) {
-  auto lower = str_lower_case(header_name);
+  auto lower = str_lower_case(header_name);  // NOLINT
   for (const auto &entry : this->response_headers_) {
     if (entry.name == lower) {
       ESP_LOGD(TAG, "Header with name %s found with value %s", lower.c_str(), entry.value.c_str());
diff --git a/esphome/components/http_request/http_request.h b/esphome/components/http_request/http_request.h
index ae73983bab..f37bf77633 100644
--- a/esphome/components/http_request/http_request.h
+++ b/esphome/components/http_request/http_request.h
@@ -11,6 +11,7 @@
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
 #include "esphome/core/defines.h"
+#include "esphome/core/alloc_helpers.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
@@ -400,7 +401,7 @@ class HttpRequestComponent : public Component {
     std::vector<std::string> lower;
     lower.reserve(collect_headers.size());
     for (const auto &h : collect_headers) {
-      lower.push_back(str_lower_case(h));
+      lower.push_back(str_lower_case(h));  // NOLINT
     }
     return this->perform(url, method, body, request_headers, lower);
   }
@@ -415,7 +416,7 @@ class HttpRequestComponent : public Component {
     std::vector<std::string> lower;
     lower.reserve(collect_headers.size());
     for (const auto &h : collect_headers) {
-      lower.push_back(str_lower_case(h));
+      lower.push_back(str_lower_case(h));  // NOLINT
     }
     return this->perform(url, method, body, std::vector<Header>(request_headers.begin(), request_headers.end()), lower);
   }
diff --git a/esphome/components/http_request/http_request_arduino.cpp b/esphome/components/http_request/http_request_arduino.cpp
index f0dd649285..05f9db1c06 100644
--- a/esphome/components/http_request/http_request_arduino.cpp
+++ b/esphome/components/http_request/http_request_arduino.cpp
@@ -161,7 +161,7 @@ std::shared_ptr<HttpContainer> HttpRequestArduino::perform(const std::string &ur
   container->response_headers_.clear();
   auto header_count = container->client_.headers();
   for (int i = 0; i < header_count; i++) {
-    const std::string header_name = str_lower_case(container->client_.headerName(i).c_str());
+    const std::string header_name = str_lower_case(container->client_.headerName(i).c_str());  // NOLINT
     if (should_collect_header(lower_case_collect_headers, header_name)) {
       std::string header_value = container->client_.header(i).c_str();
       ESP_LOGD(TAG, "Received response header, name: %s, value: %s", header_name.c_str(), header_value.c_str());
diff --git a/esphome/components/http_request/http_request_host.cpp b/esphome/components/http_request/http_request_host.cpp
index 60ab4d68a0..85c6e8b3c7 100644
--- a/esphome/components/http_request/http_request_host.cpp
+++ b/esphome/components/http_request/http_request_host.cpp
@@ -115,7 +115,7 @@ std::shared_ptr<HttpContainer> HttpRequestHost::perform(const std::string &url,
   container->content_length = container->response_body_.size();
   for (auto header : response.headers) {
     ESP_LOGD(TAG, "Header: %s: %s", header.first.c_str(), header.second.c_str());
-    auto lower_name = str_lower_case(header.first);
+    auto lower_name = str_lower_case(header.first);  // NOLINT
     if (should_collect_header(lower_case_collect_headers, lower_name)) {
       container->response_headers_.push_back({lower_name, header.second});
     }
diff --git a/esphome/components/http_request/http_request_idf.cpp b/esphome/components/http_request/http_request_idf.cpp
index 30f53eecdc..3e341395a4 100644
--- a/esphome/components/http_request/http_request_idf.cpp
+++ b/esphome/components/http_request/http_request_idf.cpp
@@ -38,7 +38,7 @@ esp_err_t HttpRequestIDF::http_event_handler(esp_http_client_event_t *evt) {
 
