From 48a9c1cd67c56ff17ea095f98815e114e8473035 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Sat, 21 Feb 2026 11:12:35 -0600
Subject: [PATCH 01/23] [mqtt] Remove broken ESP8266 ssl_fingerprints option
 (#14182)

---
 esphome/__main__.py                           | 14 ---------
 esphome/components/mqtt/__init__.py           | 21 --------------
 .../components/mqtt/mqtt_backend_esp8266.h    |  5 ----
 .../components/mqtt/mqtt_backend_libretiny.h  |  5 ----
 esphome/components/mqtt/mqtt_client.cpp       |  7 -----
 esphome/components/mqtt/mqtt_client.h         | 15 ----------
 esphome/const.py                              |  1 -
 esphome/mqtt.py                               | 29 ++-----------------
 8 files changed, 2 insertions(+), 95 deletions(-)

diff --git a/esphome/__main__.py b/esphome/__main__.py
index c86b5604e1..488955f503 100644
--- a/esphome/__main__.py
+++ b/esphome/__main__.py
@@ -944,12 +944,6 @@ def command_clean_all(args: ArgsProtocol) -> int | None:
     return 0
 
 
-def command_mqtt_fingerprint(args: ArgsProtocol, config: ConfigType) -> int | None:
-    from esphome import mqtt
-
-    return mqtt.get_fingerprint(config)
-
-
 def command_version(args: ArgsProtocol) -> int | None:
     safe_print(f"Version: {const.__version__}")
     return 0
@@ -1237,7 +1231,6 @@ POST_CONFIG_ACTIONS = {
     "run": command_run,
     "clean": command_clean,
     "clean-mqtt": command_clean_mqtt,
-    "mqtt-fingerprint": command_mqtt_fingerprint,
     "idedata": command_idedata,
     "rename": command_rename,
     "discover": command_discover,
@@ -1451,13 +1444,6 @@ def parse_args(argv):
     )
     parser_wizard.add_argument("configuration", help="Your YAML configuration file.")
 
-    parser_fingerprint = subparsers.add_parser(
-        "mqtt-fingerprint", help="Get the SSL fingerprint from a MQTT broker."
-    )
-    parser_fingerprint.add_argument(
-        "configuration", help="Your YAML configuration file(s).", nargs="+"
-    )
-
     subparsers.add_parser("version", help="Print the ESPHome version and exit.")
 
     parser_clean = subparsers.add_parser(
diff --git a/esphome/components/mqtt/__init__.py b/esphome/components/mqtt/__init__.py
index fe153fedfa..44e8836487 100644
--- a/esphome/components/mqtt/__init__.py
+++ b/esphome/components/mqtt/__init__.py
@@ -1,5 +1,3 @@
-import re
-
 from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
@@ -46,7 +44,6 @@ from esphome.const import (
     CONF_RETAIN,
     CONF_SHUTDOWN_MESSAGE,
     CONF_SKIP_CERT_CN_CHECK,
-    CONF_SSL_FINGERPRINTS,
     CONF_STATE_TOPIC,
     CONF_SUBSCRIBE_QOS,
     CONF_TOPIC,
@@ -221,13 +218,6 @@ def validate_config(value):
     return out
 
 
-def validate_fingerprint(value):
-    value = cv.string(value)
-    if re.match(r"^[0-9a-f]{40}$", value) is None:
-        raise cv.Invalid("fingerprint must be valid SHA1 hash")
-    return value
-
-
 def _consume_mqtt_sockets(config: ConfigType) -> ConfigType:
     """Register socket needs for MQTT component."""
     # MQTT needs 1 socket for the broker connection
@@ -291,9 +281,6 @@ CONFIG_SCHEMA = cv.All(
                 ),
                 validate_message_just_topic,
             ),
-            cv.Optional(CONF_SSL_FINGERPRINTS): cv.All(
-                cv.only_on_esp8266, cv.ensure_list(validate_fingerprint)
-            ),
             cv.Optional(CONF_KEEPALIVE, default="15s"): cv.positive_time_period_seconds,
             cv.Optional(
                 CONF_REBOOT_TIMEOUT, default="15min"
@@ -444,14 +431,6 @@ async def to_code(config):
         if CONF_LEVEL in log_topic:
             cg.add(var.set_log_level(logger.LOG_LEVELS[log_topic[CONF_LEVEL]]))
 
-    if CONF_SSL_FINGERPRINTS in config:
-        for fingerprint in config[CONF_SSL_FINGERPRINTS]:
-            arr = [
-                cg.RawExpression(f"0x{fingerprint[i : i + 2]}") for i in range(0, 40, 2)
-            ]
-            cg.add(var.add_ssl_fingerprint(arr))
-        cg.add_build_flag("-DASYNC_TCP_SSL_ENABLED=1")
-
     cg.add(var.set_keep_alive(config[CONF_KEEPALIVE]))
 
     cg.add(var.set_reboot_timeout(config[CONF_REBOOT_TIMEOUT]))
diff --git a/esphome/components/mqtt/mqtt_backend_esp8266.h b/esphome/components/mqtt/mqtt_backend_esp8266.h
index 470d1e6a8b..0bf5b510a4 100644
--- a/esphome/components/mqtt/mqtt_backend_esp8266.h
+++ b/esphome/components/mqtt/mqtt_backend_esp8266.h
@@ -21,11 +21,6 @@ class MQTTBackendESP8266 final : public MQTTBackend {
   }
   void set_server(network::IPAddress ip, uint16_t port) final { mqtt_client_.setServer(ip, port); }
   void set_server(const char *host, uint16_t port) final { mqtt_client_.setServer(host, port); }
-#if ASYNC_TCP_SSL_ENABLED
-  void set_secure(bool secure) { mqtt_client.setSecure(secure); }
-  void add_server_fingerprint(const uint8_t *fingerprint) { mqtt_client.addServerFingerprint(fingerprint); }
-#endif
-
   void set_on_connect(std::function<on_connect_callback_t> &&callback) final {
     this->mqtt_client_.onConnect(std::move(callback));
   }
diff --git a/esphome/components/mqtt/mqtt_backend_libretiny.h b/esphome/components/mqtt/mqtt_backend_libretiny.h
index 24bf018a90..5fa3406193 100644
--- a/esphome/components/mqtt/mqtt_backend_libretiny.h
+++ b/esphome/components/mqtt/mqtt_backend_libretiny.h
@@ -21,11 +21,6 @@ class MQTTBackendLibreTiny final : public MQTTBackend {
   }
   void set_server(network::IPAddress ip, uint16_t port) final { mqtt_client_.setServer(IPAddress(ip), port); }
   void set_server(const char *host, uint16_t port) final { mqtt_client_.setServer(host, port); }
-#if ASYNC_TCP_SSL_ENABLED
-  void set_secure(bool secure) { mqtt_client.setSecure(secure); }
-  void add_server_fingerprint(const uint8_t *fingerprint) { mqtt_client.addServerFingerprint(fingerprint); }
-#endif
-
   void set_on_connect(std::function<on_connect_callback_t> &&callback) final {
     this->mqtt_client_.onConnect(std::move(callback));
   }
diff --git a/esphome/components/mqtt/mqtt_client.cpp b/esphome/components/mqtt/mqtt_client.cpp
index 90b423c386..2fb094f370 100644
--- a/esphome/components/mqtt/mqtt_client.cpp
+++ b/esphome/components/mqtt/mqtt_client.cpp
@@ -746,13 +746,6 @@ void MQTTClientComponent::set_on_disconnect(mqtt_on_disconnect_callback_t &&call
   this->on_disconnect_.add(std::move(callback_copy));
 }
 
-#if ASYNC_TCP_SSL_ENABLED
-void MQTTClientComponent::add_ssl_fingerprint(const std::array<uint8_t, SHA1_SIZE> &fingerprint) {
-  this->mqtt_backend_.setSecure(true);
-  this->mqtt_backend_.addServerFingerprint(fingerprint.data());
-}
-#endif
-
 MQTTClientComponent *global_mqtt_client = nullptr;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
 
 // MQTTMessageTrigger
diff --git a/esphome/components/mqtt/mqtt_client.h b/esphome/components/mqtt/mqtt_client.h
index 38bc0b4da3..7a51989a10 100644
--- a/esphome/components/mqtt/mqtt_client.h
+++ b/esphome/components/mqtt/mqtt_client.h
@@ -142,21 +142,6 @@ class MQTTClientComponent : public Component
   bool is_discovery_enabled() const;
   bool is_discovery_ip_enabled() const;
 
-#if ASYNC_TCP_SSL_ENABLED
-  /** Add a SSL fingerprint to use for TCP SSL connections to the MQTT broker.
-   *
-   * To use this feature you first have to globally enable the `ASYNC_TCP_SSL_ENABLED` define flag.
-   * This function can be called multiple times and any certificate that matches any of the provided fingerprints
-   * will match. Calling this method will also automatically disable all non-ssl connections.
-   *
-   * @warning This is *not* secure and *not* how SSL is usually done. You'll have to add
-   *          a separate fingerprint for every certificate you use. Additionally, the hashing
-   *          algorithm used here due to the constraints of the MCU, SHA1, is known to be insecure.
-   *
-   * @param fingerprint The SSL fingerprint as a 20 value long std::array.
-   */
-  void add_ssl_fingerprint(const std::array<uint8_t, SHA1_SIZE> &fingerprint);
-#endif
 #ifdef USE_ESP32
   void set_ca_certificate(const char *cert) { this->mqtt_backend_.set_ca_certificate(cert); }
   void set_cl_certificate(const char *cert) { this->mqtt_backend_.set_cl_certificate(cert); }
diff --git a/esphome/const.py b/esphome/const.py
index 7d15964eab..ea8d2b73be 100644
--- a/esphome/const.py
+++ b/esphome/const.py
@@ -943,7 +943,6 @@ CONF_SPI = "spi"
 CONF_SPI_ID = "spi_id"
 CONF_SPIKE_REJECTION = "spike_rejection"
 CONF_SSID = "ssid"
-CONF_SSL_FINGERPRINTS = "ssl_fingerprints"
 CONF_STARTUP_DELAY = "startup_delay"
 CONF_STATE = "state"
 CONF_STATE_CLASS = "state_class"
diff --git a/esphome/mqtt.py b/esphome/mqtt.py
index 042df12d67..cbf78bd3f6 100644
--- a/esphome/mqtt.py
+++ b/esphome/mqtt.py
@@ -1,6 +1,5 @@
 import contextlib
 from datetime import datetime
-import hashlib
 import json
 import logging
 import ssl
@@ -22,14 +21,12 @@ from esphome.const import (
     CONF_PASSWORD,
     CONF_PORT,
     CONF_SKIP_CERT_CN_CHECK,
-    CONF_SSL_FINGERPRINTS,
     CONF_TOPIC,
     CONF_TOPIC_PREFIX,
     CONF_USERNAME,
 )
-from esphome.core import CORE, EsphomeError
+from esphome.core import EsphomeError
 from esphome.helpers import get_int_env, get_str_env
-from esphome.log import AnsiFore, color
 from esphome.types import ConfigType
 from esphome.util import safe_print
 
@@ -102,9 +99,7 @@ def prepare(
     elif username:
         client.username_pw_set(username, password)
 
-    if config[CONF_MQTT].get(CONF_SSL_FINGERPRINTS) or config[CONF_MQTT].get(
-        CONF_CERTIFICATE_AUTHORITY
-    ):
+    if config[CONF_MQTT].get(CONF_CERTIFICATE_AUTHORITY):
         context = ssl.create_default_context(
             cadata=config[CONF_MQTT].get(CONF_CERTIFICATE_AUTHORITY)
         )
@@ -283,23 +278,3 @@ def clear_topic(config, topic, username=None, password=None, client_id=None):
         client.publish(msg.topic, None, retain=True)
 
     return initialize(config, [topic], on_message, None, username, password, client_id)
-
-
-# From marvinroger/async-mqtt-client -> scripts/get-fingerprint/get-fingerprint.py
-def get_fingerprint(config):
-    addr = str(config[CONF_MQTT][CONF_BROKER]), int(config[CONF_MQTT][CONF_PORT])
-    _LOGGER.info("Getting fingerprint from %s:%s", addr[0], addr[1])
-    try:
-        cert_pem = ssl.get_server_certificate(addr)
-    except OSError as err:
-        _LOGGER.error("Unable to connect to server: %s", err)
-        return 1
-    cert_der = ssl.PEM_cert_to_DER_cert(cert_pem)
-
-    sha1 = hashlib.sha1(cert_der).hexdigest()
-
-    safe_print(f"SHA1 Fingerprint: {color(AnsiFore.CYAN, sha1)}")
-    safe_print(
-        f"Copy the string above into mqtt.ssl_fingerprints section of {CORE.config_path}"
-    )
-    return 0

From b5c36140faf58ba8966ad127f5b14670c6a3d2bb Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Thu, 26 Feb 2026 08:40:43 -0500
Subject: [PATCH 02/23] [sprinkler] Fix millis overflow and underflow bugs
 (#14299)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>
---
 esphome/components/sprinkler/sprinkler.cpp | 81 +++++++++++-----------
 esphome/components/sprinkler/sprinkler.h   |  4 +-
 2 files changed, 43 insertions(+), 42 deletions(-)

diff --git a/esphome/components/sprinkler/sprinkler.cpp b/esphome/components/sprinkler/sprinkler.cpp
index 9e423c1760..d82d7baaf6 100644
--- a/esphome/components/sprinkler/sprinkler.cpp
+++ b/esphome/components/sprinkler/sprinkler.cpp
@@ -84,32 +84,30 @@ SprinklerValveOperator::SprinklerValveOperator(SprinklerValve *valve, Sprinkler
     : controller_(controller), valve_(valve) {}
 
 void SprinklerValveOperator::loop() {
+  // Use wrapping subtraction so 32-bit millis() rollover is handled correctly:
+  // (now - start) yields the true elapsed time even across the 49.7-day boundary.
   uint32_t now = App.get_loop_component_start_time();
-  if (now >= this->start_millis_) {  // dummy check
-    switch (this->state_) {
-      case STARTING:
-        if (now > (this->start_millis_ + this->start_delay_)) {
-          this->run_();  // start_delay_ has been exceeded, so ensure both valves are on and update the state
-        }
-        break;
+  switch (this->state_) {
+    case STARTING:
+      if ((now - *this->start_millis_) > this->start_delay_) {
+        this->run_();  // start_delay_ has been exceeded, so ensure both valves are on and update the state
+      }
+      break;
 
-      case ACTIVE:
-        if (now > (this->start_millis_ + this->start_delay_ + this->run_duration_)) {
-          this->stop();  // start_delay_ + run_duration_ has been exceeded, start shutting down
-        }
-        break;
+    case ACTIVE:
+      if ((now - *this->start_millis_) > (this->start_delay_ + this->run_duration_)) {
+        this->stop();  // start_delay_ + run_duration_ has been exceeded, start shutting down
+      }
+      break;
 