   switch (evt->event_id) {
     case HTTP_EVENT_ON_HEADER: {
-      const std::string header_name = str_lower_case(evt->header_key);
+      const std::string header_name = str_lower_case(evt->header_key);  // NOLINT
       if (should_collect_header(user_data->lower_case_collect_headers, header_name)) {
         const std::string header_value = evt->header_value;
         ESP_LOGD(TAG, "Received response header, name: %s, value: %s", header_name.c_str(), header_value.c_str());
diff --git a/esphome/core/alloc_helpers.cpp b/esphome/core/alloc_helpers.cpp
new file mode 100644
index 0000000000..11c7abe3f7
--- /dev/null
+++ b/esphome/core/alloc_helpers.cpp
@@ -0,0 +1,229 @@
+#include "esphome/core/alloc_helpers.h"
+
+#include "esphome/core/helpers.h"
+
+#include <algorithm>
+#include <cctype>
+#include <cstdarg>
+#include <cstdio>
+#include <cstring>
+#include <string>
+
+namespace esphome {
+
+// --- String helpers ---
+
+std::string str_truncate(const std::string &str, size_t length) {
+  return str.length() > length ? str.substr(0, length) : str;
+}
+
+std::string str_until(const char *str, char ch) {
+  const char *pos = strchr(str, ch);
+  return pos == nullptr ? std::string(str) : std::string(str, pos - str);
+}
+std::string str_until(const std::string &str, char ch) { return str.substr(0, str.find(ch)); }
+
+// wrapper around std::transform to run safely on functions from the ctype.h header
+// see https://en.cppreference.com/w/cpp/string/byte/toupper#Notes
+template<int (*fn)(int)> std::string str_ctype_transform(const std::string &str) {
+  std::string result;
+  result.resize(str.length());
+  std::transform(str.begin(), str.end(), result.begin(), [](unsigned char ch) { return fn(ch); });
+  return result;
+}
+std::string str_lower_case(const std::string &str) { return str_ctype_transform<std::tolower>(str); }
+
+std::string str_upper_case(const std::string &str) {
+  std::string result;
+  result.resize(str.length());
+  std::transform(str.begin(), str.end(), result.begin(), [](unsigned char ch) { return std::toupper(ch); });
+  return result;
+}
+
+std::string str_snake_case(const std::string &str) {
+  std::string result = str;
+  for (char &c : result) {
+    c = to_snake_case_char(c);
+  }
+  return result;
+}
+
+std::string str_sanitize(const std::string &str) {
+  std::string result;
+  result.resize(str.size());
+  str_sanitize_to(&result[0], str.size() + 1, str.c_str());
+  return result;
+}
+
+std::string str_snprintf(const char *fmt, size_t len, ...) {
+  std::string str;
+  va_list args;
+
+  str.resize(len);
+  va_start(args, len);
+  size_t out_length = vsnprintf(&str[0], len + 1, fmt, args);
+  va_end(args);
+
+  if (out_length < len)
+    str.resize(out_length);
+
+  return str;
+}
+
+std::string str_sprintf(const char *fmt, ...) {
+  std::string str;
+  va_list args;
+
+  va_start(args, fmt);
+  size_t length = vsnprintf(nullptr, 0, fmt, args);
+  va_end(args);
+
+  str.resize(length);
+  va_start(args, fmt);
+  vsnprintf(&str[0], length + 1, fmt, args);
+  va_end(args);
+
+  return str;
+}
+
+// --- Value formatting helpers ---
+
+std::string value_accuracy_to_string(float value, int8_t accuracy_decimals) {
+  char buf[VALUE_ACCURACY_MAX_LEN];
+  value_accuracy_to_buf(buf, value, accuracy_decimals);
+  return std::string(buf);
+}
+
+// --- Base64 helpers ---
+
+static constexpr const char *BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+                                            "abcdefghijklmnopqrstuvwxyz"
+                                            "0123456789+/";
+
+// Encode 3 input bytes to 4 base64 characters, append 'count' to ret.
+static inline void base64_encode_triple(const char *char_array_3, int count, std::string &ret) {
+  char char_array_4[4];
+  char_array_4[0] = (char_array_3[0] & 0xfc) >> 2;
+  char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xf0) >> 4);
+  char_array_4[2] = ((char_array_3[1] & 0x0f) << 2) + ((char_array_3[2] & 0xc0) >> 6);
+  char_array_4[3] = char_array_3[2] & 0x3f;
+
+  for (int j = 0; j < count; j++)
+    ret += BASE64_CHARS[static_cast<uint8_t>(char_array_4[j])];
+}
+
+std::string base64_encode(const std::vector<uint8_t> &buf) { return base64_encode(buf.data(), buf.size()); }
+
+std::string base64_encode(const uint8_t *buf, size_t buf_len) {
+  std::string ret;
+  int i = 0;
+  char char_array_3[3];
+
+  while (buf_len--) {
+    char_array_3[i++] = *(buf++);
+    if (i == 3) {
+      base64_encode_triple(char_array_3, 4, ret);
+      i = 0;
+    }
+  }
+
+  if (i) {
+    for (int j = i; j < 3; j++)
+      char_array_3[j] = '\0';
+
+    base64_encode_triple(char_array_3, i + 1, ret);
+
+    while ((i++ < 3))
+      ret += '=';
+  }
+
+  return ret;
+}
+
+std::vector<uint8_t> base64_decode(const std::string &encoded_string) {
+  // Calculate maximum decoded size: every 4 base64 chars = 3 bytes
+  size_t max_len = ((encoded_string.size() + 3) / 4) * 3;
+  std::vector<uint8_t> ret(max_len);
+  size_t actual_len = base64_decode(encoded_string, ret.data(), max_len);
+  ret.resize(actual_len);
+  return ret;
+}
+
+// --- Hex/binary formatting helpers ---
+
+std::string format_mac_address_pretty(const uint8_t *mac) {
+  char buf[18];
+  format_mac_addr_upper(mac, buf);
+  return std::string(buf);
+}
+
+std::string format_hex(const uint8_t *data, size_t length) {
+  std::string ret;
+  ret.resize(length * 2);
+  format_hex_to(&ret[0], length * 2 + 1, data, length);
+  return ret;
+}
+
+std::string format_hex(const std::vector<uint8_t> &data) { return format_hex(data.data(), data.size()); }
+
+// Shared implementation for uint8_t and string hex pretty formatting
+static std::string format_hex_pretty_uint8(const uint8_t *data, size_t length, char separator, bool show_length) {
+  if (data == nullptr || length == 0)
+    return "";
+  std::string ret;
+  size_t hex_len = separator ? (length * 3 - 1) : (length * 2);
+  ret.resize(hex_len);
+  format_hex_pretty_to(&ret[0], hex_len + 1, data, length, separator);
+  if (show_length && length > 4)
+    return ret + " (" + std::to_string(length) + ")";
+  return ret;
+}
+
+std::string format_hex_pretty(const uint8_t *data, size_t length, char separator, bool show_length) {
+  return format_hex_pretty_uint8(data, length, separator, show_length);
+}
+std::string format_hex_pretty(const std::vector<uint8_t> &data, char separator, bool show_length) {
+  return format_hex_pretty(data.data(), data.size(), separator, show_length);
+}
+
+std::string format_hex_pretty(const uint16_t *data, size_t length, char separator, bool show_length) {
+  if (data == nullptr || length == 0)
+    return "";
+  std::string ret;
+  size_t hex_len = separator ? (length * 5 - 1) : (length * 4);
+  ret.resize(hex_len);
+  format_hex_pretty_to(&ret[0], hex_len + 1, data, length, separator);
+  if (show_length && length > 4)
+    return ret + " (" + std::to_string(length) + ")";
+  return ret;
+}
+std::string format_hex_pretty(const std::vector<uint16_t> &data, char separator, bool show_length) {
+  return format_hex_pretty(data.data(), data.size(), separator, show_length);
+}
+std::string format_hex_pretty(const std::string &data, char separator, bool show_length) {
+  return format_hex_pretty_uint8(reinterpret_cast<const uint8_t *>(data.data()), data.length(), separator, show_length);
+}
+
+std::string format_bin(const uint8_t *data, size_t length) {
+  std::string result;
+  result.resize(length * 8);
+  format_bin_to(&result[0], length * 8 + 1, data, length);
+  return result;
+}
+
+// --- MAC address helpers ---
+
+std::string get_mac_address() {
+  uint8_t mac[6];
+  get_mac_address_raw(mac);
+  char buf[13];
+  format_mac_addr_lower_no_sep(mac, buf);
+  return std::string(buf);
+}
+
+std::string get_mac_address_pretty() {
+  char buf[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
+  return std::string(get_mac_address_pretty_into_buffer(buf));
+}
+
+}  // namespace esphome
diff --git a/esphome/core/alloc_helpers.h b/esphome/core/alloc_helpers.h
new file mode 100644
index 0000000000..fe350886b7
--- /dev/null
+++ b/esphome/core/alloc_helpers.h
@@ -0,0 +1,128 @@
+#pragma once
+
+/// @file alloc_helpers.h
+/// @brief Heap-allocating helper functions.
+///
+/// These functions return std::string and allocate heap memory on every call.
+/// On long-running embedded devices, repeated heap allocations fragment memory
+/// over time, eventually causing crashes even with free memory available.
+///
+/// Prefer the stack-based alternatives documented on each function instead.
+/// New code should avoid using these functions.
+
+#include <cstdarg>
+#include <cstdint>
+#include <cstdio>
+#include <string>
+#include <vector>
+
+namespace esphome {
+
+// --- String helpers (allocating) ---
+
+/// Truncate a string to a specific length.
+/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
+std::string str_truncate(const std::string &str, size_t length);
+
+/// Extract the part of the string until either the first occurrence of the specified character, or the end
+/// (requires str to be null-terminated).
+/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
+std::string str_until(const char *str, char ch);
+/// Extract the part of the string until either the first occurrence of the specified character, or the end.
+/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
+std::string str_until(const std::string &str, char ch);
+
+/// Convert the string to lower case.
+/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
+std::string str_lower_case(const std::string &str);
+
+/// Convert the string to upper case.
+/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
+std::string str_upper_case(const std::string &str);
+
+/// Convert the string to snake case (lowercase with underscores).
+/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
+std::string str_snake_case(const std::string &str);
+
+/// Sanitizes the input string by removing all characters but alphanumerics, dashes and underscores.
+/// @warning Allocates heap memory. Use str_sanitize_to() with a stack buffer instead.
+std::string str_sanitize(const std::string &str);
+
+/// snprintf-like function returning std::string of maximum length \p len (excluding null terminator).
+/// @warning Allocates heap memory. Use snprintf() with a stack buffer instead.
+std::string __attribute__((format(printf, 1, 3))) str_snprintf(const char *fmt, size_t len, ...);
+
+/// sprintf-like function returning std::string.
+/// @warning Allocates heap memory. Use snprintf() with a stack buffer instead.
+std::string __attribute__((format(printf, 1, 2))) str_sprintf(const char *fmt, ...);
+
+// --- Hex/binary formatting helpers (allocating) ---
+
+/// Format the six-byte array \p mac into a MAC address string.
+/// @warning Allocates heap memory. Use format_mac_addr_upper() with a stack buffer instead.
+std::string format_mac_address_pretty(const uint8_t mac[6]);
+
+/// Format the byte array \p data of length \p len in lowercased hex.
+/// @warning Allocates heap memory. Use format_hex_to() with a stack buffer instead.
+std::string format_hex(const uint8_t *data, size_t length);
+
+/// Format the vector \p data in lowercased hex.
+/// @warning Allocates heap memory. Use format_hex_to() with a stack buffer instead.
+std::string format_hex(const std::vector<uint8_t> &data);
+
+/// Format a byte array in pretty-printed, human-readable hex format.
+/// @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
+std::string format_hex_pretty(const uint8_t *data, size_t length, char separator = '.', bool show_length = true);
+
+/// Format a 16-bit word array in pretty-printed, human-readable hex format.
+/// @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
+std::string format_hex_pretty(const uint16_t *data, size_t length, char separator = '.', bool show_length = true);
+
+/// Format a byte vector in pretty-printed, human-readable hex format.
+/// @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
+std::string format_hex_pretty(const std::vector<uint8_t> &data, char separator = '.', bool show_length = true);
+
+/// Format a 16-bit word vector in pretty-printed, human-readable hex format.
+/// @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
+std::string format_hex_pretty(const std::vector<uint16_t> &data, char separator = '.', bool show_length = true);
+
+/// Format a string's bytes in pretty-printed, human-readable hex format.
+/// @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
+std::string format_hex_pretty(const std::string &data, char separator = '.', bool show_length = true);
+
+/// Format the byte array \p data of length \p len in binary.
+/// @warning Allocates heap memory. Use format_bin_to() with a stack buffer instead.
+std::string format_bin(const uint8_t *data, size_t length);
+
+// --- Value formatting helpers (allocating) ---
+
+/// Format a float value with accuracy decimals to a string.
+/// @deprecated Allocates heap memory. Use value_accuracy_to_buf() instead. Removed in 2026.7.0.
+__attribute__((deprecated("Allocates heap memory. Use value_accuracy_to_buf() instead. Removed in 2026.7.0.")))
+std::string
+value_accuracy_to_string(float value, int8_t accuracy_decimals);
+
+// --- Base64 helpers (allocating) ---
+
+/// Encode a byte buffer to base64 string.
+/// @warning Allocates heap memory.
+std::string base64_encode(const uint8_t *buf, size_t buf_len);
+/// Encode a byte vector to base64 string.
+/// @warning Allocates heap memory.
+std::string base64_encode(const std::vector<uint8_t> &buf);
+
+/// Decode a base64 string to a byte vector.
+/// @warning Allocates heap memory. Use base64_decode(data, len, buf, buf_len) with a pre-allocated buffer instead.
+std::vector<uint8_t> base64_decode(const std::string &encoded_string);
+
+// --- MAC address helpers (allocating) ---
+
+/// Get the device MAC address as a string, in lowercase hex notation.
+/// @warning Allocates heap memory. Use get_mac_address_into_buffer() instead.
+std::string get_mac_address();
+
+/// Get the device MAC address as a string, in colon-separated uppercase hex notation.
+/// @warning Allocates heap memory. Use get_mac_address_pretty_into_buffer() instead.
+std::string get_mac_address_pretty();
+
+}  // namespace esphome
diff --git a/esphome/core/helpers.cpp b/esphome/core/helpers.cpp
index 34ecaf137f..1d0efd01ce 100644
--- a/esphome/core/helpers.cpp
+++ b/esphome/core/helpers.cpp
@@ -221,31 +221,7 @@ bool str_endswith_ignore_case(const char *str, size_t str_len, const char *suffi
   return strncasecmp(str + str_len - suffix_len, suffix, suffix_len) == 0;
 }
 
-std::string str_truncate(const std::string &str, size_t length) {
-  return str.length() > length ? str.substr(0, length) : str;
-}
-std::string str_until(const char *str, char ch) {
-  const char *pos = strchr(str, ch);
-  return pos == nullptr ? std::string(str) : std::string(str, pos - str);
-}
-std::string str_until(const std::string &str, char ch) { return str.substr(0, str.find(ch)); }
-// wrapper around std::transform to run safely on functions from the ctype.h header
-// see https://en.cppreference.com/w/cpp/string/byte/toupper#Notes
-template<int (*fn)(int)> std::string str_ctype_transform(const std::string &str) {
-  std::string result;
-  result.resize(str.length());
-  std::transform(str.begin(), str.end(), result.begin(), [](unsigned char ch) { return fn(ch); });
-  return result;
-}
-std::string str_lower_case(const std::string &str) { return str_ctype_transform<std::tolower>(str); }
-std::string str_upper_case(const std::string &str) { return str_ctype_transform<std::toupper>(str); }
-std::string str_snake_case(const std::string &str) {
-  std::string result = str;
-  for (char &c : result) {
-    c = to_snake_case_char(c);
-  }
-  return result;
-}
+// str_truncate, str_until, str_lower_case, str_upper_case, str_snake_case moved to alloc_helpers.cpp
 char *str_sanitize_to(char *buffer, size_t buffer_size, const char *str) {
   if (buffer_size == 0) {
     return buffer;
@@ -258,41 +234,7 @@ char *str_sanitize_to(char *buffer, size_t buffer_size, const char *str) {
   return buffer;
 }
 
-std::string str_sanitize(const std::string &str) {
-  std::string result;
-  result.resize(str.size());
-  str_sanitize_to(&result[0], str.size() + 1, str.c_str());
-  return result;
-}
-std::string str_snprintf(const char *fmt, size_t len, ...) {
-  std::string str;
-  va_list args;
-
-  str.resize(len);
-  va_start(args, len);
-  size_t out_length = vsnprintf(&str[0], len + 1, fmt, args);
-  va_end(args);
-
-  if (out_length < len)
-    str.resize(out_length);
-
-  return str;
-}
-std::string str_sprintf(const char *fmt, ...) {
-  std::string str;
-  va_list args;
-
-  va_start(args, fmt);
-  size_t length = vsnprintf(nullptr, 0, fmt, args);
-  va_end(args);
-
-  str.resize(length);
-  va_start(args, fmt);
-  vsnprintf(&str[0], length + 1, fmt, args);
-  va_end(args);
-
-  return str;
-}
+// str_sanitize, str_snprintf, str_sprintf moved to alloc_helpers.cpp
 
 // Maximum size for name with suffix: 120 (max friendly name) + 1 (separator) + 6 (MAC suffix) + 1 (null term)
 static constexpr size_t MAX_NAME_WITH_SUFFIX_SIZE = 128;
@@ -341,11 +283,7 @@ size_t parse_hex(const char *str, size_t length, uint8_t *data, size_t count) {
   return chars;
 }
 
-std::string format_mac_address_pretty(const uint8_t *mac) {
-  char buf[18];
-  format_mac_addr_upper(mac, buf);
-  return std::string(buf);
-}
+// format_mac_address_pretty moved to alloc_helpers.cpp
 
 // Internal helper for hex formatting - base is 'a' for lowercase or 'A' for uppercase.
 // When separator is set, it is written unconditionally after each byte and the last
@@ -398,13 +336,7 @@ char *format_hex_to(char *buffer, size_t buffer_size, const uint8_t *data, size_
   return format_hex_internal(buffer, buffer_size, data, length, 0, 'a');
 }
 
-std::string format_hex(const uint8_t *data, size_t length) {
-  std::string ret;
-  ret.resize(length * 2);
-  format_hex_to(&ret[0], length * 2 + 1, data, length);
-  return ret;
-}
-std::string format_hex(const std::vector<uint8_t> &data) { return format_hex(data.data(), data.size()); }
+// format_hex (std::string returning overloads) moved to alloc_helpers.cpp
 
 char *format_hex_pretty_to(char *buffer, size_t buffer_size, const uint8_t *data, size_t length, char separator) {
   return format_hex_internal(buffer, buffer_size, data, length, separator, 'A');
@@ -441,43 +373,7 @@ char *format_hex_pretty_to(char *buffer, size_t buffer_size, const uint16_t *dat
   return buffer;
 }
 
-// Shared implementation for uint8_t and string hex formatting
-static std::string format_hex_pretty_uint8(const uint8_t *data, size_t length, char separator, bool show_length) {
-  if (data == nullptr || length == 0)
-    return "";
-  std::string ret;
-  size_t hex_len = separator ? (length * 3 - 1) : (length * 2);
-  ret.resize(hex_len);
-  format_hex_pretty_to(&ret[0], hex_len + 1, data, length, separator);
-  if (show_length && length > 4)
-    return ret + " (" + std::to_string(length) + ")";
-  return ret;
-}
-
-std::string format_hex_pretty(const uint8_t *data, size_t length, char separator, bool show_length) {
-  return format_hex_pretty_uint8(data, length, separator, show_length);
-}
-std::string format_hex_pretty(const std::vector<uint8_t> &data, char separator, bool show_length) {
-  return format_hex_pretty(data.data(), data.size(), separator, show_length);
-}
-
-std::string format_hex_pretty(const uint16_t *data, size_t length, char separator, bool show_length) {
-  if (data == nullptr || length == 0)
-    return "";
-  std::string ret;
-  size_t hex_len = separator ? (length * 5 - 1) : (length * 4);
-  ret.resize(hex_len);
-  format_hex_pretty_to(&ret[0], hex_len + 1, data, length, separator);
-  if (show_length && length > 4)
-    return ret + " (" + std::to_string(length) + ")";
-  return ret;
-}
-std::string format_hex_pretty(const std::vector<uint16_t> &data, char separator, bool show_length) {
-  return format_hex_pretty(data.data(), data.size(), separator, show_length);
-}
-std::string format_hex_pretty(const std::string &data, char separator, bool show_length) {
-  return format_hex_pretty_uint8(reinterpret_cast<const uint8_t *>(data.data()), data.length(), separator, show_length);
-}
+// format_hex_pretty (all std::string returning overloads) moved to alloc_helpers.cpp
 
 char *format_bin_to(char *buffer, size_t buffer_size, const uint8_t *data, size_t length) {
   if (buffer_size == 0) {
@@ -500,12 +396,7 @@ char *format_bin_to(char *buffer, size_t buffer_size, const uint8_t *data, size_
   return buffer;
 }
 
-std::string format_bin(const uint8_t *data, size_t length) {
-  std::string result;
-  result.resize(length * 8);
-  format_bin_to(&result[0], length * 8 + 1, data, length);
-  return result;
-}
+// format_bin moved to alloc_helpers.cpp
 
 ParseOnOffState parse_on_off(const char *str, const char *on, const char *off) {
   if (on == nullptr && ESPHOME_strcasecmp_P(str, ESPHOME_PSTR("on")) == 0)
@@ -537,11 +428,7 @@ static inline void normalize_accuracy_decimals(float &value, int8_t &accuracy_de
   }
 }
 
-std::string value_accuracy_to_string(float value, int8_t accuracy_decimals) {
-  char buf[VALUE_ACCURACY_MAX_LEN];
-  value_accuracy_to_buf(buf, value, accuracy_decimals);
-  return std::string(buf);
-}
+// value_accuracy_to_string moved to alloc_helpers.cpp
 
 size_t value_accuracy_to_buf(std::span<char, VALUE_ACCURACY_MAX_LEN> buf, float value, int8_t accuracy_decimals) {
   normalize_accuracy_decimals(value, accuracy_decimals);
@@ -606,45 +493,7 @@ static inline uint8_t base64_find_char(char c) {
 // Check if character is valid base64 or base64url
 static inline bool is_base64(char c) { return (isalnum(c) || (c == '+') || (c == '/') || (c == '-') || (c == '_')); }
 
-std::string base64_encode(const std::vector<uint8_t> &buf) { return base64_encode(buf.data(), buf.size()); }
-
-// Encode 3 input bytes to 4 base64 characters, append 'count' to ret.
-static inline void base64_encode_triple(const char *char_array_3, int count, std::string &ret) {
-  char char_array_4[4];
-  char_array_4[0] = (char_array_3[0] & 0xfc) >> 2;
-  char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xf0) >> 4);
-  char_array_4[2] = ((char_array_3[1] & 0x0f) << 2) + ((char_array_3[2] & 0xc0) >> 6);
-  char_array_4[3] = char_array_3[2] & 0x3f;
-
-  for (int j = 0; j < count; j++)
-    ret += BASE64_CHARS[static_cast<uint8_t>(char_array_4[j])];
-}
-
-std::string base64_encode(const uint8_t *buf, size_t buf_len) {
-  std::string ret;
-  int i = 0;
-  char char_array_3[3];
-
-  while (buf_len--) {
-    char_array_3[i++] = *(buf++);
-    if (i == 3) {
-      base64_encode_triple(char_array_3, 4, ret);
-      i = 0;
-    }
-  }
-
-  if (i) {
-    for (int j = i; j < 3; j++)
-      char_array_3[j] = '\0';
-
-    base64_encode_triple(char_array_3, i + 1, ret);
-
-    while ((i++ < 3))
-      ret += '=';
-  }
-
-  return ret;
-}
+// base64_encode (both overloads) moved to alloc_helpers.cpp
 
 size_t base64_decode(const std::string &encoded_string, uint8_t *buf, size_t buf_len) {
   return base64_decode(reinterpret_cast<const uint8_t *>(encoded_string.data()), encoded_string.size(), buf, buf_len);
@@ -705,14 +554,7 @@ size_t base64_decode(const uint8_t *encoded_data, size_t encoded_len, uint8_t *b
   return out;
 }
 
-std::vector<uint8_t> base64_decode(const std::string &encoded_string) {
-  // Calculate maximum decoded size: every 4 base64 chars = 3 bytes
-  size_t max_len = ((encoded_string.size() + 3) / 4) * 3;
-  std::vector<uint8_t> ret(max_len);
-  size_t actual_len = base64_decode(encoded_string, ret.data(), max_len);
-  ret.resize(actual_len);
-  return ret;
-}
+// base64_decode (vector-returning overload) moved to alloc_helpers.cpp
 
 /// Decode base64/base64url string directly into vector of little-endian int32 values
 /// @param base64 Base64 or base64url encoded string (both +/ and -_ accepted)
@@ -851,18 +693,7 @@ void HighFrequencyLoopRequester::stop() {
   this->started_ = false;
 }
 