-      case STOPPING:
-        if (now > (this->stop_millis_ + this->stop_delay_)) {
-          this->kill_();  // stop_delay_has been exceeded, ensure all valves are off
-        }
-        break;
+    case STOPPING:
+      if ((now - *this->stop_millis_) > this->stop_delay_) {
+        this->kill_();  // stop_delay_has been exceeded, ensure all valves are off
+      }
+      break;
 
-      default:
-        break;
-    }
-  } else {         // perhaps millis() rolled over...or something else is horribly wrong!
-    this->stop();  // bail out (TODO: handle this highly unlikely situation better...)
+    default:
+      break;
   }
 }
 
@@ -124,11 +122,11 @@ void SprinklerValveOperator::set_valve(SprinklerValve *valve) {
     if (this->state_ != IDLE) {  // Only kill if not already idle
       this->kill_();             // ensure everything is off before we let go!
     }
-    this->state_ = IDLE;      // reset state
-    this->run_duration_ = 0;  // reset to ensure the valve isn't started without updating it
-    this->start_millis_ = 0;  // reset because (new) valve has not been started yet
-    this->stop_millis_ = 0;   // reset because (new) valve has not been started yet
-    this->valve_ = valve;     // finally, set the pointer to the new valve
+    this->state_ = IDLE;          // reset state
+    this->run_duration_ = 0;      // reset to ensure the valve isn't started without updating it
+    this->start_millis_.reset();  // reset because (new) valve has not been started yet
+    this->stop_millis_.reset();   // reset because (new) valve has not been started yet
+    this->valve_ = valve;         // finally, set the pointer to the new valve
   }
 }
 
@@ -162,7 +160,7 @@ void SprinklerValveOperator::start() {
   } else {
     this->run_();  // there is no start_delay_, so just start the pump and valve
   }
-  this->stop_millis_ = 0;
+  this->stop_millis_.reset();
   this->start_millis_ = millis();  // save the time the start request was made
 }
 
@@ -189,22 +187,25 @@ void SprinklerValveOperator::stop() {
 uint32_t SprinklerValveOperator::run_duration() { return this->run_duration_ / 1000; }
 
 uint32_t SprinklerValveOperator::time_remaining() {
-  if (this->start_millis_ == 0) {
+  if (!this->start_millis_.has_value()) {
     return this->run_duration();  // hasn't been started yet
   }
 
-  if (this->stop_millis_) {
-    if (this->stop_millis_ - this->start_millis_ >= this->start_delay_ + this->run_duration_) {
+  if (this->stop_millis_.has_value()) {
+    uint32_t elapsed = *this->stop_millis_ - *this->start_millis_;
+    if (elapsed >= this->start_delay_ + this->run_duration_) {
       return 0;  // valve was active for more than its configured duration, so we are done
-    } else {
-      // we're stopped; return time remaining
-      return (this->run_duration_ - (this->stop_millis_ - this->start_millis_)) / 1000;
     }
+    if (elapsed <= this->start_delay_) {
+      return this->run_duration_ / 1000;  // stopped during start delay, full run duration remains
+    }
+    return (this->run_duration_ - (elapsed - this->start_delay_)) / 1000;
   }
 
-  auto completed_millis = this->start_millis_ + this->start_delay_ + this->run_duration_;
-  if (completed_millis > millis()) {
-    return (completed_millis - millis()) / 1000;  // running now
+  uint32_t elapsed = millis() - *this->start_millis_;
+  uint32_t total_duration = this->start_delay_ + this->run_duration_;
+  if (elapsed < total_duration) {
+    return (total_duration - elapsed) / 1000;  // running now
   }
   return 0;  // run completed
 }
@@ -593,7 +594,7 @@ void Sprinkler::set_repeat(optional<uint32_t> repeat) {
   if (this->repeat_number_ == nullptr) {
     return;
   }
-  if (this->repeat_number_->state == repeat.value()) {
+  if (this->repeat_number_->state == repeat.value_or(0)) {
     return;
   }
   auto call = this->repeat_number_->make_call();
@@ -793,7 +794,7 @@ void Sprinkler::start_single_valve(const optional<size_t> valve_number, optional
 void Sprinkler::queue_valve(optional<size_t> valve_number, optional<uint32_t> run_duration) {
   if (valve_number.has_value()) {
     if (this->is_a_valid_valve(valve_number.value()) && (this->queued_valves_.size() < this->max_queue_size_)) {
-      SprinklerQueueItem item{valve_number.value(), run_duration.value()};
+      SprinklerQueueItem item{valve_number.value(), run_duration.value_or(0)};
       this->queued_valves_.insert(this->queued_valves_.begin(), item);
       ESP_LOGD(TAG, "Valve %zu placed into queue with run duration of %" PRIu32 " seconds", valve_number.value_or(0),
                run_duration.value_or(0));
@@ -1080,7 +1081,7 @@ uint32_t Sprinkler::total_cycle_time_enabled_incomplete_valves() {
     }
   }
 
-  if (incomplete_valve_count >= enabled_valve_count) {
+  if (incomplete_valve_count > 0 && incomplete_valve_count >= enabled_valve_count) {
     incomplete_valve_count--;
   }
   if (incomplete_valve_count) {
diff --git a/esphome/components/sprinkler/sprinkler.h b/esphome/components/sprinkler/sprinkler.h
index a3cdef5b1a..2598a5606a 100644
--- a/esphome/components/sprinkler/sprinkler.h
+++ b/esphome/components/sprinkler/sprinkler.h
@@ -141,8 +141,8 @@ class SprinklerValveOperator {
   uint32_t start_delay_{0};
   uint32_t stop_delay_{0};
   uint32_t run_duration_{0};
-  uint64_t start_millis_{0};
-  uint64_t stop_millis_{0};
+  optional<uint32_t> start_millis_{};
+  optional<uint32_t> stop_millis_{};
   Sprinkler *controller_{nullptr};
   SprinklerValve *valve_{nullptr};
   SprinklerState state_{IDLE};

From 97b712da9866f9a1d7ef46a1ea5bf1184fdb41cb Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Thu, 26 Feb 2026 14:48:05 -0500
Subject: [PATCH 03/23] [cc1101] Transition through IDLE in begin_tx/begin_rx
 for reliable state changes (#14321)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 esphome/components/cc1101/cc1101.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/esphome/components/cc1101/cc1101.cpp b/esphome/components/cc1101/cc1101.cpp
index b6973da78d..51aa88b8f7 100644
--- a/esphome/components/cc1101/cc1101.cpp
+++ b/esphome/components/cc1101/cc1101.cpp
@@ -242,6 +242,9 @@ void CC1101Component::begin_tx() {
   if (this->gdo0_pin_ != nullptr) {
     this->gdo0_pin_->pin_mode(gpio::FLAG_OUTPUT);
   }
+  // Transition through IDLE to bypass CCA (Clear Channel Assessment) which can
+  // block TX entry when strobing from RX, and to ensure FS_AUTOCAL calibration
+  this->enter_idle_();
   if (!this->enter_tx_()) {
     ESP_LOGW(TAG, "Failed to enter TX state!");
   }
@@ -252,6 +255,8 @@ void CC1101Component::begin_rx() {
   if (this->gdo0_pin_ != nullptr) {
     this->gdo0_pin_->pin_mode(gpio::FLAG_INPUT);
   }
+  // Transition through IDLE to ensure FS_AUTOCAL calibration occurs
+  this->enter_idle_();
   if (!this->enter_rx_()) {
     ESP_LOGW(TAG, "Failed to enter RX state!");
   }

From 840859ab7cf323bbaa5d1d508c20dfced0d6f3e8 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Fri, 27 Feb 2026 11:17:04 -0500
Subject: [PATCH 04/23] [zigbee] Fix codegen ordering for basic/identify
 attribute lists (#14343)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 esphome/components/zigbee/__init__.py      | 3 ++-
 esphome/components/zigbee/zigbee_zephyr.py | 8 +++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/esphome/components/zigbee/__init__.py b/esphome/components/zigbee/__init__.py
index 7e917a9d70..a327cc2988 100644
--- a/esphome/components/zigbee/__init__.py
+++ b/esphome/components/zigbee/__init__.py
@@ -8,7 +8,7 @@ from esphome.components.zephyr import zephyr_add_pm_static, zephyr_data
 from esphome.components.zephyr.const import KEY_BOOTLOADER
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_INTERNAL, CONF_NAME
-from esphome.core import CORE
+from esphome.core import CORE, CoroPriority, coroutine_with_priority
 from esphome.types import ConfigType
 
 from .const_zephyr import (
@@ -96,6 +96,7 @@ FINAL_VALIDATE_SCHEMA = cv.All(
 )
 
 
+@coroutine_with_priority(CoroPriority.CORE)
 async def to_code(config: ConfigType) -> None:
     cg.add_define("USE_ZIGBEE")
     if CORE.using_zephyr:
diff --git a/esphome/components/zigbee/zigbee_zephyr.py b/esphome/components/zigbee/zigbee_zephyr.py
index 0b6daa9476..a1e6ad3097 100644
--- a/esphome/components/zigbee/zigbee_zephyr.py
+++ b/esphome/components/zigbee/zigbee_zephyr.py
@@ -179,6 +179,13 @@ async def zephyr_to_code(config: ConfigType) -> None:
                 "USE_ZIGBEE_WIPE_ON_BOOT_MAGIC", random.randint(0x000001, 0xFFFFFF)
             )
         cg.add_define("USE_ZIGBEE_WIPE_ON_BOOT")
+
+    # Generate attribute lists before any await that could yield (e.g., build_automation
+    # waiting for variables from other components). If the hub's priority decays while
+    # yielding, deferred entity jobs may add cluster list globals that reference these
+    # attribute lists before they're declared.
+    await _attr_to_code(config)
+
     var = cg.new_Pvariable(config[CONF_ID])
 
     if on_join_config := config.get(CONF_ON_JOIN):
@@ -186,7 +193,6 @@ async def zephyr_to_code(config: ConfigType) -> None:
 
     await cg.register_component(var, config)
 
-    await _attr_to_code(config)
     CORE.add_job(_ctx_to_code, config)
 
 

From 641914cdbe646747437f76b428991d028684222e Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Fri, 27 Feb 2026 17:27:51 -1000
Subject: [PATCH 05/23] [uart] Revert UART0 default pin workarounds (fixed in
 ESP-IDF 5.5.2) (#14363)

---
 .../uart/uart_component_esp_idf.cpp           | 36 +++----------------
 1 file changed, 5 insertions(+), 31 deletions(-)

diff --git a/esphome/components/uart/uart_component_esp_idf.cpp b/esphome/components/uart/uart_component_esp_idf.cpp
index ea7a09fee6..8699d37d7a 100644
--- a/esphome/components/uart/uart_component_esp_idf.cpp
+++ b/esphome/components/uart/uart_component_esp_idf.cpp
@@ -9,7 +9,6 @@
 #include "esphome/core/gpio.h"
 #include "driver/gpio.h"
 #include "soc/gpio_num.h"
-#include "soc/uart_pins.h"
 
 #ifdef USE_LOGGER
 #include "esphome/components/logger/logger.h"
@@ -19,13 +18,6 @@ namespace esphome::uart {
 
 static const char *const TAG = "uart.idf";
 
-/// Check if a pin number matches one of the default UART0 GPIO pins.
-/// These pins may have residual state from the boot console that requires
-/// explicit reset before UART reconfiguration (ESP-IDF issue #17459).
-static constexpr bool is_default_uart0_pin(int8_t pin_num) {
-  return pin_num == U0TXD_GPIO_NUM || pin_num == U0RXD_GPIO_NUM;
-}
-
 uart_config_t IDFUARTComponent::get_config_() {
   uart_parity_t parity = UART_PARITY_DISABLE;
   if (this->parity_ == UART_CONFIG_PARITY_EVEN) {
@@ -149,34 +141,12 @@ void IDFUARTComponent::load_settings(bool dump_config) {
     return;
   }
 
-  int8_t tx = this->tx_pin_ != nullptr ? this->tx_pin_->get_pin() : -1;
-  int8_t rx = this->rx_pin_ != nullptr ? this->rx_pin_->get_pin() : -1;
-  int8_t flow_control = this->flow_control_pin_ != nullptr ? this->flow_control_pin_->get_pin() : -1;
-
-  // Workaround for ESP-IDF issue: https://github.com/espressif/esp-idf/issues/17459
-  // Commit 9ed617fb17 removed gpio_func_sel() calls from uart_set_pin(), which breaks
-  // UART on default UART0 pins that may have residual state from boot console.
-  // Reset these pins before configuring UART to ensure they're in a clean state.
-  if (is_default_uart0_pin(tx)) {
-    gpio_reset_pin(static_cast<gpio_num_t>(tx));
-  }
-  if (is_default_uart0_pin(rx)) {
-    gpio_reset_pin(static_cast<gpio_num_t>(rx));
-  }
-
-  // Setup pins after reset to configure GPIO direction and pull resistors.
-  // For UART0 default pins, setup() must always be called because gpio_reset_pin()
-  // above sets GPIO_MODE_DISABLE which disables the input buffer. Without setup(),
-  // uart_set_pin() on ESP-IDF 5.4.2+ does not re-enable the input buffer for
-  // IOMUX-connected pins, so the RX pin cannot receive data (see issue #10132).
-  // For other pins, only call setup() if pull or open-drain flags are set to avoid
-  // disturbing the default pin state which breaks some external components (#11823).
   auto setup_pin_if_needed = [](InternalGPIOPin *pin) {
     if (!pin) {
       return;
     }
     const auto mask = gpio::Flags::FLAG_OPEN_DRAIN | gpio::Flags::FLAG_PULLUP | gpio::Flags::FLAG_PULLDOWN;
-    if (is_default_uart0_pin(pin->get_pin()) || (pin->get_flags() & mask) != gpio::Flags::FLAG_NONE) {
+    if ((pin->get_flags() & mask) != gpio::Flags::FLAG_NONE) {
       pin->setup();
     }
   };
@@ -186,6 +156,10 @@ void IDFUARTComponent::load_settings(bool dump_config) {
     setup_pin_if_needed(this->tx_pin_);
   }
 
+  int8_t tx = this->tx_pin_ != nullptr ? this->tx_pin_->get_pin() : -1;
+  int8_t rx = this->rx_pin_ != nullptr ? this->rx_pin_->get_pin() : -1;
+  int8_t flow_control = this->flow_control_pin_ != nullptr ? this->flow_control_pin_->get_pin() : -1;
+
   uint32_t invert = 0;
   if (this->tx_pin_ != nullptr && this->tx_pin_->is_inverted()) {
     invert |= UART_SIGNAL_TXD_INV;

From 91250fd46cc27ba1f36830b48ef3d6cb61c69970 Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Sat, 28 Feb 2026 20:37:04 +1100
Subject: [PATCH 06/23] [mipi_dsi] Fix Waveshare P4 7B board config (#14372)