-std::string get_mac_address() {
-  uint8_t mac[6];
-  get_mac_address_raw(mac);
-  char buf[13];
-  format_mac_addr_lower_no_sep(mac, buf);
-  return std::string(buf);
-}
-
-std::string get_mac_address_pretty() {
-  char buf[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
-  return std::string(get_mac_address_pretty_into_buffer(buf));
-}
+// get_mac_address, get_mac_address_pretty moved to alloc_helpers.cpp
 
 void get_mac_address_into_buffer(std::span<char, MAC_ADDRESS_BUFFER_SIZE> buf) {
   uint8_t mac[6];
diff --git a/esphome/core/helpers.h b/esphome/core/helpers.h
index 54bc32a5a5..bb164f5034 100644
--- a/esphome/core/helpers.h
+++ b/esphome/core/helpers.h
@@ -21,6 +21,12 @@
 
 #include "esphome/core/optional.h"
 
+// Backward compatibility re-export of heap-allocating helpers.
+// These functions have moved to alloc_helpers.h. External components should
+// update their includes to use #include "esphome/core/alloc_helpers.h" directly.
+// This re-export will be removed in 2026.11.0.
+#include "esphome/core/alloc_helpers.h"
+
 #ifdef USE_ESP8266
 #include <Esp.h>
 #include <pgmspace.h>
@@ -979,27 +985,13 @@ inline bool str_endswith_ignore_case(const std::string &str, const char *suffix)
   return str_endswith_ignore_case(str.c_str(), str.size(), suffix, strlen(suffix));
 }
 
-/// Truncate a string to a specific length.
-/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
-std::string str_truncate(const std::string &str, size_t length);
+// str_truncate moved to alloc_helpers.h - remove this include before 2026.11.0
 
-/// Extract the part of the string until either the first occurrence of the specified character, or the end
-/// (requires str to be null-terminated).
-std::string str_until(const char *str, char ch);
-/// Extract the part of the string until either the first occurrence of the specified character, or the end.
-std::string str_until(const std::string &str, char ch);
-
-/// Convert the string to lower case.
-std::string str_lower_case(const std::string &str);
-/// Convert the string to upper case.
-/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
-std::string str_upper_case(const std::string &str);
+// str_until, str_lower_case, str_upper_case moved to alloc_helpers.h - remove this comment before 2026.11.0
 
 /// Convert a single char to snake_case: lowercase and space to underscore.
 constexpr char to_snake_case_char(char c) { return (c == ' ') ? '_' : (c >= 'A' && c <= 'Z') ? c + ('a' - 'A') : c; }
-/// Convert the string to snake case (lowercase with underscores).
-/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
-std::string str_snake_case(const std::string &str);
+// str_snake_case moved to alloc_helpers.h - remove this comment before 2026.11.0
 
 /// Sanitize a single char: keep alphanumerics, dashes, underscores; replace others with underscore.
 constexpr char to_sanitized_char(char c) {
@@ -1022,9 +1014,7 @@ template<size_t N> inline char *str_sanitize_to(char (&buffer)[N], const char *s
   return str_sanitize_to(buffer, N, str);
 }
 
-/// Sanitizes the input string by removing all characters but alphanumerics, dashes and underscores.
-/// @warning Allocates heap memory. Use str_sanitize_to() with a stack buffer instead.
-std::string str_sanitize(const std::string &str);
+// str_sanitize moved to alloc_helpers.h - remove this comment before 2026.11.0
 
 /// Calculate FNV-1 hash of a string while applying snake_case + sanitize transformations.
 /// This computes object_id hashes directly from names without creating an intermediate buffer.
@@ -1040,13 +1030,7 @@ inline uint32_t fnv1_hash_object_id(const char *str, size_t len) {
   return hash;
 }
 
-/// snprintf-like function returning std::string of maximum length \p len (excluding null terminator).
-/// @warning Allocates heap memory. Use snprintf() with a stack buffer instead.
-std::string __attribute__((format(printf, 1, 3))) str_snprintf(const char *fmt, size_t len, ...);
-
-/// sprintf-like function returning std::string.
-/// @warning Allocates heap memory. Use snprintf() with a stack buffer instead.
-std::string __attribute__((format(printf, 1, 2))) str_sprintf(const char *fmt, ...);
+// str_snprintf, str_sprintf moved to alloc_helpers.h - remove this comment before 2026.11.0
 
 #ifdef USE_ESP8266
 // ESP8266: Use vsnprintf_P to keep format strings in flash (PROGMEM)
@@ -1441,189 +1425,26 @@ inline void format_mac_addr_lower_no_sep(const uint8_t *mac, char *output) {
   format_hex_to(output, MAC_ADDRESS_BUFFER_SIZE, mac, MAC_ADDRESS_SIZE);
 }
 
-/// Format the six-byte array \p mac into a MAC address.
-/// @warning Allocates heap memory. Use format_mac_addr_upper() with a stack buffer instead.
-/// Causes heap fragmentation on long-running devices.
-std::string format_mac_address_pretty(const uint8_t mac[6]);
-/// Format the byte array \p data of length \p len in lowercased hex.
-/// @warning Allocates heap memory. Use format_hex_to() with a stack buffer instead.
-/// Causes heap fragmentation on long-running devices.
-std::string format_hex(const uint8_t *data, size_t length);
-/// Format the vector \p data in lowercased hex.
-/// @warning Allocates heap memory. Use format_hex_to() with a stack buffer instead.
-/// Causes heap fragmentation on long-running devices.
-std::string format_hex(const std::vector<uint8_t> &data);
+// format_mac_address_pretty, format_hex (all overloads) moved to alloc_helpers.h
+// Remove this comment and the template overloads below before 2026.11.0
+
 /// Format an unsigned integer in lowercased hex, starting with the most significant byte.
 /// @warning Allocates heap memory. Use format_hex_to() with a stack buffer instead.
-/// Causes heap fragmentation on long-running devices.
 template<typename T, enable_if_t<std::is_unsigned<T>::value, int> = 0> std::string format_hex(T val) {
   val = convert_big_endian(val);
   return format_hex(reinterpret_cast<uint8_t *>(&val), sizeof(T));
 }
 /// Format the std::array \p data in lowercased hex.
 /// @warning Allocates heap memory. Use format_hex_to() with a stack buffer instead.
-/// Causes heap fragmentation on long-running devices.
 template<std::size_t N> std::string format_hex(const std::array<uint8_t, N> &data) {
   return format_hex(data.data(), data.size());
 }
 
-/** Format a byte array in pretty-printed, human-readable hex format.
- *
- * Converts binary data to a hexadecimal string representation with customizable formatting.
- * Each byte is displayed as a two-digit uppercase hex value, separated by the specified separator.
- * Optionally includes the total byte count in parentheses at the end.
- *
- * @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
- * Causes heap fragmentation on long-running devices.
- *
- * @param data Pointer to the byte array to format.
- * @param length Number of bytes in the array.
- * @param separator Character to use between hex bytes (default: '.').
- * @param show_length Whether to append the byte count in parentheses (default: true).
- * @return Formatted hex string, e.g., "A1.B2.C3.D4.E5 (5)" or "A1:B2:C3" depending on parameters.
- *
- * @note Returns empty string if data is nullptr or length is 0.
- * @note The length will only be appended if show_length is true AND the length is greater than 4.
- *
- * Example:
- * @code
- * uint8_t data[] = {0xA1, 0xB2, 0xC3};
- * format_hex_pretty(data, 3);           // Returns "A1.B2.C3" (no length shown for <= 4 parts)
- * uint8_t data2[] = {0xA1, 0xB2, 0xC3, 0xD4, 0xE5};
- * format_hex_pretty(data2, 5);          // Returns "A1.B2.C3.D4.E5 (5)"
- * format_hex_pretty(data2, 5, ':');     // Returns "A1:B2:C3:D4:E5 (5)"
- * format_hex_pretty(data2, 5, '.', false); // Returns "A1.B2.C3.D4.E5"
- * @endcode
- */
-std::string format_hex_pretty(const uint8_t *data, size_t length, char separator = '.', bool show_length = true);
+// format_hex_pretty (all overloads) moved to alloc_helpers.h
+// Remove this comment and the template overload below before 2026.11.0
 
-/** Format a 16-bit word array in pretty-printed, human-readable hex format.
- *
- * Similar to the byte array version, but formats 16-bit words as 4-digit hex values.
- *
- * @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
- * Causes heap fragmentation on long-running devices.
- *
- * @param data Pointer to the 16-bit word array to format.
- * @param length Number of 16-bit words in the array.
- * @param separator Character to use between hex words (default: '.').
- * @param show_length Whether to append the word count in parentheses (default: true).
- * @return Formatted hex string with 4-digit hex values per word.
- *
- * @note The length will only be appended if show_length is true AND the length is greater than 4.
- *
- * Example:
- * @code
- * uint16_t data[] = {0xA1B2, 0xC3D4};
- * format_hex_pretty(data, 2); // Returns "A1B2.C3D4" (no length shown for <= 4 parts)
- * uint16_t data2[] = {0xA1B2, 0xC3D4, 0xE5F6};
- * format_hex_pretty(data2, 3); // Returns "A1B2.C3D4.E5F6 (3)"
- * @endcode
- */
-std::string format_hex_pretty(const uint16_t *data, size_t length, char separator = '.', bool show_length = true);
-
-/** Format a byte vector in pretty-printed, human-readable hex format.
- *
- * Convenience overload for std::vector<uint8_t>. Formats each byte as a two-digit
- * uppercase hex value with customizable separator.
- *
- * @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
- * Causes heap fragmentation on long-running devices.
- *
- * @param data Vector of bytes to format.
- * @param separator Character to use between hex bytes (default: '.').
- * @param show_length Whether to append the byte count in parentheses (default: true).
- * @return Formatted hex string representation of the vector contents.
- *
- * @note The length will only be appended if show_length is true AND the vector size is greater than 4.
- *
- * Example:
- * @code
- * std::vector<uint8_t> data = {0xDE, 0xAD, 0xBE, 0xEF};
- * format_hex_pretty(data);        // Returns "DE.AD.BE.EF" (no length shown for <= 4 parts)
- * std::vector<uint8_t> data2 = {0xDE, 0xAD, 0xBE, 0xEF, 0xCA};
- * format_hex_pretty(data2);       // Returns "DE.AD.BE.EF.CA (5)"
- * format_hex_pretty(data2, '-');  // Returns "DE-AD-BE-EF-CA (5)"
- * @endcode
- */
-std::string format_hex_pretty(const std::vector<uint8_t> &data, char separator = '.', bool show_length = true);
-
-/** Format a 16-bit word vector in pretty-printed, human-readable hex format.
- *
- * Convenience overload for std::vector<uint16_t>. Each 16-bit word is formatted
- * as a 4-digit uppercase hex value in big-endian order.
- *
- * @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
- * Causes heap fragmentation on long-running devices.
- *
- * @param data Vector of 16-bit words to format.
- * @param separator Character to use between hex words (default: '.').
- * @param show_length Whether to append the word count in parentheses (default: true).
- * @return Formatted hex string representation of the vector contents.
- *
- * @note The length will only be appended if show_length is true AND the vector size is greater than 4.
- *
- * Example:
- * @code
- * std::vector<uint16_t> data = {0x1234, 0x5678};
- * format_hex_pretty(data); // Returns "1234.5678" (no length shown for <= 4 parts)
- * std::vector<uint16_t> data2 = {0x1234, 0x5678, 0x9ABC};
- * format_hex_pretty(data2); // Returns "1234.5678.9ABC (3)"
- * @endcode
- */
-std::string format_hex_pretty(const std::vector<uint16_t> &data, char separator = '.', bool show_length = true);
-
-/** Format a string's bytes in pretty-printed, human-readable hex format.
- *
- * Treats each character in the string as a byte and formats it in hex.
- * Useful for debugging binary data stored in std::string containers.
- *
- * @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
- * Causes heap fragmentation on long-running devices.
- *
- * @param data String whose bytes should be formatted as hex.
- * @param separator Character to use between hex bytes (default: '.').
- * @param show_length Whether to append the byte count in parentheses (default: true).
- * @return Formatted hex string representation of the string's byte contents.
- *
- * @note The length will only be appended if show_length is true AND the string length is greater than 4.
- *
- * Example:
- * @code
- * std::string data = "ABC";  // ASCII: 0x41, 0x42, 0x43
- * format_hex_pretty(data);   // Returns "41.42.43" (no length shown for <= 4 parts)
- * std::string data2 = "ABCDE";
- * format_hex_pretty(data2);  // Returns "41.42.43.44.45 (5)"
- * @endcode
- */
-std::string format_hex_pretty(const std::string &data, char separator = '.', bool show_length = true);
-
-/** Format an unsigned integer in pretty-printed, human-readable hex format.
- *
- * Converts the integer to big-endian byte order and formats each byte as hex.
- * The most significant byte appears first in the output string.
- *
- * @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
- * Causes heap fragmentation on long-running devices.
- *
- * @tparam T Unsigned integer type (uint8_t, uint16_t, uint32_t, uint64_t, etc.).
- * @param val The unsigned integer value to format.
- * @param separator Character to use between hex bytes (default: '.').
- * @param show_length Whether to append the byte count in parentheses (default: true).
- * @return Formatted hex string with most significant byte first.
- *
- * @note The length will only be appended if show_length is true AND sizeof(T) is greater than 4.
- *
- * Example:
- * @code
- * uint32_t value = 0x12345678;
- * format_hex_pretty(value);        // Returns "12.34.56.78" (no length shown for <= 4 parts)
- * uint64_t value2 = 0x123456789ABCDEF0;
- * format_hex_pretty(value2);       // Returns "12.34.56.78.9A.BC.DE.F0 (8)"
- * format_hex_pretty(value2, ':');  // Returns "12:34:56:78:9A:BC:DE:F0 (8)"
- * format_hex_pretty<uint16_t>(0x1234); // Returns "12.34"
- * @endcode
- */
+/// Format an unsigned integer in pretty-printed, human-readable hex format.
+/// @warning Allocates heap memory. Use format_hex_pretty_to() with a stack buffer instead.
 template<typename T, enable_if_t<std::is_unsigned<T>::value, int> = 0>
 std::string format_hex_pretty(T val, char separator = '.', bool show_length = true) {
   val = convert_big_endian(val);
@@ -1683,13 +1504,10 @@ inline char *format_bin_to(char (&buffer)[N], T val) {
   return format_bin_to(buffer, reinterpret_cast<const uint8_t *>(&val), sizeof(T));
 }
 
-/// Format the byte array \p data of length \p len in binary.
-/// @warning Allocates heap memory. Use format_bin_to() with a stack buffer instead.
-/// Causes heap fragmentation on long-running devices.
-std::string format_bin(const uint8_t *data, size_t length);
+// format_bin moved to alloc_helpers.h - remove this comment and template overload before 2026.11.0
+
 /// Format an unsigned integer in binary, starting with the most significant byte.
 /// @warning Allocates heap memory. Use format_bin_to() with a stack buffer instead.
-/// Causes heap fragmentation on long-running devices.
 template<typename T, enable_if_t<std::is_unsigned<T>::value, int> = 0> std::string format_bin(T val) {
   val = convert_big_endian(val);
   return format_bin(reinterpret_cast<uint8_t *>(&val), sizeof(T));
@@ -1705,9 +1523,7 @@ enum ParseOnOffState : uint8_t {
 /// Parse a string that contains either on, off or toggle.
 ParseOnOffState parse_on_off(const char *str, const char *on = nullptr, const char *off = nullptr);
 
-/// @deprecated Allocates heap memory. Use value_accuracy_to_buf() instead. Removed in 2026.7.0.
-ESPDEPRECATED("Allocates heap memory. Use value_accuracy_to_buf() instead. Removed in 2026.7.0.", "2026.1.0")
-std::string value_accuracy_to_string(float value, int8_t accuracy_decimals);
+// value_accuracy_to_string moved to alloc_helpers.h - remove this comment before 2026.11.0
 
 /// Maximum buffer size for value_accuracy formatting (float ~15 chars + space + UOM ~40 chars + null)
 static constexpr size_t VALUE_ACCURACY_MAX_LEN = 64;
@@ -1721,10 +1537,8 @@ size_t value_accuracy_with_uom_to_buf(std::span<char, VALUE_ACCURACY_MAX_LEN> bu
 /// Derive accuracy in decimals from an increment step.
 int8_t step_to_accuracy_decimals(float step);
 
-std::string base64_encode(const uint8_t *buf, size_t buf_len);
-std::string base64_encode(const std::vector<uint8_t> &buf);
-
-std::vector<uint8_t> base64_decode(const std::string &encoded_string);
+// base64_encode (both overloads), base64_decode (vector overload) moved to alloc_helpers.h
+// Remove this comment before 2026.11.0
 size_t base64_decode(std::string const &encoded_string, uint8_t *buf, size_t buf_len);
 size_t base64_decode(const uint8_t *encoded_data, size_t encoded_len, uint8_t *buf, size_t buf_len);
 
@@ -2160,15 +1974,7 @@ class HighFrequencyLoopRequester {
 /// Get the device MAC address as raw bytes, written into the provided byte array (6 bytes).
 void get_mac_address_raw(uint8_t *mac);  // NOLINT(readability-non-const-parameter)
 
-/// Get the device MAC address as a string, in lowercase hex notation.
-/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
-/// Use get_mac_address_into_buffer() instead.
-std::string get_mac_address();
-
-/// Get the device MAC address as a string, in colon-separated uppercase hex notation.
-/// @warning Allocates heap memory. Avoid in new code - causes heap fragmentation on long-running devices.
-/// Use get_mac_address_pretty_into_buffer() instead.
-std::string get_mac_address_pretty();
+// get_mac_address, get_mac_address_pretty moved to alloc_helpers.h - remove this comment before 2026.11.0
 
 /// Get the device MAC address into the given buffer, in lowercase hex notation.
 /// Assumes buffer length is MAC_ADDRESS_BUFFER_SIZE (12 digits for hexadecimal representation followed by null
diff --git a/script/ci-custom.py b/script/ci-custom.py
index 6dce86924e..02ec08bc31 100755
--- a/script/ci-custom.py
+++ b/script/ci-custom.py
@@ -722,18 +722,22 @@ def lint_trailing_whitespace(fname, match):
 # Heap-allocating helpers that cause fragmentation on long-running embedded devices.
 # These return std::string and should be replaced with stack-based alternatives.
 HEAP_ALLOCATING_HELPERS = {
+    "base64_encode": "base64_encode_to() with a pre-allocated buffer",
     "format_bin": "format_bin_to() with a stack buffer",
     "format_hex": "format_hex_to() with a stack buffer",
     "format_hex_pretty": "format_hex_pretty_to() with a stack buffer",
     "format_mac_address_pretty": "format_mac_addr_upper() with a stack buffer",
     "get_mac_address": "get_mac_address_into_buffer() with a stack buffer",
     "get_mac_address_pretty": "get_mac_address_pretty_into_buffer() with a stack buffer",
+    "str_lower_case": "manual tolower() with a stack buffer",
     "str_sanitize": "str_sanitize_to() with a stack buffer",
     "str_truncate": "removal (function is unused)",
+    "str_until": "manual strchr()/find() with a StringRef or stack buffer",
     "str_upper_case": "removal (function is unused)",
     "str_snake_case": "removal (function is unused)",
     "str_sprintf": "snprintf() with a stack buffer",
     "str_snprintf": "snprintf() with a stack buffer",
+    "value_accuracy_to_string": "value_accuracy_to_buf() with a stack buffer",
 }
 