---
 esphome/components/mipi_dsi/models/waveshare.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/esphome/components/mipi_dsi/models/waveshare.py b/esphome/components/mipi_dsi/models/waveshare.py
index bf4f9063bb..61829ca9c1 100644
--- a/esphome/components/mipi_dsi/models/waveshare.py
+++ b/esphome/components/mipi_dsi/models/waveshare.py
@@ -90,8 +90,6 @@ DriverChip(
         (0xE9, 0xC8, 0x10, 0x0A, 0x00, 0x00, 0x80, 0x81, 0x12, 0x31, 0x23, 0x4F, 0x86, 0xA0, 0x00, 0x47, 0x08, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x98, 0x02, 0x8B, 0xAF, 0x46, 0x02, 0x88, 0x88, 0x88, 0x88, 0x88, 0x98, 0x13, 0x8B, 0xAF, 0x57, 0x13, 0x88, 0x88, 0x88, 0x88, 0x88, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00),
         (0xEA, 0x97, 0x0C, 0x09, 0x09, 0x09, 0x78, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x9F, 0x31, 0x8B, 0xA8, 0x31, 0x75, 0x88, 0x88, 0x88, 0x88, 0x88, 0x9F, 0x20, 0x8B, 0xA8, 0x20, 0x64, 0x88, 0x88, 0x88, 0x88, 0x88, 0x23, 0x00, 0x00, 0x02, 0x71, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x80, 0x81, 0x00, 0x00, 0x00, 0x00),
         (0xEF, 0xFF, 0xFF, 0x01),
-        (0x11, 0x00),
-        (0x29, 0x00),
     ],
 )
 
@@ -109,6 +107,7 @@ DriverChip(
     lane_bit_rate="900Mbps",
     no_transform=True,
     color_order="RGB",
+    reset_pin=33,
     initsequence=[
         (0x80, 0x8B),
         (0x81, 0x78),

From c9c99a22e0374d5d47a1fc131ce86384a5c038e2 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Sat, 28 Feb 2026 18:10:53 -0500
Subject: [PATCH 07/23] [core] Defer entity automation codegen to prevent
 sibling ID deadlocks (#14381)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 esphome/components/binary_sensor/__init__.py | 36 +++++++++++--------
 esphome/components/number/__init__.py        | 31 +++++++++-------
 esphome/components/sensor/__init__.py        | 37 +++++++++++---------
 esphome/components/switch/__init__.py        | 16 ++++++---
 esphome/components/text_sensor/__init__.py   | 19 ++++++----
 5 files changed, 83 insertions(+), 56 deletions(-)

diff --git a/esphome/components/binary_sensor/__init__.py b/esphome/components/binary_sensor/__init__.py
index c38d6b78d3..036d78da73 100644
--- a/esphome/components/binary_sensor/__init__.py
+++ b/esphome/components/binary_sensor/__init__.py
@@ -550,21 +550,8 @@ def binary_sensor_schema(
     return _BINARY_SENSOR_SCHEMA.extend(schema)
 
 
-async def setup_binary_sensor_core_(var, config):
-    await setup_entity(var, config, "binary_sensor")
-
-    if (device_class := config.get(CONF_DEVICE_CLASS)) is not None:
-        cg.add(var.set_device_class(device_class))
-    trigger = config.get(CONF_TRIGGER_ON_INITIAL_STATE, False) or config.get(
-        CONF_PUBLISH_INITIAL_STATE, False
-    )
-    cg.add(var.set_trigger_on_initial_state(trigger))
-    if inverted := config.get(CONF_INVERTED):
-        cg.add(var.set_inverted(inverted))
-    if filters_config := config.get(CONF_FILTERS):
-        filters = await cg.build_registry_list(FILTER_REGISTRY, filters_config)
-        cg.add(var.add_filters(filters))
-
+@coroutine_with_priority(CoroPriority.AUTOMATION)
+async def _build_binary_sensor_automations(var, config):
     for conf in config.get(CONF_ON_PRESS, []):
         trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
         await automation.build_automation(trigger, [], conf)
@@ -616,6 +603,25 @@ async def setup_binary_sensor_core_(var, config):
             conf,
         )
 
+
+async def setup_binary_sensor_core_(var, config):
+    await setup_entity(var, config, "binary_sensor")
+
+    if (device_class := config.get(CONF_DEVICE_CLASS)) is not None:
+        cg.add(var.set_device_class(device_class))
+    trigger = config.get(CONF_TRIGGER_ON_INITIAL_STATE, False) or config.get(
+        CONF_PUBLISH_INITIAL_STATE, False
+    )
+    cg.add(var.set_trigger_on_initial_state(trigger))
+    if inverted := config.get(CONF_INVERTED):
+        cg.add(var.set_inverted(inverted))
+    if filters_config := config.get(CONF_FILTERS):
+        cg.add_define("USE_BINARY_SENSOR_FILTER")
+        filters = await cg.build_registry_list(FILTER_REGISTRY, filters_config)
+        cg.add(var.add_filters(filters))
+
+    CORE.add_job(_build_binary_sensor_automations, var, config)
+
     if mqtt_id := config.get(CONF_MQTT_ID):
         mqtt_ = cg.new_Pvariable(mqtt_id, var)
         await mqtt.register_mqtt_component(mqtt_, config)
diff --git a/esphome/components/number/__init__.py b/esphome/components/number/__init__.py
index b23da7799f..d12ec7463b 100644
--- a/esphome/components/number/__init__.py
+++ b/esphome/components/number/__init__.py
@@ -240,6 +240,23 @@ def number_schema(
     return _NUMBER_SCHEMA.extend(schema)
 
 
+@coroutine_with_priority(CoroPriority.AUTOMATION)
+async def _build_number_automations(var, config):
+    for conf in config.get(CONF_ON_VALUE, []):
+        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+        await automation.build_automation(trigger, [(float, "x")], conf)
+    for conf in config.get(CONF_ON_VALUE_RANGE, []):
+        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+        await cg.register_component(trigger, conf)
+        if CONF_ABOVE in conf:
+            template_ = await cg.templatable(conf[CONF_ABOVE], [(float, "x")], float)
+            cg.add(trigger.set_min(template_))
+        if CONF_BELOW in conf:
+            template_ = await cg.templatable(conf[CONF_BELOW], [(float, "x")], float)
+            cg.add(trigger.set_max(template_))
+        await automation.build_automation(trigger, [(float, "x")], conf)
+
+
 async def setup_number_core_(
     var, config, *, min_value: float, max_value: float, step: float
 ):
@@ -254,19 +271,7 @@ async def setup_number_core_(
     if config[CONF_MODE] != NumberMode.NUMBER_MODE_AUTO:
         cg.add(var.traits.set_mode(config[CONF_MODE]))
 
-    for conf in config.get(CONF_ON_VALUE, []):
-        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        await automation.build_automation(trigger, [(float, "x")], conf)
-    for conf in config.get(CONF_ON_VALUE_RANGE, []):
-        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        await cg.register_component(trigger, conf)
-        if CONF_ABOVE in conf:
-            template_ = await cg.templatable(conf[CONF_ABOVE], [(float, "x")], float)
-            cg.add(trigger.set_min(template_))
-        if CONF_BELOW in conf:
-            template_ = await cg.templatable(conf[CONF_BELOW], [(float, "x")], float)
-            cg.add(trigger.set_max(template_))
-        await automation.build_automation(trigger, [(float, "x")], conf)
+    CORE.add_job(_build_number_automations, var, config)
 
     if (unit_of_measurement := config.get(CONF_UNIT_OF_MEASUREMENT)) is not None:
         cg.add(var.traits.set_unit_of_measurement(unit_of_measurement))
diff --git a/esphome/components/sensor/__init__.py b/esphome/components/sensor/__init__.py
index 03784ba76b..1e5f16a81d 100644
--- a/esphome/components/sensor/__init__.py
+++ b/esphome/components/sensor/__init__.py
@@ -888,6 +888,26 @@ async def build_filters(config):
     return await cg.build_registry_list(FILTER_REGISTRY, config)
 
 
+@coroutine_with_priority(CoroPriority.AUTOMATION)
+async def _build_sensor_automations(var, config):
+    for conf in config.get(CONF_ON_VALUE, []):
+        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+        await automation.build_automation(trigger, [(float, "x")], conf)
+    for conf in config.get(CONF_ON_RAW_VALUE, []):
+        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+        await automation.build_automation(trigger, [(float, "x")], conf)
+    for conf in config.get(CONF_ON_VALUE_RANGE, []):
+        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+        await cg.register_component(trigger, conf)
+        if (above := conf.get(CONF_ABOVE)) is not None:
+            template_ = await cg.templatable(above, [(float, "x")], float)
+            cg.add(trigger.set_min(template_))
+        if (below := conf.get(CONF_BELOW)) is not None:
+            template_ = await cg.templatable(below, [(float, "x")], float)
+            cg.add(trigger.set_max(template_))
+        await automation.build_automation(trigger, [(float, "x")], conf)
+
+
 async def setup_sensor_core_(var, config):
     await setup_entity(var, config, "sensor")
 
@@ -906,22 +926,7 @@ async def setup_sensor_core_(var, config):
         filters = await build_filters(config[CONF_FILTERS])
         cg.add(var.set_filters(filters))
 
-    for conf in config.get(CONF_ON_VALUE, []):
-        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        await automation.build_automation(trigger, [(float, "x")], conf)
-    for conf in config.get(CONF_ON_RAW_VALUE, []):
-        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        await automation.build_automation(trigger, [(float, "x")], conf)
-    for conf in config.get(CONF_ON_VALUE_RANGE, []):
-        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        await cg.register_component(trigger, conf)
-        if (above := conf.get(CONF_ABOVE)) is not None:
-            template_ = await cg.templatable(above, [(float, "x")], float)
-            cg.add(trigger.set_min(template_))
-        if (below := conf.get(CONF_BELOW)) is not None:
-            template_ = await cg.templatable(below, [(float, "x")], float)
-            cg.add(trigger.set_max(template_))
-        await automation.build_automation(trigger, [(float, "x")], conf)
+    CORE.add_job(_build_sensor_automations, var, config)
 
     if (mqtt_id := config.get(CONF_MQTT_ID)) is not None:
         mqtt_ = cg.new_Pvariable(mqtt_id, var)
diff --git a/esphome/components/switch/__init__.py b/esphome/components/switch/__init__.py
index 7424d7c92f..cfc5e2b6e8 100644
--- a/esphome/components/switch/__init__.py
+++ b/esphome/components/switch/__init__.py
@@ -141,11 +141,8 @@ def switch_schema(
     return _SWITCH_SCHEMA.extend(schema)
 
 
-async def setup_switch_core_(var, config):
-    await setup_entity(var, config, "switch")
-
-    if (inverted := config.get(CONF_INVERTED)) is not None:
-        cg.add(var.set_inverted(inverted))
+@coroutine_with_priority(CoroPriority.AUTOMATION)
+async def _build_switch_automations(var, config):
     for conf in config.get(CONF_ON_STATE, []):
         trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
         await automation.build_automation(trigger, [(bool, "x")], conf)
@@ -156,6 +153,15 @@ async def setup_switch_core_(var, config):
         trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
         await automation.build_automation(trigger, [], conf)
 
+
+async def setup_switch_core_(var, config):
+    await setup_entity(var, config, "switch")
+
+    if (inverted := config.get(CONF_INVERTED)) is not None:
+        cg.add(var.set_inverted(inverted))
+
+    CORE.add_job(_build_switch_automations, var, config)
+
     if (mqtt_id := config.get(CONF_MQTT_ID)) is not None:
         mqtt_ = cg.new_Pvariable(mqtt_id, var)
         await mqtt.register_mqtt_component(mqtt_, config)
diff --git a/esphome/components/text_sensor/__init__.py b/esphome/components/text_sensor/__init__.py
index 0d22400a8e..58c293e67b 100644
--- a/esphome/components/text_sensor/__init__.py
+++ b/esphome/components/text_sensor/__init__.py
@@ -197,6 +197,17 @@ async def build_filters(config):
     return await cg.build_registry_list(FILTER_REGISTRY, config)
 
 
+@coroutine_with_priority(CoroPriority.AUTOMATION)
+async def _build_text_sensor_automations(var, config):
+    for conf in config.get(CONF_ON_VALUE, []):
+        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+        await automation.build_automation(trigger, [(cg.std_string, "x")], conf)
+
+    for conf in config.get(CONF_ON_RAW_VALUE, []):
+        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+        await automation.build_automation(trigger, [(cg.std_string, "x")], conf)
+
+
 async def setup_text_sensor_core_(var, config):
     await setup_entity(var, config, "text_sensor")
 
@@ -207,13 +218,7 @@ async def setup_text_sensor_core_(var, config):
         filters = await build_filters(config[CONF_FILTERS])
         cg.add(var.set_filters(filters))
 
-    for conf in config.get(CONF_ON_VALUE, []):
-        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        await automation.build_automation(trigger, [(cg.std_string, "x")], conf)
-
-    for conf in config.get(CONF_ON_RAW_VALUE, []):
-        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        await automation.build_automation(trigger, [(cg.std_string, "x")], conf)
+    CORE.add_job(_build_text_sensor_automations, var, config)
 
     if (mqtt_id := config.get(CONF_MQTT_ID)) is not None:
         mqtt_ = cg.new_Pvariable(mqtt_id, var)

From 0ac61cbb9bed23de4b97611a1b78e3e303267201 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Sun, 1 Mar 2026 10:23:10 -1000
Subject: [PATCH 08/23] [improv_serial] Add missing USE_IMPROV_SERIAL define to
 fix WiFi scan filtering (#14359)

---
 esphome/components/improv_serial/__init__.py         | 1 +
 esphome/components/wifi/wifi_component.cpp           | 2 +-
 esphome/components/wifi/wifi_component.h             | 4 ++--
 esphome/components/wifi/wifi_component_esp8266.cpp   | 2 +-
 esphome/components/wifi/wifi_component_esp_idf.cpp   | 2 +-
 esphome/components/wifi/wifi_component_libretiny.cpp | 2 +-
 esphome/components/wifi/wifi_component_pico_w.cpp    | 9 +++++++--
 esphome/core/defines.h                               | 1 +
 8 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/esphome/components/improv_serial/__init__.py b/esphome/components/improv_serial/__init__.py
index 9a2ac2f40f..4266f5b78b 100644
--- a/esphome/components/improv_serial/__init__.py
+++ b/esphome/components/improv_serial/__init__.py
@@ -43,3 +43,4 @@ async def to_code(config):
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await improv_base.setup_improv_core(var, config, "improv_serial")
+    cg.add_define("USE_IMPROV_SERIAL")
diff --git a/esphome/components/wifi/wifi_component.cpp b/esphome/components/wifi/wifi_component.cpp
index 61d05d7635..fbc1e946bb 100644
--- a/esphome/components/wifi/wifi_component.cpp
+++ b/esphome/components/wifi/wifi_component.cpp
@@ -2048,7 +2048,7 @@ bool WiFiComponent::can_proceed() {
 #endif
 
 void WiFiComponent::set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
-bool WiFiComponent::is_connected() {
+bool WiFiComponent::is_connected() const {
   return this->state_ == WIFI_COMPONENT_STATE_STA_CONNECTED &&
          this->wifi_sta_connect_status_() == WiFiSTAConnectStatus::CONNECTED && !this->error_from_callback_;
 }
diff --git a/esphome/components/wifi/wifi_component.h b/esphome/components/wifi/wifi_component.h
index ac28a1bc81..2e285289e7 100644
--- a/esphome/components/wifi/wifi_component.h
+++ b/esphome/components/wifi/wifi_component.h
@@ -430,7 +430,7 @@ class WiFiComponent : public Component {
 
   void set_reboot_timeout(uint32_t reboot_timeout);
 
-  bool is_connected();
+  bool is_connected() const;
 
   void set_power_save_mode(WiFiPowerSaveMode power_save);
   void set_min_auth_mode(WifiMinAuthMode min_auth_mode) { min_auth_mode_ = min_auth_mode; }
@@ -665,7 +665,7 @@ class WiFiComponent : public Component {
   bool wifi_apply_hostname_();
   bool wifi_sta_connect_(const WiFiAP &ap);
   void wifi_pre_setup_();
-  WiFiSTAConnectStatus wifi_sta_connect_status_();
+  WiFiSTAConnectStatus wifi_sta_connect_status_() const;
   bool wifi_scan_start_(bool passive);
 
 #ifdef USE_WIFI_AP
diff --git a/esphome/components/wifi/wifi_component_esp8266.cpp b/esphome/components/wifi/wifi_component_esp8266.cpp
index cbf7d7d80f..7fe090c45c 100644
--- a/esphome/components/wifi/wifi_component_esp8266.cpp
+++ b/esphome/components/wifi/wifi_component_esp8266.cpp
@@ -626,7 +626,7 @@ void WiFiComponent::wifi_pre_setup_() {
   this->wifi_mode_(false, false);
 }
 
-WiFiSTAConnectStatus WiFiComponent::wifi_sta_connect_status_() {
+WiFiSTAConnectStatus WiFiComponent::wifi_sta_connect_status_() const {
   station_status_t status = wifi_station_get_connect_status();
   if (status == STATION_GOT_IP)
     return WiFiSTAConnectStatus::CONNECTED;
diff --git a/esphome/components/wifi/wifi_component_esp_idf.cpp b/esphome/components/wifi/wifi_component_esp_idf.cpp
index 52ee482121..f594c13afe 100644
--- a/esphome/components/wifi/wifi_component_esp_idf.cpp
+++ b/esphome/components/wifi/wifi_component_esp_idf.cpp
@@ -914,7 +914,7 @@ void WiFiComponent::wifi_process_event_(IDFWiFiEvent *data) {
   }
 }
 
-WiFiSTAConnectStatus WiFiComponent::wifi_sta_connect_status_() {
+WiFiSTAConnectStatus WiFiComponent::wifi_sta_connect_status_() const {
   if (s_sta_connected && this->got_ipv4_address_) {
 #if USE_NETWORK_IPV6 && (USE_NETWORK_MIN_IPV6_ADDR_COUNT > 0)
     if (this->num_ipv6_addresses_ >= USE_NETWORK_MIN_IPV6_ADDR_COUNT) {
diff --git a/esphome/components/wifi/wifi_component_libretiny.cpp b/esphome/components/wifi/wifi_component_libretiny.cpp
index 2cc05928af..71cc419107 100644
--- a/esphome/components/wifi/wifi_component_libretiny.cpp
+++ b/esphome/components/wifi/wifi_component_libretiny.cpp
@@ -621,7 +621,7 @@ void WiFiComponent::wifi_pre_setup_() {
   // Make sure WiFi is in clean state before anything starts
   this->wifi_mode_(false, false);
 }
-WiFiSTAConnectStatus WiFiComponent::wifi_sta_connect_status_() {
+WiFiSTAConnectStatus WiFiComponent::wifi_sta_connect_status_() const {
   // Use state machine instead of querying WiFi.status() directly
   // State is updated in main loop from queued events, ensuring thread safety
   switch (s_sta_state) {
diff --git a/esphome/components/wifi/wifi_component_pico_w.cpp b/esphome/components/wifi/wifi_component_pico_w.cpp
index 1baf21e2b2..7a93de5728 100644
--- a/esphome/components/wifi/wifi_component_pico_w.cpp
+++ b/esphome/components/wifi/wifi_component_pico_w.cpp
@@ -115,8 +115,13 @@ const char *get_disconnect_reason_str(uint8_t reason) {
   return "UNKNOWN";
 }
 
-WiFiSTAConnectStatus WiFiComponent::wifi_sta_connect_status_() {
-  int status = cyw43_tcpip_link_status(&cyw43_state, CYW43_ITF_STA);
+WiFiSTAConnectStatus WiFiComponent::wifi_sta_connect_status_() const {
+  // Use cyw43_wifi_link_status instead of cyw43_tcpip_link_status because the Arduino
+  // framework's __wrap_cyw43_cb_tcpip_init is a no-op — the SDK's internal netif
+  // (cyw43_state.netif[]) is never initialized. cyw43_tcpip_link_status checks that netif's
+  // flags and would only fall through to cyw43_wifi_link_status when the flags aren't set.
+  // Using cyw43_wifi_link_status directly gives us the actual WiFi radio join state.
+  int status = cyw43_wifi_link_status(&cyw43_state, CYW43_ITF_STA);
   switch (status) {
     case CYW43_LINK_JOIN:
     case CYW43_LINK_NOIP:
diff --git a/esphome/core/defines.h b/esphome/core/defines.h
index bfa33e4e59..e7d5caf7c2 100644
--- a/esphome/core/defines.h
+++ b/esphome/core/defines.h
@@ -52,6 +52,7 @@
 #define USE_HOMEASSISTANT_TIME
 #define USE_HTTP_REQUEST_OTA_WATCHDOG_TIMEOUT 8000  // NOLINT
 #define USE_IMAGE
+#define USE_IMPROV_SERIAL
 #define USE_IMPROV_SERIAL_NEXT_URL
 #define USE_INFRARED
 #define USE_IR_RF

From d2a819eb77c966dc2d4675c49a7023ffa40d80a1 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Mon, 2 Mar 2026 14:52:06 -0500
Subject: [PATCH 09/23] [uart] Fix flow_control_pin inverted flag ignored on
 ESP-IDF (#14410)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
---
 esphome/components/uart/uart_component_esp_idf.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/esphome/components/uart/uart_component_esp_idf.cpp b/esphome/components/uart/uart_component_esp_idf.cpp
index 8699d37d7a..7e34f835cd 100644
--- a/esphome/components/uart/uart_component_esp_idf.cpp
+++ b/esphome/components/uart/uart_component_esp_idf.cpp
@@ -167,6 +167,9 @@ void IDFUARTComponent::load_settings(bool dump_config) {
   if (this->rx_pin_ != nullptr && this->rx_pin_->is_inverted()) {
     invert |= UART_SIGNAL_RXD_INV;
   }
+  if (this->flow_control_pin_ != nullptr && this->flow_control_pin_->is_inverted()) {
+    invert |= UART_SIGNAL_RTS_INV;
+  }
 
   err = uart_set_line_inverse(this->uart_num_, invert);
   if (err != ESP_OK) {

From dc56cd1d1fc39c2ca0beb5bfb8b0e19b8e4ff4a1 Mon Sep 17 00:00:00 2001
From: Jesse Hills <3060199+jesserockz@users.noreply.github.com>
Date: Tue, 3 Mar 2026 08:57:52 +1300
Subject: [PATCH 10/23] Bump version to 2026.2.3

---
 Doxyfile         | 2 +-
 esphome/const.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doxyfile b/Doxyfile
index 2de0460ef1..5f351c1bbb 100644
--- a/Doxyfile
+++ b/Doxyfile
@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.2.2
+PROJECT_NUMBER         = 2026.2.3
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
diff --git a/esphome/const.py b/esphome/const.py
index ea8d2b73be..aaa34b2fd1 100644
--- a/esphome/const.py
+++ b/esphome/const.py
@@ -4,7 +4,7 @@ from enum import Enum
 
 from esphome.enum import StrEnum
 
-__version__ = "2026.2.2"
+__version__ = "2026.2.3"
 
 ALLOWED_NAME_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789-_"
 VALID_SUBSTITUTIONS_CHARACTERS = (

From d1de50c0e513431943607f678fc3f661aa605dd0 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Mon, 2 Mar 2026 11:11:04 -1000
Subject: [PATCH 11/23] [core] Add ESP8266 support to wake_loop_any_context()
 (#14392)

---
 esphome/components/socket/lwip_raw_tcp_impl.cpp |  2 +-
 esphome/components/socket/socket.h              |  5 +++--
 esphome/core/application.h                      | 12 +++++++++++-
 esphome/core/component.cpp                      |  9 +++++----
 4 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/esphome/components/socket/lwip_raw_tcp_impl.cpp b/esphome/components/socket/lwip_raw_tcp_impl.cpp
index 430356592f..d697bd47a5 100644
--- a/esphome/components/socket/lwip_raw_tcp_impl.cpp
+++ b/esphome/components/socket/lwip_raw_tcp_impl.cpp
@@ -36,7 +36,7 @@ void socket_delay(uint32_t ms) {
   esp_delay(ms, []() { return !s_socket_woke; });
 }
 
-void socket_wake() {
+void IRAM_ATTR socket_wake() {
   s_socket_woke = true;
   esp_schedule();
 }
diff --git a/esphome/components/socket/socket.h b/esphome/components/socket/socket.h
index 86a4f0cba9..546d278260 100644
--- a/esphome/components/socket/socket.h
+++ b/esphome/components/socket/socket.h
@@ -86,8 +86,9 @@ size_t format_sockaddr_to(const struct sockaddr *addr_ptr, socklen_t len, std::s
 /// On ESP8266, lwip callbacks set a flag and call esp_schedule() to wake the delay.
 void socket_delay(uint32_t ms);
 
-/// Called by lwip callbacks to signal socket activity and wake delay.
-void socket_wake();
+/// Signal socket/IO activity and wake the main loop from esp_delay() early.
+/// ISR-safe: uses IRAM_ATTR internally and only sets a volatile flag + esp_schedule().
+void socket_wake();  // NOLINT(readability-redundant-declaration)
 #endif
 
 }  // namespace esphome::socket
diff --git a/esphome/core/application.h b/esphome/core/application.h
index 13fd0180ab..63d59c555e 100644
--- a/esphome/core/application.h
+++ b/esphome/core/application.h
@@ -34,7 +34,11 @@
 #endif
 #endif
 #endif  // USE_SOCKET_SELECT_SUPPORT
-
+#if defined(USE_ESP8266) && defined(USE_SOCKET_IMPL_LWIP_TCP)
+namespace esphome::socket {
+void socket_wake();  // NOLINT(readability-redundant-declaration)
+}  // namespace esphome::socket
+#endif
 #ifdef USE_BINARY_SENSOR
 #include "esphome/components/binary_sensor/binary_sensor.h"
 #endif
@@ -530,6 +534,12 @@ class Application {
 #endif
 #endif
 
+#if defined(USE_ESP8266) && defined(USE_SOCKET_IMPL_LWIP_TCP)
+  /// Wake the main event loop from any context (ISR, thread, or main loop).
+  /// On ESP8266: sets the socket wake flag and calls esp_schedule() to exit esp_delay() early.
+  static void IRAM_ATTR wake_loop_any_context() { socket::socket_wake(); }
+#endif
+
  protected:
   friend Component;
 #ifdef USE_SOCKET_SELECT_SUPPORT
diff --git a/esphome/core/component.cpp b/esphome/core/component.cpp
index a71aa8b3a3..53cb50a44c 100644
--- a/esphome/core/component.cpp
+++ b/esphome/core/component.cpp
@@ -323,10 +323,11 @@ void IRAM_ATTR HOT Component::enable_loop_soon_any_context() {
   // 8. Race condition with main loop is handled by clearing flag before processing
   this->pending_enable_loop_ = true;
   App.has_pending_enable_loop_requests_ = true;
-#if defined(USE_LWIP_FAST_SELECT) && defined(USE_ESP32)
-  // Wake the main loop if sleeping in ulTaskNotifyTake(). Without this,
-  // the main loop would not wake until the select timeout expires (~16ms).
-  // Uses xPortInIsrContext() to choose the correct FreeRTOS notify API.
+#if (defined(USE_LWIP_FAST_SELECT) && defined(USE_ESP32)) || (defined(USE_ESP8266) && defined(USE_SOCKET_IMPL_LWIP_TCP))
+  // Wake the main loop from sleep. Without this, the main loop would not
+  // wake until the select/delay timeout expires (~16ms).
+  // ESP32: uses xPortInIsrContext() to choose the correct FreeRTOS notify API.
+  // ESP8266: sets socket wake flag and calls esp_schedule() to exit esp_delay() early.
   Application::wake_loop_any_context();
 #endif
 }

From 3615a7b90c13f2bb100d5ea3241795aec5c7512b Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Mon, 2 Mar 2026 11:42:25 -1000
Subject: [PATCH 12/23] [core] Eliminate __udivdi3 in millis() on ESP32 and
 RP2040 (#14409)