 
@@ -743,24 +747,33 @@ HEAP_ALLOCATING_HELPERS = {
     # get_mac_address(?!_) ensures we don't match get_mac_address_into_buffer, etc.
     # CPP_RE_EOL captures rest of line so NOLINT comments are detected
     r"[^\w]("
+    r"base64_encode(?!_)|"
     r"format_bin(?!_)|"
     r"format_hex(?!_)|"
     r"format_hex_pretty(?!_)|"
     r"format_mac_address_pretty|"
     r"get_mac_address_pretty(?!_)|"
     r"get_mac_address(?!_)|"
+    r"str_lower_case|"
     r"str_sanitize(?!_)|"
     r"str_truncate|"
+    r"str_until|"
     r"str_upper_case|"
     r"str_snake_case|"
     r"str_sprintf|"
-    r"str_snprintf"
+    r"str_snprintf|"
+    r"value_accuracy_to_string"
     r")\s*\(" + CPP_RE_EOL,
     include=cpp_include,
     exclude=[
         # The definitions themselves
+        "esphome/core/alloc_helpers.h",
+        "esphome/core/alloc_helpers.cpp",
+        # Backward compatibility re-exports (remove before 2026.11.0)
         "esphome/core/helpers.h",
         "esphome/core/helpers.cpp",
+        # Vendored third-party library
+        "esphome/components/http_request/httplib.h",
     ],
 )
 def lint_no_heap_allocating_helpers(fname, match):
@@ -812,6 +825,7 @@ def lint_no_sprintf(fname, match):
         "esphome/components/http_request/httplib.h",
         # Deprecated helpers that return std::string
         "esphome/core/helpers.cpp",
+        "esphome/core/alloc_helpers.cpp",
         # The using declaration itself
         "esphome/core/helpers.h",
         # Test fixtures - not production embedded code

From a5b1f3eece4d1d64e62daaa902259fd87f61f967 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Tue, 21 Apr 2026 04:40:03 +0200
Subject: [PATCH 15/19] [core] Remove pre-sleep socket scan from fast select
 path (#15639)

---
 .../components/socket/bsd_sockets_impl.cpp    | 44 +++++++++----------
 esphome/components/socket/bsd_sockets_impl.h  | 15 +++++--
 .../components/socket/lwip_sockets_impl.cpp   | 44 +++++++++----------
 esphome/components/socket/lwip_sockets_impl.h | 15 +++++--
 esphome/components/socket/socket.h            | 21 +++++++--
 esphome/core/application.cpp                  | 27 +-----------
 esphome/core/application.h                    | 41 ++++++-----------
 7 files changed, 96 insertions(+), 111 deletions(-)

diff --git a/esphome/components/socket/bsd_sockets_impl.cpp b/esphome/components/socket/bsd_sockets_impl.cpp
index aea7c776c6..92691b17ab 100644
--- a/esphome/components/socket/bsd_sockets_impl.cpp
+++ b/esphome/components/socket/bsd_sockets_impl.cpp
@@ -14,38 +14,34 @@ BSDSocketImpl::BSDSocketImpl(int fd, bool monitor_loop) {
   if (!monitor_loop || this->fd_ < 0)
     return;
 #ifdef USE_LWIP_FAST_SELECT
-  // Cache lwip_sock pointer and register for monitoring (hooks callback internally)
-  this->cached_sock_ = esphome_lwip_get_sock(this->fd_);
-  this->loop_monitored_ = App.register_socket(this->cached_sock_);
+  this->cached_sock_ = hook_fd_for_fast_select(this->fd_);
 #else
   this->loop_monitored_ = App.register_socket_fd(this->fd_);
 #endif
 }
 
-BSDSocketImpl::~BSDSocketImpl() {
-  if (!this->closed_) {
-    this->close();
-  }
-}
+BSDSocketImpl::~BSDSocketImpl() { this->close(); }
 
 int BSDSocketImpl::close() {
-  if (!this->closed_) {
-    // Unregister before closing to avoid dangling pointer in monitored set
-#ifdef USE_LWIP_FAST_SELECT
-    if (this->loop_monitored_) {
-      App.unregister_socket(this->cached_sock_);
-      this->cached_sock_ = nullptr;
-    }
-#else
-    if (this->loop_monitored_) {
-      App.unregister_socket_fd(this->fd_);
-    }
-#endif
-    int ret = ::close(this->fd_);
-    this->closed_ = true;
-    return ret;
+  if (this->fd_ < 0) {
+    // Already closed, or never opened.
+    return 0;
   }
-  return 0;
+#ifdef USE_LWIP_FAST_SELECT
+  // Null the cached lwip_sock pointer before closing. The underlying lwip slot can be
+  // recycled for a new connection as soon as ::close() returns, so anything that might
+  // dereference cached_sock_ post-close (e.g. setsockopt(TCP_NODELAY)) would otherwise
+  // touch an unrelated socket's pcb. No per-socket callback unhook is needed —
+  // all LwIP sockets share the same static event_callback.
+  this->cached_sock_ = nullptr;
+#else
+  if (this->loop_monitored_) {
+    App.unregister_socket_fd(this->fd_);
+  }
+#endif
+  int ret = ::close(this->fd_);
+  this->fd_ = -1;  // Sentinel for "closed" — prevents double-close and makes use-after-close visible.
+  return ret;
 }
 
 int BSDSocketImpl::setblocking(bool blocking) {
diff --git a/esphome/components/socket/bsd_sockets_impl.h b/esphome/components/socket/bsd_sockets_impl.h
index e520784702..57c1a430a2 100644
--- a/esphome/components/socket/bsd_sockets_impl.h
+++ b/esphome/components/socket/bsd_sockets_impl.h
@@ -119,12 +119,21 @@ class BSDSocketImpl {
   int get_fd() const { return this->fd_; }
 
  protected:
+  // fd_ < 0 means "not open" — used both pre-open (initial state) and post-close. This
+  // replaces a separate closed_ flag: close() sets fd_ = -1 after ::close(), and the
+  // destructor / double-close path just check fd_ < 0.
   int fd_{-1};
 #ifdef USE_LWIP_FAST_SELECT
-  struct lwip_sock *cached_sock_{nullptr};  // Cached for direct rcvevent read in ready()
-#endif
-  bool closed_{false};
+  // Cached lwip_sock pointer used for direct rcvevent reads in ready() on the
+  // fast-select path. Replaces loop_monitored_: null means this socket is not being
+  // monitored for read events — either monitoring was not requested, the fd was
+  // invalid, or esphome_lwip_get_sock() failed. Non-null means the netconn event
+  // callback was hooked and notifications are flowing. close() nulls this to prevent
+  // use-after-free via a recycled lwip slot.
+  struct lwip_sock *cached_sock_{nullptr};
+#else
   bool loop_monitored_{false};
+#endif
 };
 
 }  // namespace esphome::socket
diff --git a/esphome/components/socket/lwip_sockets_impl.cpp b/esphome/components/socket/lwip_sockets_impl.cpp
index 2fad429e0f..b4eba3febf 100644
--- a/esphome/components/socket/lwip_sockets_impl.cpp
+++ b/esphome/components/socket/lwip_sockets_impl.cpp
@@ -14,38 +14,34 @@ LwIPSocketImpl::LwIPSocketImpl(int fd, bool monitor_loop) {
   if (!monitor_loop || this->fd_ < 0)
     return;
 #ifdef USE_LWIP_FAST_SELECT
-  // Cache lwip_sock pointer and register for monitoring (hooks callback internally)
-  this->cached_sock_ = esphome_lwip_get_sock(this->fd_);
-  this->loop_monitored_ = App.register_socket(this->cached_sock_);
+  this->cached_sock_ = hook_fd_for_fast_select(this->fd_);
 #else
   this->loop_monitored_ = App.register_socket_fd(this->fd_);
 #endif
 }
 
-LwIPSocketImpl::~LwIPSocketImpl() {
-  if (!this->closed_) {
-    this->close();
-  }
-}
+LwIPSocketImpl::~LwIPSocketImpl() { this->close(); }
 
 int LwIPSocketImpl::close() {
-  if (!this->closed_) {
-    // Unregister before closing to avoid dangling pointer in monitored set
-#ifdef USE_LWIP_FAST_SELECT
-    if (this->loop_monitored_) {
-      App.unregister_socket(this->cached_sock_);
-      this->cached_sock_ = nullptr;
-    }
-#else
-    if (this->loop_monitored_) {
-      App.unregister_socket_fd(this->fd_);
-    }
-#endif
-    int ret = lwip_close(this->fd_);
-    this->closed_ = true;
-    return ret;
+  if (this->fd_ < 0) {
+    // Already closed, or never opened.
+    return 0;
   }
-  return 0;
+#ifdef USE_LWIP_FAST_SELECT
+  // Null the cached lwip_sock pointer before closing. The underlying lwip slot can be
+  // recycled for a new connection as soon as lwip_close() returns, so anything that
+  // might dereference cached_sock_ post-close (e.g. setsockopt(TCP_NODELAY)) would
+  // otherwise touch an unrelated socket's pcb. No per-socket callback unhook is needed —
+  // all LwIP sockets share the same static event_callback.
+  this->cached_sock_ = nullptr;
+#else
+  if (this->loop_monitored_) {
+    App.unregister_socket_fd(this->fd_);
+  }
+#endif
+  int ret = lwip_close(this->fd_);
+  this->fd_ = -1;  // Sentinel for "closed" — prevents double-close and makes use-after-close visible.
+  return ret;
 }
 