---
 esphome/components/esp32/core.cpp             |  4 +-
 esphome/components/rp2040/core.cpp            |  4 +-
 esphome/core/helpers.h                        | 38 ++++++++++++
 .../fixtures/micros_to_millis.yaml            | 61 +++++++++++++++++++
 tests/integration/test_micros_to_millis.py    | 46 ++++++++++++++
 5 files changed, 149 insertions(+), 4 deletions(-)
 create mode 100644 tests/integration/fixtures/micros_to_millis.yaml
 create mode 100644 tests/integration/test_micros_to_millis.py

diff --git a/esphome/components/esp32/core.cpp b/esphome/components/esp32/core.cpp
index 59b791da40..7ebbba609e 100644
--- a/esphome/components/esp32/core.cpp
+++ b/esphome/components/esp32/core.cpp
@@ -22,8 +22,8 @@ extern "C" __attribute__((weak)) void initArduino() {}
 namespace esphome {
 
 void HOT yield() { vPortYield(); }
-uint32_t IRAM_ATTR HOT millis() { return (uint32_t) (esp_timer_get_time() / 1000ULL); }
-uint64_t HOT millis_64() { return static_cast<uint64_t>(esp_timer_get_time()) / 1000ULL; }
+uint32_t IRAM_ATTR HOT millis() { return micros_to_millis(static_cast<uint64_t>(esp_timer_get_time())); }
+uint64_t HOT millis_64() { return micros_to_millis<uint64_t>(static_cast<uint64_t>(esp_timer_get_time())); }
 void HOT delay(uint32_t ms) { vTaskDelay(ms / portTICK_PERIOD_MS); }
 uint32_t IRAM_ATTR HOT micros() { return (uint32_t) esp_timer_get_time(); }
 void IRAM_ATTR HOT delayMicroseconds(uint32_t us) { delay_microseconds_safe(us); }
diff --git a/esphome/components/rp2040/core.cpp b/esphome/components/rp2040/core.cpp
index 6386d53292..a15ee7e263 100644
--- a/esphome/components/rp2040/core.cpp
+++ b/esphome/components/rp2040/core.cpp
@@ -11,8 +11,8 @@
 namespace esphome {
 
 void HOT yield() { ::yield(); }
-uint64_t millis_64() { return time_us_64() / 1000ULL; }
-uint32_t HOT millis() { return static_cast<uint32_t>(millis_64()); }
+uint64_t millis_64() { return micros_to_millis<uint64_t>(time_us_64()); }
+uint32_t HOT millis() { return micros_to_millis(time_us_64()); }
 void HOT delay(uint32_t ms) { ::delay(ms); }
 uint32_t HOT micros() { return ::micros(); }
 void HOT delayMicroseconds(uint32_t us) { delay_microseconds_safe(us); }
diff --git a/esphome/core/helpers.h b/esphome/core/helpers.h
index c68cb549bb..ae505a2d8a 100644
--- a/esphome/core/helpers.h
+++ b/esphome/core/helpers.h
@@ -599,6 +599,44 @@ template<std::integral T> constexpr uint32_t fnv1a_hash_extend(uint32_t hash, T
 constexpr uint32_t fnv1a_hash(const char *str) { return fnv1a_hash_extend(FNV1_OFFSET_BASIS, str); }
 inline uint32_t fnv1a_hash(const std::string &str) { return fnv1a_hash(str.c_str()); }
 
+/// Convert a 64-bit microsecond count to milliseconds without calling
+/// __udivdi3 (software 64-bit divide, ~1200 ns on Xtensa @ 240 MHz).
+///
+/// Returns uint32_t by default (for millis()), or uint64_t when requested
+/// (for millis_64()). The only difference is whether hi * Q is truncated
+/// to 32 bits or widened to 64.
+///
+/// On 32-bit targets, GCC does not optimize 64-bit constant division into a
+/// multiply-by-reciprocal. Since 1000 = 8 * 125, we first right-shift by 3
+/// (free divide-by-8), then use the Euclidean division identity to decompose
+/// the remaining 64-bit divide-by-125 into a single 32-bit division:
+///
+///   floor(us / 1000) = floor(floor(us / 8) / 125)    [exact for integers]
+///   2^32 = Q * 125 + R  (34359738 * 125 + 46)
+///   (hi * 2^32 + lo) / 125 = hi * Q + (hi * R + lo) / 125
+///
+/// GCC optimizes the remaining 32-bit "/ 125U" into a multiply-by-reciprocal
+/// (mulhu + shift), so no division instruction is emitted.
+///
+/// Safe for us up to ~3.2e18 (~101,700 years of microseconds).
+///
+/// See: https://en.wikipedia.org/wiki/Euclidean_division
+/// See: https://ridiculousfish.com/blog/posts/labor-of-division-episode-iii.html
+template<typename ReturnT = uint32_t> inline constexpr ESPHOME_ALWAYS_INLINE ReturnT micros_to_millis(uint64_t us) {
+  constexpr uint32_t d = 125U;
+  constexpr uint32_t q = static_cast<uint32_t>((1ULL << 32) / d);  // 34359738
+  constexpr uint32_t r = static_cast<uint32_t>((1ULL << 32) % d);  // 46
+  // 1000 = 8 * 125; divide-by-8 is a free shift
+  uint64_t x = us >> 3;
+  uint32_t lo = static_cast<uint32_t>(x);
+  uint32_t hi = static_cast<uint32_t>(x >> 32);
+  // Combine remainder term: hi * (2^32 % 125) + lo
+  uint32_t adj = hi * r + lo;
+  // If adj overflowed, the true value is 2^32 + adj; apply the identity again
+  // static_cast<ReturnT>(hi) widens to 64-bit when ReturnT=uint64_t, preserving upper bits of hi*q
+  return static_cast<ReturnT>(hi) * q + (adj < lo ? (adj + r) / d + q : adj / d);
+}
+
 /// Return a random 32-bit unsigned integer.
 uint32_t random_uint32();
 /// Return a random float between 0 and 1.
diff --git a/tests/integration/fixtures/micros_to_millis.yaml b/tests/integration/fixtures/micros_to_millis.yaml
new file mode 100644
index 0000000000..d11808c43a
--- /dev/null
+++ b/tests/integration/fixtures/micros_to_millis.yaml
@@ -0,0 +1,61 @@
+esphome:
+  name: micros-to-millis-test
+  platformio_options:
+    build_flags:
+      - "-DDEBUG"
+  on_boot:
+    - lambda: |-
+        using esphome::micros_to_millis;
+        const char *TAG = "MTM";
+        int pass = 0, fail = 0;
+
+        auto check = [&](const char *name, uint64_t us) {
+          uint32_t got = micros_to_millis(us);
+          uint32_t want = (uint32_t)(us / 1000ULL);
+          if (got == want) { pass++; }
+          else { ESP_LOGE(TAG, "%s FAILED: got=%u want=%u", name, got, want); fail++; }
+        };
+
+        // Basic values
+        check("zero", 0);
+        check("below_1ms", 999);
+        check("exactly_1ms", 1000);
+        check("above_1ms", 1001);
+
+        // Shift boundary (1000 = 8 * 125, exercises the >>3 shift)
+        check("shift_7999", 7999);
+        check("shift_8000", 8000);
+        check("shift_8001", 8001);
+
+        // 32-bit boundary
+        check("u32max_minus1", 0xFFFFFFFEULL);
+        check("u32max", 0xFFFFFFFFULL);
+        check("u32max_plus1", 0x100000000ULL);
+
+        // Realistic uptimes
+        check("30_days", 2592000000000ULL);
+        check("1_year", 31536000000000ULL);
+
+        // Carry path: construct x = us>>3 with specific hi/lo that trigger adj overflow
+        { uint64_t x = (603ULL << 32) | 0xFFFFFFFFU; check("carry_603", x << 3); }
+        { uint64_t x = (5000ULL << 32) | 0xFFFFFFFFU; check("carry_5000", x << 3); }
+
+        // Carry boundary: exact transition where adj overflows (hi=1000, R=46)
+        {
+          uint32_t hi = 1000;
+          uint32_t thr = 0xFFFFFFFFU - hi * 46U;
+          uint64_t h = (uint64_t)hi << 32;
+          check("carry_before", (h | (thr - 1)) << 3);
+          check("carry_at", (h | thr) << 3);
+          check("carry_after", (h | (thr + 1)) << 3);
+        }
+
+        // Mod-8 variations (exercises the >>3 truncation)
+        for (int i = 0; i < 8; i++) { check("mod8", 2592000000000ULL + i); }
+
+        if (fail == 0) { ESP_LOGI(TAG, "ALL_PASSED %d tests", pass); }
+        else { ESP_LOGE(TAG, "%d FAILED out of %d", fail, pass + fail); }
+
+host:
+api:
+logger:
diff --git a/tests/integration/test_micros_to_millis.py b/tests/integration/test_micros_to_millis.py
new file mode 100644
index 0000000000..9960d6b017
--- /dev/null
+++ b/tests/integration/test_micros_to_millis.py
@@ -0,0 +1,46 @@
+"""Integration test for micros_to_millis Euclidean decomposition."""
+
+from __future__ import annotations
+
+import asyncio
+import re
+
+import pytest
+
+from .types import APIClientConnectedFactory, RunCompiledFunction
+
+
+@pytest.mark.asyncio
+async def test_micros_to_millis(
+    yaml_config: str,
+    run_compiled: RunCompiledFunction,
+    api_client_connected: APIClientConnectedFactory,
+) -> None:
+    """Test that micros_to_millis matches reference uint64 division."""
+
+    all_passed = asyncio.Event()
+    failures: list[str] = []
+
+    def on_log_line(line: str) -> None:
+        clean_line = re.sub(r"\x1b\[[0-9;]*m", "", line)
+        if "ALL_PASSED" in clean_line:
+            all_passed.set()
+        elif "FAILED" in clean_line and "[MTM" in clean_line:
+            failures.append(clean_line)
+
+    async with (
+        run_compiled(yaml_config, line_callback=on_log_line),
+        api_client_connected() as client,
+    ):
+        device_info = await client.device_info()
+        assert device_info is not None
+        assert device_info.name == "micros-to-millis-test"
+
+        try:
+            await asyncio.wait_for(all_passed.wait(), timeout=2.0)
+        except TimeoutError:
+            if failures:
+                pytest.fail(f"micros_to_millis failures: {failures}")
+            pytest.fail("micros_to_millis test timed out")
+
+        assert not failures, f"micros_to_millis failures: {failures}"

From 5510b45f3bfa45e3204de607e0a3815b42623606 Mon Sep 17 00:00:00 2001
From: Lino Schmidt <72667500+LinoSchmidt@users.noreply.github.com>
Date: Mon, 2 Mar 2026 22:43:06 +0100
Subject: [PATCH 13/23] [const] Move CONF_WATCHDOG (#14415)

---
 esphome/components/as5600/__init__.py        | 2 +-
 esphome/components/as5600/sensor/__init__.py | 1 -
 esphome/const.py                             | 1 +
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/esphome/components/as5600/__init__.py b/esphome/components/as5600/__init__.py
index acb1c4d9db..b141329e94 100644
--- a/esphome/components/as5600/__init__.py
+++ b/esphome/components/as5600/__init__.py
@@ -9,6 +9,7 @@ from esphome.const import (
     CONF_ID,
     CONF_POWER_MODE,
     CONF_RANGE,
+    CONF_WATCHDOG,
 )
 
 CODEOWNERS = ["@ammmze"]
@@ -57,7 +58,6 @@ FAST_FILTER = {
 
 CONF_RAW_ANGLE = "raw_angle"
 CONF_RAW_POSITION = "raw_position"
-CONF_WATCHDOG = "watchdog"
 CONF_SLOW_FILTER = "slow_filter"
 CONF_FAST_FILTER = "fast_filter"
 CONF_START_POSITION = "start_position"
diff --git a/esphome/components/as5600/sensor/__init__.py b/esphome/components/as5600/sensor/__init__.py
index 1491852e07..e84733a484 100644
--- a/esphome/components/as5600/sensor/__init__.py
+++ b/esphome/components/as5600/sensor/__init__.py
@@ -23,7 +23,6 @@ AS5600Sensor = as5600_ns.class_("AS5600Sensor", sensor.Sensor, cg.PollingCompone
 
 CONF_RAW_ANGLE = "raw_angle"
 CONF_RAW_POSITION = "raw_position"
-CONF_WATCHDOG = "watchdog"
 CONF_SLOW_FILTER = "slow_filter"
 CONF_FAST_FILTER = "fast_filter"
 CONF_PWM_FREQUENCY = "pwm_frequency"
diff --git a/esphome/const.py b/esphome/const.py
index 7262a106d8..bbd85ca66b 100644
--- a/esphome/const.py
+++ b/esphome/const.py
@@ -1094,6 +1094,7 @@ CONF_WAND_ID = "wand_id"
 CONF_WARM_WHITE = "warm_white"
 CONF_WARM_WHITE_COLOR_TEMPERATURE = "warm_white_color_temperature"
 CONF_WARMUP_TIME = "warmup_time"
+CONF_WATCHDOG = "watchdog"
 CONF_WATCHDOG_THRESHOLD = "watchdog_threshold"
 CONF_WATCHDOG_TIMEOUT = "watchdog_timeout"
 CONF_WATER_HEATER = "water_heater"

From 727fa073777cb758dd580fd9ea31a664fc58133f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Mar 2026 11:44:53 -1000
Subject: [PATCH 14/23] Bump github/codeql-action from 4.32.4 to 4.32.5
 (#14416)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 5d7c32eaa9..4bd018b5c9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -58,7 +58,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -86,6 +86,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
         with:
           category: "/language:${{matrix.language}}"

From 2e623fd6c3f83870ddeac768b855cbf3ba51e517 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Mon, 2 Mar 2026 11:48:50 -1000
Subject: [PATCH 15/23] [tests] Fix flaky log assertion race in oversized
 payload tests (#14414)

---
 tests/integration/test_oversized_payloads.py | 69 ++++++++++++--------
 1 file changed, 41 insertions(+), 28 deletions(-)

diff --git a/tests/integration/test_oversized_payloads.py b/tests/integration/test_oversized_payloads.py
index 8bf890261a..be488347aa 100644
--- a/tests/integration/test_oversized_payloads.py
+++ b/tests/integration/test_oversized_payloads.py
@@ -17,10 +17,10 @@ async def test_oversized_payload_plaintext(
 ) -> None:
     """Test that oversized payloads (>32768 bytes) from client cause disconnection without crashing."""
     process_exited = False
-    helper_log_found = False
+    helper_log_event = asyncio.Event()
 
     def check_logs(line: str) -> None:
-        nonlocal process_exited, helper_log_found
+        nonlocal process_exited
         # Check for signs that the process exited/crashed
         if "Segmentation fault" in line or "core dumped" in line:
             process_exited = True
@@ -30,7 +30,7 @@ async def test_oversized_payload_plaintext(
             and "Bad packet: message size" in line
             and "exceeds maximum" in line
         ):
-            helper_log_found = True
+            helper_log_event.set()
 
     async with run_compiled(yaml_config, line_callback=check_logs):
         async with api_client_connected_with_disconnect() as (client, disconnect_event):
@@ -54,10 +54,13 @@ async def test_oversized_payload_plaintext(
 
         # After disconnection, verify process didn't crash
         assert not process_exited, "ESPHome process should not crash"
-        # Verify we saw the expected HELPER_LOG message
-        assert helper_log_found, (
-            "Expected to see HELPER_LOG about message size exceeding maximum"
-        )
+        # Wait for the expected log message (may arrive after disconnect event)
+        try:
+            await asyncio.wait_for(helper_log_event.wait(), timeout=2.0)
+        except TimeoutError:
+            pytest.fail(
+                "Expected to see HELPER_LOG about message size exceeding maximum"
+            )
 
         # Try to reconnect to verify the process is still running
         async with api_client_connected_with_disconnect() as (client2, _):
@@ -77,10 +80,10 @@ async def test_oversized_protobuf_message_id_plaintext(
     This tests the message type limit - message IDs must fit in a uint16_t (0-65535).
     """
     process_exited = False
-    helper_log_found = False
+    helper_log_event = asyncio.Event()
 
     def check_logs(line: str) -> None:
-        nonlocal process_exited, helper_log_found
+        nonlocal process_exited
         # Check for signs that the process exited/crashed
         if "Segmentation fault" in line or "core dumped" in line:
             process_exited = True
@@ -90,7 +93,7 @@ async def test_oversized_protobuf_message_id_plaintext(
             and "Bad packet: message type" in line
             and "exceeds maximum" in line
         ):
-            helper_log_found = True
+            helper_log_event.set()
 
     async with run_compiled(yaml_config, line_callback=check_logs):
         async with api_client_connected_with_disconnect() as (client, disconnect_event):
@@ -114,10 +117,13 @@ async def test_oversized_protobuf_message_id_plaintext(
 
         # After disconnection, verify process didn't crash
         assert not process_exited, "ESPHome process should not crash"
-        # Verify we saw the expected HELPER_LOG message
-        assert helper_log_found, (
-            "Expected to see HELPER_LOG about message type exceeding maximum"
-        )
+        # Wait for the expected log message (may arrive after disconnect event)
+        try:
+            await asyncio.wait_for(helper_log_event.wait(), timeout=2.0)
+        except TimeoutError:
+            pytest.fail(
+                "Expected to see HELPER_LOG about message type exceeding maximum"
+            )
 
         # Try to reconnect to verify the process is still running
         async with api_client_connected_with_disconnect() as (client2, _):
@@ -135,10 +141,10 @@ async def test_oversized_payload_noise(
     """Test that oversized payloads from client cause disconnection without crashing with noise encryption."""
     noise_key = "N4Yle5YirwZhPiHHsdZLdOA73ndj/84veVaLhTvxCuU="
     process_exited = False
-    helper_log_found = False
+    helper_log_event = asyncio.Event()
 
     def check_logs(line: str) -> None:
-        nonlocal process_exited, helper_log_found
+        nonlocal process_exited
         # Check for signs that the process exited/crashed
         if "Segmentation fault" in line or "core dumped" in line:
             process_exited = True
@@ -149,7 +155,7 @@ async def test_oversized_payload_noise(
             and "Bad packet: message size" in line
             and "exceeds maximum" in line
         ):
-            helper_log_found = True
+            helper_log_event.set()
 
     async with run_compiled(yaml_config, line_callback=check_logs):
         async with api_client_connected_with_disconnect(noise_psk=noise_key) as (
@@ -177,10 +183,13 @@ async def test_oversized_payload_noise(
 
         # After disconnection, verify process didn't crash
         assert not process_exited, "ESPHome process should not crash"
-        # Verify we saw the expected HELPER_LOG message
-        assert helper_log_found, (
-            "Expected to see HELPER_LOG about message size exceeding maximum"
-        )
+        # Wait for the expected log message (may arrive after disconnect event)
+        try:
+            await asyncio.wait_for(helper_log_event.wait(), timeout=2.0)
+        except TimeoutError:
+            pytest.fail(
+                "Expected to see HELPER_LOG about message size exceeding maximum"
+            )
 
         # Try to reconnect to verify the process is still running
         async with api_client_connected_with_disconnect(noise_psk=noise_key) as (
@@ -274,10 +283,10 @@ async def test_noise_corrupt_encrypted_frame(
     """
     noise_key = "N4Yle5YirwZhPiHHsdZLdOA73ndj/84veVaLhTvxCuU="
     process_exited = False
-    cipherstate_failed = False
+    cipherstate_event = asyncio.Event()
 
     def check_logs(line: str) -> None:
-        nonlocal process_exited, cipherstate_failed
+        nonlocal process_exited
         # Check for signs that the process exited/crashed
         if "Segmentation fault" in line or "core dumped" in line:
             process_exited = True
@@ -290,7 +299,7 @@ async def test_noise_corrupt_encrypted_frame(
             "[W][api.connection" in line
             and "Reading failed CIPHERSTATE_DECRYPT_FAILED" in line
         ):
-            cipherstate_failed = True
+            cipherstate_event.set()
 
     async with run_compiled(yaml_config, line_callback=check_logs):
         async with api_client_connected_with_disconnect(noise_psk=noise_key) as (
@@ -326,10 +335,14 @@ async def test_noise_corrupt_encrypted_frame(
         assert not process_exited, (
             "ESPHome process should not crash on corrupt encrypted frames"
         )
-        # Verify we saw the expected log message about decryption failure
-        assert cipherstate_failed, (
-            "Expected to see log about noise_cipherstate_decrypt failure or CIPHERSTATE_DECRYPT_FAILED"
-        )
+        # Wait for the expected log message (may arrive after disconnect event)
+        try:
+            await asyncio.wait_for(cipherstate_event.wait(), timeout=2.0)
+        except TimeoutError:
+            pytest.fail(
+                "Expected to see log about noise_cipherstate_decrypt failure"
+                " or CIPHERSTATE_DECRYPT_FAILED"
+            )
 
         # Verify we can still reconnect after handling the corrupt frame
         async with api_client_connected_with_disconnect(noise_psk=noise_key) as (

From 7a87348855aa7d49dc77926868717e0343bdb47a Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Mon, 2 Mar 2026 16:49:14 -0500
Subject: [PATCH 16/23] [ci] Skip PR title check for dependabot PRs (#14418)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/pr-title-check.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
index f23c2c870e..198b9a6b25 100644
--- a/.github/workflows/pr-title-check.yml
+++ b/.github/workflows/pr-title-check.yml
@@ -26,14 +26,19 @@ jobs:
             } = require('./.github/scripts/detect-tags.js');
 
             const title = context.payload.pull_request.title;
+            const author = context.payload.pull_request.user.login;
+
+            // Skip bot PRs (e.g. dependabot) - they have their own title format
+            if (author === 'dependabot[bot]') {
+              return;
+            }
 
             // Block titles starting with "word:" or "word(scope):" patterns
             const commitStylePattern = /^\w+(\(.*?\))?[!]?\s*:/;
             if (commitStylePattern.test(title)) {
               core.setFailed(
                 `PR title should not start with a "prefix:" style format.\n` +
-                `Please use the format: [component] Brief description\n` +
-                `Example: [pn532] Add health checking and auto-reset`
+                `Please use the format: [component] Brief description\n`
               );
               return;
             }

From 97d713ee6477c003a8241b0452c1bcf2d6557289 Mon Sep 17 00:00:00 2001
From: Kevin Ahrendt <kevin.ahrendt@openhomefoundation.org>
Date: Mon, 2 Mar 2026 19:16:38 -0600
Subject: [PATCH 17/23] [media_source] Add new Media Source platform component
 (#14417)

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 CODEOWNERS                                    |   1 +
 esphome/components/media_source/__init__.py   |  40 +++++
 .../components/media_source/media_source.h    | 159 ++++++++++++++++++
 esphome/core/defines.h                        |   1 +
 4 files changed, 201 insertions(+)
 create mode 100644 esphome/components/media_source/__init__.py
 create mode 100644 esphome/components/media_source/media_source.h

diff --git a/CODEOWNERS b/CODEOWNERS
index 4c97b7f99d..21bee125c6 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -316,6 +316,7 @@ esphome/components/mcp9808/* @k7hpn
 esphome/components/md5/* @esphome/core
 esphome/components/mdns/* @esphome/core
 esphome/components/media_player/* @jesserockz
+esphome/components/media_source/* @kahrendt
 esphome/components/micro_wake_word/* @jesserockz @kahrendt
 esphome/components/micronova/* @edenhaus @jorre05
 esphome/components/microphone/* @jesserockz @kahrendt
diff --git a/esphome/components/media_source/__init__.py b/esphome/components/media_source/__init__.py
new file mode 100644
index 0000000000..43256db4af
--- /dev/null
+++ b/esphome/components/media_source/__init__.py
@@ -0,0 +1,40 @@
+import esphome.codegen as cg
+import esphome.config_validation as cv
+from esphome.const import CONF_ID
+from esphome.core import CORE
+from esphome.coroutine import CoroPriority, coroutine_with_priority
+from esphome.cpp_generator import MockObjClass
+
+CODEOWNERS = ["@kahrendt"]
+
+AUTO_LOAD = ["audio"]
+
+IS_PLATFORM_COMPONENT = True
+
+media_source_ns = cg.esphome_ns.namespace("media_source")
+
+MediaSource = media_source_ns.class_("MediaSource")
+
+
+async def register_media_source(var, config):
+    if not CORE.has_id(config[CONF_ID]):
+        var = cg.Pvariable(config[CONF_ID], var)
+    CORE.register_platform_component("media_source", var)
+    return var
+
+
+_MEDIA_SOURCE_SCHEMA = cv.Schema({})
+
+
+def media_source_schema(
+    class_: MockObjClass,
+) -> cv.Schema:
+    schema = {cv.GenerateID(CONF_ID): cv.declare_id(class_)}
+
+    return _MEDIA_SOURCE_SCHEMA.extend(schema)
+
+
+@coroutine_with_priority(CoroPriority.CORE)
+async def to_code(config):
+    cg.add_global(media_source_ns.using)
+    cg.add_define("USE_MEDIA_SOURCE")
diff --git a/esphome/components/media_source/media_source.h b/esphome/components/media_source/media_source.h
new file mode 100644
index 0000000000..688c27134f
--- /dev/null
+++ b/esphome/components/media_source/media_source.h
@@ -0,0 +1,159 @@
+#pragma once
+
+#include "esphome/components/audio/audio.h"
+#include "esphome/core/helpers.h"
+
+#include <cstdint>
+#include <string>
+
+namespace esphome::media_source {
+
+enum class MediaSourceState : uint8_t {
+  IDLE,     // Not playing, ready to accept play_uri
+  PLAYING,  // Currently playing media
+  PAUSED,   // Playback paused, can be resumed
+  ERROR,    // Error occurred during playback; sources are responsible for logging their own error details
+};
+
+/// @brief Commands that are sent from the orchestrator to a media source
+enum class MediaSourceCommand : uint8_t {
+  // All sources should support these basic commands.
+  PLAY,
+  PAUSE,
+  STOP,
+
+  // Only sources with internal playlists will handle these; simple sources should ignore them.
+  NEXT,
+  PREVIOUS,
+  CLEAR_PLAYLIST,
+  REPEAT_ALL,
+  REPEAT_ONE,
+  REPEAT_OFF,
+  SHUFFLE,
+  UNSHUFFLE,
+};
+
+/// @brief Callbacks from a MediaSource to its orchestrator
+class MediaSourceListener {
+ public:
+  virtual ~MediaSourceListener() = default;
+
+  // Callbacks that all sources use to send data and state changes to the orchestrator.
+  /// @brief Send audio data to the listener
+  virtual size_t write_audio(const uint8_t *data, size_t length, uint32_t timeout_ms,
+                             const audio::AudioStreamInfo &stream_info) = 0;
+  /// @brief Notify listener of state changes
+  virtual void report_state(MediaSourceState state) = 0;
+
+  // Callbacks from smart sources requesting the orchestrator to change volume, mute, or start a new URI.
+  // Simple sources never invoke these.
+  /// @brief Request the orchestrator to change volume
+  virtual void request_volume(float volume) {}
+  /// @brief Request the orchestrator to change mute state
+  virtual void request_mute(bool is_muted) {}
+  /// @brief Request the orchestrator to play a new URI
+  virtual void request_play_uri(const std::string &uri) {}
+};
+
+/// @brief Abstract base class for media sources
+/// MediaSource provides audio data to an orchestrator via the MediaSourceListener interface. It also receives commands
+/// from the orchestrator to control playback.
+class MediaSource {
+ public:
+  virtual ~MediaSource() = default;
+
+  // === Playback Control ===
+
+  /// @brief Start playing the given URI
+  /// Sources should validate the URI and state, returning false if the source is busy.
+  /// The orchestrator is responsible for stopping active sources before starting a new one.
+  /// @param uri URI to play; e.g., "http://stream_url"
+  /// @return true if playback started successfully, false otherwise
+  virtual bool play_uri(const std::string &uri) = 0;
+
+  /// @brief Handle playback commands (pause, stop, next, etc.)
+  /// @param command Command to execute
+  virtual void handle_command(MediaSourceCommand command) = 0;
+
+  /// @brief Whether this source manages its own playlist internally
+  /// Smart sources that handle next/previous/repeat/shuffle should override this to return true.
+  virtual bool has_internal_playlist() const { return false; }
+
+  // === State Access ===
+
+  /// @brief Get current playback state (must only be called from the main loop)
+  /// @return Current state of this source
+  MediaSourceState get_state() const { return this->state_; }
+
+  // === URI Matching ===
+
+  /// @brief Check if this source can handle the given URI
+  /// Each source must override this to match its supported URI scheme(s).
+  /// @param uri URI to check
+  /// @return true if this source can handle the URI
+  virtual bool can_handle(const std::string &uri) const = 0;
+
+  // === Listener: Source -> Orchestrator ===
+
+  /// @brief Set the listener that receives callbacks from this source
+  /// @param listener Pointer to the MediaSourceListener implementation
+  void set_listener(MediaSourceListener *listener) { this->listener_ = listener; }
+
+  /// @brief Check if a listener has been registered
+  bool has_listener() const { return this->listener_ != nullptr; }
+
+  /// @brief Write audio data to the listener
+  /// @param data Pointer to audio data buffer (not modified by this method)
+  /// @param length Number of bytes to write
+  /// @param timeout_ms Milliseconds to wait if the listener can't accept data immediately
+  /// @param stream_info Audio stream format information
+  /// @return Number of bytes written, or 0 if no listener is set
+  size_t write_output(const uint8_t *data, size_t length, uint32_t timeout_ms,
+                      const audio::AudioStreamInfo &stream_info) {
+    if (this->listener_ != nullptr) {
+      return this->listener_->write_audio(data, length, timeout_ms, stream_info);
+    }
+    return 0;
+  }
+
+  // === Callbacks: Orchestrator -> Source ===
+
+  /// @brief Notify the source that volume changed
+  /// Simple sources ignore this. Override for smart sources that track volume state.
+  /// @param volume New volume level (0.0 to 1.0)
+  virtual void notify_volume_changed(float volume) {}
+
+  /// @brief Notify the source that mute state changed
+  /// Simple sources ignore this. Override for smart sources that track mute state.
+  /// @param is_muted New mute state
+  virtual void notify_mute_changed(bool is_muted) {}
+
+  /// @brief Notify the source about audio that has been played
+  /// Called when the speaker reports that audio frames have been written to the DAC.
+  /// Sources can override this to track playback progress for synchronization.
+  /// @param frames Number of audio frames that were played
+  /// @param timestamp System time in microseconds when the frames finished writing to the DAC
+  virtual void notify_audio_played(uint32_t frames, int64_t timestamp) {}
+
+ protected:
+  /// @brief Update state and notify listener (must only be called from the main loop)
+  /// This is the only way to change state_, ensuring listener notifications always fire.
+  /// Sources running FreeRTOS tasks should signal via event groups and call this from loop().
+  /// @param state New state to set
+  void set_state_(MediaSourceState state) {
+    if (this->state_ != state) {
+      this->state_ = state;
+      if (this->listener_ != nullptr) {
+        this->listener_->report_state(state);
+      }
+    }
+  }
+
+ private:
+  // Private to enforce the invariant that listener notifications always fire on state changes.
+  // All state transitions must go through set_state_() which couples the update with notification.
+  MediaSourceState state_{MediaSourceState::IDLE};
+  MediaSourceListener *listener_{nullptr};
+};
+
+}  // namespace esphome::media_source
diff --git a/esphome/core/defines.h b/esphome/core/defines.h
index 8c78afa7d4..7fbc5a0b53 100644
--- a/esphome/core/defines.h
+++ b/esphome/core/defines.h
@@ -106,6 +106,7 @@
 #define MDNS_DYNAMIC_TXT_COUNT 2
 #define SNTP_SERVER_COUNT 3
 #define USE_MEDIA_PLAYER
+#define USE_MEDIA_SOURCE
 #define USE_NEXTION_TFT_UPLOAD
 #define USE_NUMBER
 #define USE_OUTPUT