 int LwIPSocketImpl::setblocking(bool blocking) {
diff --git a/esphome/components/socket/lwip_sockets_impl.h b/esphome/components/socket/lwip_sockets_impl.h
index 942d0ccf85..7f3b706cd8 100644
--- a/esphome/components/socket/lwip_sockets_impl.h
+++ b/esphome/components/socket/lwip_sockets_impl.h
@@ -85,12 +85,21 @@ class LwIPSocketImpl {
   int get_fd() const { return this->fd_; }
 
  protected:
+  // fd_ < 0 means "not open" — used both pre-open (initial state) and post-close. This
+  // replaces a separate closed_ flag: close() sets fd_ = -1 after lwip_close(), and the
+  // destructor / double-close path just check fd_ < 0.
   int fd_{-1};
 #ifdef USE_LWIP_FAST_SELECT
-  struct lwip_sock *cached_sock_{nullptr};  // Cached for direct rcvevent read in ready()
-#endif
-  bool closed_{false};
+  // Cached lwip_sock pointer used for direct rcvevent reads in ready() on the
+  // fast-select path. Replaces loop_monitored_: null means this socket is not being
+  // monitored for read events — either monitoring was not requested, the fd was
+  // invalid, or esphome_lwip_get_sock() failed. Non-null means the netconn event
+  // callback was hooked and notifications are flowing. close() nulls this to prevent
+  // use-after-free via a recycled lwip slot.
+  struct lwip_sock *cached_sock_{nullptr};
+#else
   bool loop_monitored_{false};
+#endif
 };
 
 }  // namespace esphome::socket
diff --git a/esphome/components/socket/socket.h b/esphome/components/socket/socket.h
index ad55e889e8..204113e4b2 100644
--- a/esphome/components/socket/socket.h
+++ b/esphome/components/socket/socket.h
@@ -42,8 +42,23 @@ using ListenSocket = LWIPRawListenImpl;
 
 #ifdef USE_LWIP_FAST_SELECT
 /// Shared ready() helper using cached lwip_sock pointer for direct rcvevent read.
-inline bool socket_ready(struct lwip_sock *cached_sock, bool loop_monitored) {
-  return !loop_monitored || (cached_sock != nullptr && esphome_lwip_socket_has_data(cached_sock));
+/// cached_sock == nullptr means the socket is not monitored (monitor_loop was false, fd
+/// was invalid, or esphome_lwip_get_sock() failed) — in that case return true so the
+/// caller attempts the read and handles blocking itself.
+inline bool socket_ready(struct lwip_sock *cached_sock) {
+  return cached_sock == nullptr || esphome_lwip_socket_has_data(cached_sock);
+}
+
+/// Resolve an fd to its lwip_sock and install the netconn event-callback hook so the
+/// main loop is woken by FreeRTOS task notifications when data arrives. Shared between
+/// BSD and LwIP socket impls on the fast-select path. Returns the cached lwip_sock
+/// pointer (or nullptr if the fd does not map to a valid lwip_sock).
+inline struct lwip_sock *hook_fd_for_fast_select(int fd) {
+  struct lwip_sock *sock = esphome_lwip_get_sock(fd);
+  if (sock != nullptr) {
+    esphome_lwip_hook_socket(sock);
+  }
+  return sock;
 }
 #elif defined(USE_HOST)
 /// Shared ready() helper for fd-based socket implementations.
@@ -69,7 +84,7 @@ bool socket_ready_fd(int fd, bool loop_monitored);
 #if defined(USE_SOCKET_IMPL_BSD_SOCKETS) || defined(USE_SOCKET_IMPL_LWIP_SOCKETS)
 inline bool Socket::ready() const {
 #ifdef USE_LWIP_FAST_SELECT
-  return socket_ready(this->cached_sock_, this->loop_monitored_);
+  return socket_ready(this->cached_sock_);
 #else
   return socket_ready_fd(this->fd_, this->loop_monitored_);
 #endif
diff --git a/esphome/core/application.cpp b/esphome/core/application.cpp
index e5e1b36a65..affee20066 100644
--- a/esphome/core/application.cpp
+++ b/esphome/core/application.cpp
@@ -509,32 +509,7 @@ void Application::enable_pending_loops_() {
   }
 }
 
-#ifdef USE_LWIP_FAST_SELECT
-bool Application::register_socket(struct lwip_sock *sock) {
-  // It modifies monitored_sockets_ without locking — must only be called from the main loop.
-  if (sock == nullptr)
-    return false;
-  esphome_lwip_hook_socket(sock);
-  this->monitored_sockets_.push_back(sock);
-  return true;
-}
-
-void Application::unregister_socket(struct lwip_sock *sock) {
-  // It modifies monitored_sockets_ without locking — must only be called from the main loop.
-  for (size_t i = 0; i < this->monitored_sockets_.size(); i++) {
-    if (this->monitored_sockets_[i] != sock)
-      continue;
-
-    // Swap with last element and pop - O(1) removal since order doesn't matter.
-    // No need to unhook the netconn callback — all LwIP sockets share the same
-    // static event_callback, and the socket will be closed by the caller.
-    if (i < this->monitored_sockets_.size() - 1)
-      this->monitored_sockets_[i] = this->monitored_sockets_.back();
-    this->monitored_sockets_.pop_back();
-    return;
-  }
-}
-#elif defined(USE_HOST)
+#ifdef USE_HOST
 bool Application::register_socket_fd(int fd) {
   // WARNING: This function is NOT thread-safe and must only be called from the main loop
   // It modifies socket_fds_ and related variables without locking
diff --git a/esphome/core/application.h b/esphome/core/application.h
index 645caa2404..a512af9c61 100644
--- a/esphome/core/application.h
+++ b/esphome/core/application.h
@@ -345,16 +345,13 @@ class Application {
 
   Scheduler scheduler;
 
-  /// Register/unregister a socket to be monitored for read events.
-  /// WARNING: These functions are NOT thread-safe. They must only be called from the main loop.
-#ifdef USE_LWIP_FAST_SELECT
-  /// Fast select path: hooks netconn callback and registers for monitoring.
-  /// @return true if registration was successful, false if sock is null
-  bool register_socket(struct lwip_sock *sock);
-  void unregister_socket(struct lwip_sock *sock);
-#elif defined(USE_HOST)
-  /// Fallback select() path: monitors file descriptors.
+#ifdef USE_HOST
+  /// Register/unregister a socket file descriptor with the host select() fallback loop.
+  /// USE_LWIP_FAST_SELECT builds do not use this API — sockets hook the lwIP netconn
+  /// event_callback directly (see socket.h hook_fd_for_fast_select) and rely on FreeRTOS
+  /// task notifications for wake-up.
   /// NOTE: File descriptors >= FD_SETSIZE (typically 10 on ESP) will be rejected with an error.
+  /// WARNING: These functions are NOT thread-safe. They must only be called from the main loop.
   /// @return true if registration was successful, false if fd exceeds limits
   bool register_socket_fd(int fd);
   void unregister_socket_fd(int fd);
@@ -488,9 +485,7 @@ class Application {
   //   and active_end_ is incremented
   // - This eliminates branch mispredictions from flag checking in the hot loop
   FixedVector<Component *> looping_components_{};
-#ifdef USE_LWIP_FAST_SELECT
-  std::vector<struct lwip_sock *> monitored_sockets_;  // Cached lwip_sock pointers for direct rcvevent read
-#elif defined(USE_HOST)
+#ifdef USE_HOST
   std::vector<int> socket_fds_;  // Vector of all monitored socket file descriptors
 #endif
 #ifdef USE_HOST
@@ -705,26 +700,16 @@ inline void ESPHOME_ALWAYS_INLINE Application::loop() {
 #ifndef USE_HOST
 inline void ESPHOME_ALWAYS_INLINE Application::yield_with_select_(uint32_t delay_ms) {
 #ifdef USE_LWIP_FAST_SELECT
-  // Fast path (ESP32/LibreTiny): reads rcvevent directly from cached lwip_sock pointers.
-  // Safe because this runs on the main loop which owns socket lifetime (create, read, close).
+  // Fast path (ESP32/LibreTiny): FreeRTOS task notifications posted by the lwip
+  // event_callback wrapper (see lwip_fast_select.c) are the single source of truth for
+  // socket wake-ups. Every NETCONN_EVT_RCVPLUS posts an xTaskNotifyGive, so any notification
+  // that lands between wakes keeps the counter non-zero (next ulTaskNotifyTake returns
+  // immediately) or wakes a blocked Take directly. Additional wake sources:
+  // wake_loop_threadsafe() from background tasks, and the delay_ms timeout.
   if (delay_ms == 0) [[unlikely]] {
     yield();
     return;
   }
-
-  // Check if any socket already has pending data before sleeping.
-  // If a socket still has unread data (rcvevent > 0) but the task notification was already
-  // consumed, ulTaskNotifyTake would block until timeout — adding up to delay_ms latency.
-  // This scan preserves select() semantics: return immediately when any fd is ready.
-  for (struct lwip_sock *sock : this->monitored_sockets_) {
-    if (esphome_lwip_socket_has_data(sock)) {
-      yield();
-      return;
-    }
-  }
-
-  // Sleep with instant wake via FreeRTOS task notification.
-  // Woken by: callback wrapper (socket data), wake_loop_threadsafe() (background tasks), or timeout.
 #endif
   esphome::internal::wakeable_delay(delay_ms);
 }

From 37608c26560fe0ba7eefad7a0129074e6b7ccc2e Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Tue, 21 Apr 2026 04:40:24 +0200
Subject: [PATCH 16/19] [ltr390] Reduce data polling delay and timeout (#15507)