From c77241940b701e8a8c5709374340c80b75e7e7c6 Mon Sep 17 00:00:00 2001
From: melak <ice@extreme.hu>
Date: Tue, 3 Mar 2026 02:24:00 +0100
Subject: [PATCH 18/23] [lps22] Add support for the LPS22DF variant (#14397)

---
 esphome/components/lps22/lps22.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/esphome/components/lps22/lps22.cpp b/esphome/components/lps22/lps22.cpp
index 7fc5774b08..592b7faaf0 100644
--- a/esphome/components/lps22/lps22.cpp
+++ b/esphome/components/lps22/lps22.cpp
@@ -8,6 +8,7 @@ static constexpr const char *const TAG = "lps22";
 static constexpr uint8_t WHO_AM_I = 0x0F;
 static constexpr uint8_t LPS22HB_ID = 0xB1;
 static constexpr uint8_t LPS22HH_ID = 0xB3;
+static constexpr uint8_t LPS22DF_ID = 0xB4;
 static constexpr uint8_t CTRL_REG2 = 0x11;
 static constexpr uint8_t CTRL_REG2_ONE_SHOT_MASK = 0b1;
 static constexpr uint8_t STATUS = 0x27;
@@ -24,8 +25,8 @@ static constexpr float TEMPERATURE_SCALE = 0.01f;
 void LPS22Component::setup() {
   uint8_t value = 0x00;
   this->read_register(WHO_AM_I, &value, 1);
-  if (value != LPS22HB_ID && value != LPS22HH_ID) {
-    ESP_LOGW(TAG, "device IDs as %02x, which isn't a known LPS22HB or LPS22HH ID", value);
+  if (value != LPS22HB_ID && value != LPS22HH_ID && value != LPS22DF_ID) {
+    ESP_LOGW(TAG, "device IDs as %02x, which isn't a known LPS22HB/HH/DF ID", value);
     this->mark_failed();
   }
 }

From ed63f51fcbf3fdaf304dbd1eb07ddff5029c739f Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Mon, 2 Mar 2026 15:32:33 -1000
Subject: [PATCH 19/23] [github-actions] Add code-owner-approved label workflow

Add a workflow that automatically manages a code-owner-approved label
on PRs when component-specific codeowners submit approvals. This helps
maintainers prioritize PRs that have domain-expert sign-off.

The workflow triggers on pull_request_review events and recalculates
the label based on all current reviews. Only individual component
codeowners count - the catch-all @esphome/core team is excluded.
Uses last-match-wins semantics for CODEOWNERS pattern matching.

Also extracts shared CODEOWNERS parsing logic into a reusable module
at .github/scripts/codeowners.js and updates codeowner-review-request
and auto-label-pr workflows to use it.
---
 .github/scripts/auto-label-pr/detectors.js    |  48 ++----
 .github/scripts/codeowners.js                 | 124 ++++++++++++++
 .../workflows/codeowner-approved-label.yml    | 159 ++++++++++++++++++
 .../workflows/codeowner-review-request.yml    |  89 +++-------
 4 files changed, 317 insertions(+), 103 deletions(-)
 create mode 100644 .github/scripts/codeowners.js
 create mode 100644 .github/workflows/codeowner-approved-label.yml

diff --git a/.github/scripts/auto-label-pr/detectors.js b/.github/scripts/auto-label-pr/detectors.js
index 80d8847bc1..b2a7665e25 100644
--- a/.github/scripts/auto-label-pr/detectors.js
+++ b/.github/scripts/auto-label-pr/detectors.js
@@ -7,6 +7,7 @@ const {
   hasDashboardChanges,
   hasGitHubActionsChanges,
 } = require('../detect-tags');
+const { fetchCodeowners, getEffectiveOwners } = require('../codeowners');
 
 // Strategy: Merge branch detection
 async function detectMergeBranch(context) {
@@ -151,48 +152,21 @@ async function detectCodeOwner(github, context, changedFiles) {
   const { owner, repo } = context.repo;
 
   try {
-    const { data: codeownersFile } = await github.rest.repos.getContent({
-      owner,
-      repo,
-      path: 'CODEOWNERS',
-    });
-
-    const codeownersContent = Buffer.from(codeownersFile.content, 'base64').toString('utf8');
+    const codeownersPatterns = await fetchCodeowners(github, owner, repo);
     const prAuthor = context.payload.pull_request.user.login;
 
-    const codeownersLines = codeownersContent.split('\n')
-      .map(line => line.trim())
-      .filter(line => line && !line.startsWith('#'));
-
-    const codeownersRegexes = codeownersLines.map(line => {
-      const parts = line.split(/\s+/);
-      const pattern = parts[0];
-      const owners = parts.slice(1);
-
-      let regex;
-      if (pattern.endsWith('*')) {
-        const dir = pattern.slice(0, -1);
-        regex = new RegExp(`^${dir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`);
-      } else if (pattern.includes('*')) {
-        // First escape all regex special chars except *, then replace * with .*
-        const regexPattern = pattern
-          .replace(/[.+?^${}()|[\]\\]/g, '\\$&')
-          .replace(/\*/g, '.*');
-        regex = new RegExp(`^${regexPattern}$`);
-      } else {
-        regex = new RegExp(`^${pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`);
-      }
-
-      return { regex, owners };
-    });
-
+    // Check if PR author is a codeowner of any changed file (last-match-wins)
     for (const file of changedFiles) {
-      for (const { regex, owners } of codeownersRegexes) {
-        if (regex.test(file) && owners.some(owner => owner === `@${prAuthor}`)) {
-          labels.add('by-code-owner');
-          return labels;
+      let effectiveOwners = null;
+      for (const { regex, owners } of codeownersPatterns) {
+        if (regex.test(file)) {
+          effectiveOwners = owners;
         }
       }
+      if (effectiveOwners && effectiveOwners.some(o => o === `@${prAuthor}`)) {
+        labels.add('by-code-owner');
+        return labels;
+      }
     }
   } catch (error) {
     console.log('Failed to read or parse CODEOWNERS file:', error.message);
diff --git a/.github/scripts/codeowners.js b/.github/scripts/codeowners.js
new file mode 100644
index 0000000000..f0121802c2
--- /dev/null
+++ b/.github/scripts/codeowners.js
@@ -0,0 +1,124 @@
+// Shared CODEOWNERS parsing and matching utilities.
+//
+// Used by:
+//   - codeowner-review-request.yml
+//   - codeowner-approved-label.yml
+//   - auto-label-pr/detectors.js (detectCodeOwner)
+
+/**
+ * Convert a CODEOWNERS glob pattern to a RegExp.
+ *
+ * Handles **, *, and ? wildcards after escaping regex-special characters.
+ */
+function globToRegex(pattern) {
+  let regexStr = pattern
+    .replace(/([.+^=!:${}()|[\]\\])/g, '\\$1')
+    .replace(/\*\*/g, '.*')
+    .replace(/\*/g, '[^/]*')
+    .replace(/\?/g, '.');
+  return new RegExp('^' + regexStr + '$');
+}
+
+/**
+ * Parse raw CODEOWNERS file content into an array of
+ * { pattern, regex, owners } objects.
+ *
+ * Each `owners` entry is the raw string from the file (e.g. "@user" or
+ * "@esphome/core").
+ */
+function parseCodeowners(content) {
+  const lines = content
+    .split('\n')
+    .map(line => line.trim())
+    .filter(line => line && !line.startsWith('#'));
+
+  const patterns = [];
+  for (const line of lines) {
+    const parts = line.split(/\s+/);
+    if (parts.length < 2) continue;
+
+    const pattern = parts[0];
+    const owners = parts.slice(1);
+    const regex = globToRegex(pattern);
+    patterns.push({ pattern, regex, owners });
+  }
+  return patterns;
+}
+
+/**
+ * Fetch and parse the CODEOWNERS file via the GitHub API.
+ *
+ * @param {object} github  - octokit instance from actions/github-script
+ * @param {string} owner   - repo owner
+ * @param {string} repo    - repo name
+ * @param {string} [ref]   - git ref (SHA / branch) to read from
+ * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
+ */
+async function fetchCodeowners(github, owner, repo, ref) {
+  const params = { owner, repo, path: 'CODEOWNERS' };
+  if (ref) params.ref = ref;
+
+  const { data: file } = await github.rest.repos.getContent(params);
+  const content = Buffer.from(file.content, 'base64').toString('utf8');
+  return parseCodeowners(content);
+}
+
+/**
+ * Classify raw owner strings into individual users and teams.
+ *
+ * @param {string[]} rawOwners - e.g. ["@user1", "@esphome/core"]
+ * @returns {{ users: string[], teams: string[] }}
+ *   users  – login names without "@"
+ *   teams  – team slugs without the "org/" prefix
+ */
+function classifyOwners(rawOwners) {
+  const users = [];
+  const teams = [];
+  for (const o of rawOwners) {
+    const clean = o.startsWith('@') ? o.slice(1) : o;
+    if (clean.includes('/')) {
+      teams.push(clean.split('/')[1]);
+    } else {
+      users.push(clean);
+    }
+  }
+  return { users, teams };
+}
+
+/**
+ * For each file, find its effective codeowners using GitHub's
+ * "last match wins" semantics, then union across all files.
+ *
+ * @param {string[]} files              - list of file paths
+ * @param {Array}    codeownersPatterns  - from parseCodeowners / fetchCodeowners
+ * @returns {{ users: Set<string>, teams: Set<string> }}
+ */
+function getEffectiveOwners(files, codeownersPatterns) {
+  const users = new Set();
+  const teams = new Set();
+
+  for (const file of files) {
+    // Last matching pattern wins for each file
+    let effectiveOwners = null;
+    for (const { regex, owners } of codeownersPatterns) {
+      if (regex.test(file)) {
+        effectiveOwners = owners;
+      }
+    }
+    if (effectiveOwners) {
+      const classified = classifyOwners(effectiveOwners);
+      for (const u of classified.users) users.add(u);
+      for (const t of classified.teams) teams.add(t);
+    }
+  }
+
+  return { users, teams };
+}
+
+module.exports = {
+  globToRegex,
+  parseCodeowners,
+  fetchCodeowners,
+  classifyOwners,
+  getEffectiveOwners
+};
diff --git a/.github/workflows/codeowner-approved-label.yml b/.github/workflows/codeowner-approved-label.yml
new file mode 100644
index 0000000000..d81dad7f76
--- /dev/null
+++ b/.github/workflows/codeowner-approved-label.yml
@@ -0,0 +1,159 @@
+# This workflow adds/removes a 'code-owner-approved' label when a
+# component-specific codeowner approves (or dismisses) a PR.
+# This helps maintainers prioritize PRs that have codeowner sign-off.
+#
+# Only component-specific codeowners count — the catch-all @esphome/core
+# team is excluded so the label reflects domain-expert approval.
+
+name: Codeowner Approved Label
+
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  codeowner-approved:
+    name: Run
+    if: ${{ github.repository == 'esphome/esphome' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Check codeowner approval and update label
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const { fetchCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const pr_number = context.payload.pull_request.number;
+            const LABEL_NAME = 'code-owner-approved';
+
+            console.log(`Processing PR #${pr_number} for codeowner approval label`);
+
+            try {
+              // Get the list of changed files in this PR (with pagination)
+              const prFiles = await github.paginate(
+                github.rest.pulls.listFiles,
+                {
+                  owner,
+                  repo,
+                  pull_number: pr_number
+                }
+              );
+
+              const changedFiles = prFiles.map(file => file.filename);
+              console.log(`Found ${changedFiles.length} changed files`);
+
+              if (changedFiles.length === 0) {
+                console.log('No changed files found, skipping');
+                return;
+              }
+
+              // Fetch and parse CODEOWNERS from base branch
+              const codeownersPatterns = await fetchCodeowners(
+                github, owner, repo,
+                context.payload.pull_request.base.sha
+              );
+
+              // Get effective owners using last-match-wins semantics
+              const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
+
+              // Only keep individual component-specific codeowners (exclude teams)
+              const componentCodeowners = effective.users;
+
+              console.log(`Component-specific codeowners for changed files: ${Array.from(componentCodeowners).join(', ') || '(none)'}`);
+
+              if (componentCodeowners.size === 0) {
+                console.log('No component-specific codeowners found for changed files');
+                // Remove label if present since there are no component codeowners
+                try {
+                  await github.rest.issues.removeLabel({
+                    owner,
+                    repo,
+                    issue_number: pr_number,
+                    name: LABEL_NAME
+                  });
+                  console.log(`Removed '${LABEL_NAME}' label (no component codeowners)`);
+                } catch (error) {
+                  if (error.status !== 404) {
+                    console.log(`Failed to remove label: ${error.message}`);
+                  }
+                }
+                return;
+              }
+
+              // Get all reviews on the PR
+              const reviews = await github.paginate(
+                github.rest.pulls.listReviews,
+                {
+                  owner,
+                  repo,
+                  pull_number: pr_number
+                }
+              );
+
+              // Get the latest review per user (reviews are returned chronologically)
+              const latestReviewByUser = new Map();
+              for (const review of reviews) {
+                // Skip bot reviews and comment-only reviews
+                if (!review.user || review.state === 'COMMENTED') continue;
+                latestReviewByUser.set(review.user.login, review);
+              }
+
+              // Check if any component-specific codeowner has an active approval
+              let hasCodeownerApproval = false;
+              for (const [login, review] of latestReviewByUser) {
+                if (review.state === 'APPROVED' && componentCodeowners.has(login)) {
+                  console.log(`Codeowner '${login}' has approved`);
+                  hasCodeownerApproval = true;
+                  break;
+                }
+              }
+
+              // Get current labels to check if label is already present
+              const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({
+                owner,
+                repo,
+                issue_number: pr_number
+              });
+              const hasLabel = currentLabels.some(label => label.name === LABEL_NAME);
+
+              if (hasCodeownerApproval && !hasLabel) {
+                // Add the label
+                await github.rest.issues.addLabels({
+                  owner,
+                  repo,
+                  issue_number: pr_number,
+                  labels: [LABEL_NAME]
+                });
+                console.log(`Added '${LABEL_NAME}' label`);
+              } else if (!hasCodeownerApproval && hasLabel) {
+                // Remove the label
+                try {
+                  await github.rest.issues.removeLabel({
+                    owner,
+                    repo,
+                    issue_number: pr_number,
+                    name: LABEL_NAME
+                  });
+                  console.log(`Removed '${LABEL_NAME}' label`);
+                } catch (error) {
+                  if (error.status !== 404) {
+                    console.log(`Failed to remove label: ${error.message}`);
+                  }
+                }
+              } else {
+                console.log(`Label already ${hasLabel ? 'present' : 'absent'}, no change needed`);
+              }
+
+            } catch (error) {
+              console.log('Failed to process codeowner approval label:', error.message);
+              console.error(error);
+            }
diff --git a/.github/workflows/codeowner-review-request.yml b/.github/workflows/codeowner-review-request.yml
index 6f4351b298..f12791c5c1 100644
--- a/.github/workflows/codeowner-review-request.yml
+++ b/.github/workflows/codeowner-review-request.yml
@@ -24,10 +24,15 @@ jobs:
     if: ${{ github.repository == 'esphome/esphome' && !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Request reviews from component codeowners
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
+            const { fetchCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
+
             const owner = context.repo.owner;
             const repo = context.repo.repo;
             const pr_number = context.payload.pull_request.number;
@@ -53,32 +58,13 @@ jobs:
                 return;
               }
 