---
 esphome/components/ltr390/ltr390.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/esphome/components/ltr390/ltr390.cpp b/esphome/components/ltr390/ltr390.cpp
index ba4a7ea5cb..033f31a3d1 100644
--- a/esphome/components/ltr390/ltr390.cpp
+++ b/esphome/components/ltr390/ltr390.cpp
@@ -45,6 +45,7 @@ optional<uint32_t> LTR390Component::read_sensor_data_(LTR390MODE mode) {
   uint8_t buffer[num_bytes];
 
   // Wait until data available
+  constexpr uint32_t max_wait_ms = 25;
   const uint32_t now = millis();
   while (true) {
     std::bitset<8> status = this->reg(LTR390_MAIN_STATUS).get();
@@ -52,12 +53,12 @@ optional<uint32_t> LTR390Component::read_sensor_data_(LTR390MODE mode) {
     if (available)
       break;
 
-    if (millis() - now > 100) {
+    if (millis() - now > max_wait_ms) {
       ESP_LOGW(TAG, "Sensor didn't return any data, aborting");
       return {};
     }
-    ESP_LOGD(TAG, "Waiting for data");
-    delay(2);
+    ESP_LOGV(TAG, "Waiting for data");
+    delay(1);
   }
 
   if (!this->read_bytes(MODEADDRESSES[mode], buffer, num_bytes)) {

From 78875abee4a396b73b36557cbfa58ff5b51b3c1c Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Tue, 21 Apr 2026 04:40:40 +0200
Subject: [PATCH 17/19] [core] Make buf_append_str PROGMEM-aware on ESP8266
 (#15738)

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 esphome/core/helpers.h | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

diff --git a/esphome/core/helpers.h b/esphome/core/helpers.h
index bb164f5034..78476bf596 100644
--- a/esphome/core/helpers.h
+++ b/esphome/core/helpers.h
@@ -1079,7 +1079,33 @@ __attribute__((format(printf, 4, 5))) inline size_t buf_append_printf(char *buf,
 }
 #endif
 
-/// Safely append a string to buffer without format parsing, returning new position (capped at size).
+#ifdef USE_ESP8266
+/// Safely append a PROGMEM string to buffer, returning new position (capped at size).
+/// ESP8266 internal implementation — prefer the `buf_append_str` macro which wraps
+/// literals with `PSTR()` automatically so they stay in flash instead of eating RAM.
+/// @param buf Output buffer
+/// @param size Total buffer size
+/// @param pos Current position in buffer
+/// @param str PROGMEM-resident string to append (must not be null)
+/// @return New position after appending; returns `size` if `pos >= size`, otherwise
+///         returns at most `size - 1` because one byte is reserved for the null terminator
+inline size_t buf_append_str_p(char *buf, size_t size, size_t pos, PGM_P str) {
+  if (pos >= size) {
+    return size;
+  }
+  size_t remaining = size - pos - 1;  // reserve space for null terminator
+  size_t len = strnlen_P(str, remaining);
+  memcpy_P(buf + pos, str, len);
+  pos += len;
+  buf[pos] = '\0';
+  return pos;
+}
+/// Safely append a string to buffer, returning new position (capped at size).
+/// More efficient than buf_append_printf for plain string literals.
+/// On ESP8266 the literal is wrapped with PSTR() so it stays in flash.
+#define buf_append_str(buf, size, pos, str) buf_append_str_p(buf, size, pos, PSTR(str))
+#else
+/// Safely append a string to buffer, returning new position (capped at size).
 /// More efficient than buf_append_printf for plain string literals.
 /// @param buf Output buffer
 /// @param size Total buffer size
@@ -1091,15 +1117,13 @@ inline size_t buf_append_str(char *buf, size_t size, size_t pos, const char *str
     return size;
   }
   size_t remaining = size - pos - 1;  // reserve space for null terminator
-  size_t len = strlen(str);
-  if (len > remaining) {
-    len = remaining;
-  }
+  size_t len = strnlen(str, remaining);
   memcpy(buf + pos, str, len);
   pos += len;
   buf[pos] = '\0';
   return pos;
 }
+#endif
 
 /// Concatenate a name with a separator and suffix using an efficient stack-based approach.
 /// This avoids multiple heap allocations during string construction.

From f05fa45747f2ae8f71928f99b161a8b7f0c5fd0d Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Tue, 21 Apr 2026 04:41:13 +0200
Subject: [PATCH 18/19] [sensor] Specialize `throttle_with_priority` NaN-only
 case (#15823)

---
 esphome/components/sensor/__init__.py | 18 +++++++++++++++---
 esphome/components/sensor/filter.cpp  | 12 ++++++++++++
 esphome/components/sensor/filter.h    | 13 +++++++++++++
 3 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/esphome/components/sensor/__init__.py b/esphome/components/sensor/__init__.py
index b658ff7056..8dcb7165e3 100644
--- a/esphome/components/sensor/__init__.py
+++ b/esphome/components/sensor/__init__.py
@@ -275,6 +275,9 @@ ThrottleFilter = sensor_ns.class_("ThrottleFilter", Filter)
 ThrottleWithPriorityFilter = sensor_ns.class_(
     "ThrottleWithPriorityFilter", ValueListFilter
 )
+ThrottleWithPriorityNanFilter = sensor_ns.class_(
+    "ThrottleWithPriorityNanFilter", Filter
+)
 TimeoutFilterBase = sensor_ns.class_("TimeoutFilterBase", Filter, cg.Component)
 TimeoutFilterLast = sensor_ns.class_("TimeoutFilterLast", TimeoutFilterBase)
 TimeoutFilterConfigured = sensor_ns.class_("TimeoutFilterConfigured", TimeoutFilterBase)
@@ -656,9 +659,18 @@ THROTTLE_WITH_PRIORITY_SCHEMA = cv.maybe_simple_value(
     THROTTLE_WITH_PRIORITY_SCHEMA,
 )
 async def throttle_with_priority_filter_to_code(config, filter_id):
-    if not isinstance(config[CONF_VALUE], list):
-        config[CONF_VALUE] = [config[CONF_VALUE]]
-    template_ = [await cg.templatable(x, [], cg.float_) for x in config[CONF_VALUE]]
+    values = config[CONF_VALUE]
+    if not isinstance(values, list):
+        values = [values]
+    # Specialize the common "NaN-only" case (the schema default when the user
+    # omits `value:`) to avoid the TemplatableFn<float> array + NaN lambda the
+    # generic ValueListFilter path requires. Behavior is identical: NaN sensor
+    # readings always bypass the throttle.
+    if values and all(isinstance(v, float) and math.isnan(v) for v in values):
+        filter_id = filter_id.copy()
+        filter_id.type = ThrottleWithPriorityNanFilter
+        return cg.new_Pvariable(filter_id, config[CONF_TIMEOUT])
+    template_ = [await cg.templatable(x, [], cg.float_) for x in values]
     return cg.new_Pvariable(
         filter_id, cg.TemplateArguments(len(template_)), config[CONF_TIMEOUT], template_
     )
diff --git a/esphome/components/sensor/filter.cpp b/esphome/components/sensor/filter.cpp
index fbac7d3535..4896757d3f 100644
--- a/esphome/components/sensor/filter.cpp
+++ b/esphome/components/sensor/filter.cpp
@@ -269,6 +269,18 @@ optional<float> throttle_with_priority_new_value(Sensor *parent, float value, co
   return {};
 }
 
+// ThrottleWithPriorityNanFilter
+ThrottleWithPriorityNanFilter::ThrottleWithPriorityNanFilter(uint32_t min_time_between_inputs)
+    : min_time_between_inputs_(min_time_between_inputs) {}
+optional<float> ThrottleWithPriorityNanFilter::new_value(float value) {
+  const uint32_t now = App.get_loop_component_start_time();
+  if (this->last_input_ == 0 || now - this->last_input_ >= this->min_time_between_inputs_ || std::isnan(value)) {
+    this->last_input_ = now;
+    return value;
+  }
+  return {};
+}
+
 // DeltaFilter
 DeltaFilter::DeltaFilter(float min_a0, float min_a1, float max_a0, float max_a1)
     : min_a0_(min_a0), min_a1_(min_a1), max_a0_(max_a0), max_a1_(max_a1) {}
diff --git a/esphome/components/sensor/filter.h b/esphome/components/sensor/filter.h
index 0dbbc33ab3..a91d66a8fb 100644
--- a/esphome/components/sensor/filter.h
+++ b/esphome/components/sensor/filter.h
@@ -399,6 +399,19 @@ template<size_t N> class ThrottleWithPriorityFilter : public ValueListFilter<N>
   uint32_t min_time_between_inputs_;
 };
 
+/// Specialization of ThrottleWithPriorityFilter for the common "prioritize NaN"
+/// case: skips the TemplatableFn<float> array + lambda and inlines the check.
+class ThrottleWithPriorityNanFilter : public Filter {
+ public:
+  explicit ThrottleWithPriorityNanFilter(uint32_t min_time_between_inputs);
+
+  optional<float> new_value(float value) override;
+
+ protected:
+  uint32_t last_input_{0};
+  uint32_t min_time_between_inputs_;
+};
+
 // Base class for timeout filters - contains common loop logic
 class TimeoutFilterBase : public Filter, public Component {
  public:

From a8bd035b62b7ab9712e394fafdbdef9cd772bcde Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 04:44:25 +0200
Subject: [PATCH 19/19] Bump CodSpeedHQ/action from 4.13.1 to 4.14.0 (#15880)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6aa5b2a547..20c349ac00 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -339,7 +339,7 @@ jobs:
           echo "binary=$BINARY" >> $GITHUB_OUTPUT
 
       - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@db35df748deb45fdef0960669f57d627c1956c30 # v4
+        uses: CodSpeedHQ/action@658a901452bb54c799643e060733b7afe9121b8d # v4.14.0
         with:
           run: ${{ steps.build.outputs.binary }}
           mode: simulation