-              // Fetch CODEOWNERS file from root
-              const { data: codeownersFile } = await github.rest.repos.getContent({
-                owner,
-                repo,
-                path: 'CODEOWNERS',
-                ref: context.payload.pull_request.base.sha
-              });
-              const codeownersContent = Buffer.from(codeownersFile.content, 'base64').toString('utf8');
+              // Fetch and parse CODEOWNERS file from base branch
+              const codeownersPatterns = await fetchCodeowners(
+                github, owner, repo,
+                context.payload.pull_request.base.sha
+              );
 
-              // Parse CODEOWNERS file to extract all patterns and their owners
-              const codeownersLines = codeownersContent.split('\n')
-                .map(line => line.trim())
-                .filter(line => line && !line.startsWith('#'));
-
-              const codeownersPatterns = [];
-
-              // Convert CODEOWNERS pattern to regex (robust glob handling)
-              function globToRegex(pattern) {
-                // Escape regex special characters except for glob wildcards
-                let regexStr = pattern
-                  .replace(/([.+^=!:${}()|[\]\\])/g, '\\$1') // escape regex chars
-                  .replace(/\*\*/g, '.*') // globstar
-                  .replace(/\*/g, '[^/]*') // single star
-                  .replace(/\?/g, '.'); // question mark
-                return new RegExp('^' + regexStr + '$');
-              }
+              console.log(`Parsed ${codeownersPatterns.length} codeowner patterns`);
 
               // Helper function to create comment body
               function createCommentBody(reviewersList, teamsList, matchedFileCount, isSuccessful = true) {
@@ -93,47 +79,18 @@ jobs:
                 }
               }
 
-              for (const line of codeownersLines) {
-                const parts = line.split(/\s+/);
-                if (parts.length < 2) continue;
-
-                const pattern = parts[0];
-                const owners = parts.slice(1);
-
-                // Use robust glob-to-regex conversion
-                const regex = globToRegex(pattern);
-                codeownersPatterns.push({ pattern, regex, owners });
-              }
-
-              console.log(`Parsed ${codeownersPatterns.length} codeowner patterns`);
-
-              // Match changed files against CODEOWNERS patterns
-              const matchedOwners = new Set();
-              const matchedTeams = new Set();
-              const fileMatches = new Map(); // Track which files matched which patterns
+              // Match changed files against CODEOWNERS patterns using last-match-wins semantics
+              const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
+              const matchedOwners = effective.users;
+              const matchedTeams = effective.teams;
 
+              // Count matched files for the comment
+              let matchedFileCount = 0;
               for (const file of changedFiles) {
-                for (const { pattern, regex, owners } of codeownersPatterns) {
+                for (const { regex } of codeownersPatterns) {
                   if (regex.test(file)) {
-                    console.log(`File '${file}' matches pattern '${pattern}' with owners: ${owners.join(', ')}`);
-
-                    if (!fileMatches.has(file)) {
-                      fileMatches.set(file, []);
-                    }
-                    fileMatches.get(file).push({ pattern, owners });
-
-                    // Add owners to the appropriate set (remove @ prefix)
-                    for (const owner of owners) {
-                      const cleanOwner = owner.startsWith('@') ? owner.slice(1) : owner;
-                      if (cleanOwner.includes('/')) {
-                        // Team mention (org/team-name)
-                        const teamName = cleanOwner.split('/')[1];
-                        matchedTeams.add(teamName);
-                      } else {
-                        // Individual user
-                        matchedOwners.add(cleanOwner);
-                      }
-                    }
+                    matchedFileCount++;
+                    break;
                   }
                 }
               }
@@ -247,7 +204,7 @@ jobs:
               }
 
               const totalReviewers = reviewersList.length + teamsList.length;
-              console.log(`Requesting reviews from ${reviewersList.length} users and ${teamsList.length} teams for ${fileMatches.size} matched files`);
+              console.log(`Requesting reviews from ${reviewersList.length} users and ${teamsList.length} teams for ${matchedFileCount} matched files`);
 
               // Request reviews
               try {
@@ -279,7 +236,7 @@ jobs:
 
                 // Only add a comment if there are new codeowners to mention (not previously pinged)
                 if (reviewersList.length > 0 || teamsList.length > 0) {
-                  const commentBody = createCommentBody(reviewersList, teamsList, fileMatches.size, true);
+                  const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, true);
 
                   await github.rest.issues.createComment({
                     owner,
@@ -297,7 +254,7 @@ jobs:
 
                   // Only try to add a comment if there are new codeowners to mention
                   if (reviewersList.length > 0 || teamsList.length > 0) {
-                    const commentBody = createCommentBody(reviewersList, teamsList, fileMatches.size, false);
+                    const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, false);
 
                     try {
                       await github.rest.issues.createComment({

From 55fc563c69fb5b6b700e52a46c5d2ad38f3d9cd8 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Mon, 2 Mar 2026 15:50:54 -1000
Subject: [PATCH 20/23] Checkout base branch to prevent PR author code
 injection

pull_request_review checks out the PR merge commit by default,
which means require() would load the PR author's version of
shared scripts. Explicitly checkout the base branch SHA instead.
---
 .github/workflows/codeowner-approved-label.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeowner-approved-label.yml b/.github/workflows/codeowner-approved-label.yml
index d81dad7f76..7ba9f126c2 100644
--- a/.github/workflows/codeowner-approved-label.yml
+++ b/.github/workflows/codeowner-approved-label.yml
@@ -21,8 +21,10 @@ jobs:
     if: ${{ github.repository == 'esphome/esphome' }}
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Checkout base branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Check codeowner approval and update label
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

From ca600a45a225a43834d7f7335d8e4c343de60069 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Mon, 2 Mar 2026 15:52:04 -1000
Subject: [PATCH 21/23] Address review feedback

- Actually filter bot reviews (not just comment about it)
- Use core.setFailed() instead of silently swallowing errors
- Remove unused getEffectiveOwners import from detectors.js
---
 .github/scripts/auto-label-pr/detectors.js     | 2 +-
 .github/workflows/codeowner-approved-label.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/scripts/auto-label-pr/detectors.js b/.github/scripts/auto-label-pr/detectors.js
index b2a7665e25..527a08da85 100644
--- a/.github/scripts/auto-label-pr/detectors.js
+++ b/.github/scripts/auto-label-pr/detectors.js
@@ -7,7 +7,7 @@ const {
   hasDashboardChanges,
   hasGitHubActionsChanges,
 } = require('../detect-tags');
-const { fetchCodeowners, getEffectiveOwners } = require('../codeowners');
+const { fetchCodeowners } = require('../codeowners');
 
 // Strategy: Merge branch detection
 async function detectMergeBranch(context) {
diff --git a/.github/workflows/codeowner-approved-label.yml b/.github/workflows/codeowner-approved-label.yml
index 7ba9f126c2..b45cdd82ec 100644
--- a/.github/workflows/codeowner-approved-label.yml
+++ b/.github/workflows/codeowner-approved-label.yml
@@ -105,7 +105,7 @@ jobs:
               const latestReviewByUser = new Map();
               for (const review of reviews) {
                 // Skip bot reviews and comment-only reviews
-                if (!review.user || review.state === 'COMMENTED') continue;
+                if (!review.user || review.user.type === 'Bot' || review.state === 'COMMENTED') continue;
                 latestReviewByUser.set(review.user.login, review);
               }
 
@@ -156,6 +156,6 @@ jobs:
               }
 
             } catch (error) {
-              console.log('Failed to process codeowner approval label:', error.message);
               console.error(error);
+              core.setFailed(`Failed to process codeowner approval label: ${error.message}`);
             }

From d9b5f54cf6febda5da4b77cbee9b359f917f6fd8 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Mon, 2 Mar 2026 15:53:14 -1000
Subject: [PATCH 22/23] Pin codeowner-review-request checkout to base SHA

Explicitly checkout the base branch SHA for consistency and to
ensure the shared codeowners.js script is always loaded from
trusted code, not the PR head.
---
 .github/workflows/codeowner-review-request.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeowner-review-request.yml b/.github/workflows/codeowner-review-request.yml
index f12791c5c1..c6f5864983 100644
--- a/.github/workflows/codeowner-review-request.yml
+++ b/.github/workflows/codeowner-review-request.yml
@@ -24,8 +24,10 @@ jobs:
     if: ${{ github.repository == 'esphome/esphome' && !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Checkout base branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Request reviews from component codeowners
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

From 769031b72481e6f374162b00d767286ea9f9f6b8 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Mon, 2 Mar 2026 16:01:23 -1000
Subject: [PATCH 23/23] reduce api calls

---
 .github/scripts/codeowners.js                 | 27 ++++++++++++++++---
 .../workflows/codeowner-approved-label.yml    |  9 +++----
 .../workflows/codeowner-review-request.yml    | 21 +++------------
 3 files changed, 30 insertions(+), 27 deletions(-)

diff --git a/.github/scripts/codeowners.js b/.github/scripts/codeowners.js
index f0121802c2..9a10391699 100644
--- a/.github/scripts/codeowners.js
+++ b/.github/scripts/codeowners.js
@@ -13,8 +13,9 @@
 function globToRegex(pattern) {
   let regexStr = pattern
     .replace(/([.+^=!:${}()|[\]\\])/g, '\\$1')
-    .replace(/\*\*/g, '.*')
-    .replace(/\*/g, '[^/]*')
+    .replace(/\*\*/g, '\x00GLOBSTAR\x00')  // protect ** from next replace
+    .replace(/\*/g, '[^/]*')               // single star
+    .replace(/\x00GLOBSTAR\x00/g, '.*')    // restore globstar
     .replace(/\?/g, '.');
   return new RegExp('^' + regexStr + '$');
 }
@@ -91,11 +92,12 @@ function classifyOwners(rawOwners) {
  *
  * @param {string[]} files              - list of file paths
  * @param {Array}    codeownersPatterns  - from parseCodeowners / fetchCodeowners
- * @returns {{ users: Set<string>, teams: Set<string> }}
+ * @returns {{ users: Set<string>, teams: Set<string>, matchedFileCount: number }}
  */
 function getEffectiveOwners(files, codeownersPatterns) {
   const users = new Set();
   const teams = new Set();
+  let matchedFileCount = 0;
 
   for (const file of files) {
     // Last matching pattern wins for each file
@@ -106,19 +108,36 @@ function getEffectiveOwners(files, codeownersPatterns) {
       }
     }
     if (effectiveOwners) {
+      matchedFileCount++;
       const classified = classifyOwners(effectiveOwners);
       for (const u of classified.users) users.add(u);
       for (const t of classified.teams) teams.add(t);
     }
   }
 
-  return { users, teams };
+  return { users, teams, matchedFileCount };
+}
+
+/**
+ * Read and parse the CODEOWNERS file from disk.
+ *
+ * Use this when the repo is already checked out (avoids an API call).
+ *
+ * @param {string} [repoRoot='.'] - path to the repo root
+ * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
+ */
+function loadCodeowners(repoRoot = '.') {
+  const fs = require('fs');
+  const path = require('path');
+  const content = fs.readFileSync(path.join(repoRoot, 'CODEOWNERS'), 'utf8');
+  return parseCodeowners(content);
 }
 
 module.exports = {
   globToRegex,
   parseCodeowners,
   fetchCodeowners,
+  loadCodeowners,
   classifyOwners,
   getEffectiveOwners
 };
diff --git a/.github/workflows/codeowner-approved-label.yml b/.github/workflows/codeowner-approved-label.yml
index b45cdd82ec..217ae06419 100644
--- a/.github/workflows/codeowner-approved-label.yml
+++ b/.github/workflows/codeowner-approved-label.yml
@@ -30,7 +30,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
-            const { fetchCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
+            const { loadCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
 
             const owner = context.repo.owner;
             const repo = context.repo.repo;
@@ -58,11 +58,8 @@ jobs:
                 return;
               }
 
-              // Fetch and parse CODEOWNERS from base branch
-              const codeownersPatterns = await fetchCodeowners(
-                github, owner, repo,
-                context.payload.pull_request.base.sha
-              );
+              // Parse CODEOWNERS from the checked-out base branch
+              const codeownersPatterns = loadCodeowners();
 
               // Get effective owners using last-match-wins semantics
               const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
diff --git a/.github/workflows/codeowner-review-request.yml b/.github/workflows/codeowner-review-request.yml
index c6f5864983..abe90836f7 100644
--- a/.github/workflows/codeowner-review-request.yml
+++ b/.github/workflows/codeowner-review-request.yml
@@ -33,7 +33,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
-            const { fetchCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
+            const { loadCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
 
             const owner = context.repo.owner;
             const repo = context.repo.repo;
@@ -60,11 +60,8 @@ jobs:
                 return;
               }
 
-              // Fetch and parse CODEOWNERS file from base branch
-              const codeownersPatterns = await fetchCodeowners(
-                github, owner, repo,
-                context.payload.pull_request.base.sha
-              );
+              // Parse CODEOWNERS from the checked-out base branch
+              const codeownersPatterns = loadCodeowners();
 
               console.log(`Parsed ${codeownersPatterns.length} codeowner patterns`);
 
@@ -85,17 +82,7 @@ jobs:
               const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
               const matchedOwners = effective.users;
               const matchedTeams = effective.teams;
-
-              // Count matched files for the comment
-              let matchedFileCount = 0;
-              for (const file of changedFiles) {
-                for (const { regex } of codeownersPatterns) {
-                  if (regex.test(file)) {
-                    matchedFileCount++;
-                    break;
-                  }
-                }
-              }
+              const matchedFileCount = effective.matchedFileCount;
 
               if (matchedOwners.size === 0 && matchedTeams.size === 0) {
                 console.log('No codeowners found for any changed files');