From 9498c554bfe8ec103ff0f549b10298492bee7329 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Wed, 18 Mar 2026 08:52:44 -1000
Subject: [PATCH 01/14] [ota] Pack deferred state args into uint32 to avoid
 heap allocation

The notify_state_deferred_ lambda captured [this, state, progress, error]
(16 bytes on 32-bit), exceeding std::function SBO and forcing a heap
allocation on every OTA progress update.

Pack the three values into a single uint32_t:
- state (8 bits) + error (8 bits) + progress as fixed-point (16 bits)

The lambda now captures [this, packed] (8 bytes), fitting in SBO.
Progress resolution of 0.01% is more than adequate for OTA reporting.
---
 esphome/components/ota/ota_backend.h | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/esphome/components/ota/ota_backend.h b/esphome/components/ota/ota_backend.h
index bc603a6e9e..cc6ef365be 100644
--- a/esphome/components/ota/ota_backend.h
+++ b/esphome/components/ota/ota_backend.h
@@ -74,7 +74,15 @@ class OTAComponent : public Component {
    * (like web_server OTA) to ensure listeners execute in the main loop.
    */
   void notify_state_deferred_(OTAState state, float progress, uint8_t error) {
-    this->defer([this, state, progress, error]() { this->notify_state_(state, progress, error); });
+    // Pack state, error, and progress into a single uint32_t so the lambda
+    // captures only [this, packed] (8 bytes) — fits in std::function SBO.
+    // Layout: [state:8][error:8][progress_fixed:16] where progress is 0–10000 (0.01% resolution)
+    uint32_t packed = (static_cast<uint32_t>(state) << 24) | (static_cast<uint32_t>(error) << 16) |
+                      static_cast<uint16_t>(progress * 100.0f);
+    this->defer([this, packed]() {
+      this->notify_state_(static_cast<OTAState>(packed >> 24), static_cast<float>(packed & 0xFFFF) / 100.0f,
+                          static_cast<uint8_t>(packed >> 16));
+    });
   }
 
   std::vector<OTAStateListener *> state_listeners_;

From 6cf32af33f4ec92d0b06939129be8c7cb254cb59 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Mon, 16 Mar 2026 15:57:53 -0400
Subject: [PATCH 02/14] [seeed_mr24hpc1] Fix frame parser length handling bugs
 (#14863)

---
 esphome/components/seeed_mr24hpc1/seeed_mr24hpc1.cpp | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/esphome/components/seeed_mr24hpc1/seeed_mr24hpc1.cpp b/esphome/components/seeed_mr24hpc1/seeed_mr24hpc1.cpp
index 263603704a..c9fe3a2e6e 100644
--- a/esphome/components/seeed_mr24hpc1/seeed_mr24hpc1.cpp
+++ b/esphome/components/seeed_mr24hpc1/seeed_mr24hpc1.cpp
@@ -297,19 +297,17 @@ void MR24HPC1Component::r24_split_data_frame_(uint8_t value) {
       this->sg_recv_data_state_ = FRAME_DATA_LEN_H;
       break;
     case FRAME_DATA_LEN_H:
-      if (value <= 4) {
-        this->sg_data_len_ = value * 256;
+      if (value == 0) {
         this->sg_frame_buf_[4] = value;
         this->sg_recv_data_state_ = FRAME_DATA_LEN_L;
       } else {
-        this->sg_data_len_ = 0;
         this->sg_recv_data_state_ = FRAME_IDLE;
         ESP_LOGD(TAG, "FRAME_DATA_LEN_H ERROR value:%x", value);
       }
       break;
     case FRAME_DATA_LEN_L:
-      this->sg_data_len_ += value;
-      if (this->sg_data_len_ > 32) {
+      this->sg_data_len_ = value;
+      if (this->sg_data_len_ == 0 || this->sg_data_len_ > 32) {
         ESP_LOGD(TAG, "len=%d, FRAME_DATA_LEN_L ERROR value:%x", this->sg_data_len_, value);
         this->sg_data_len_ = 0;
         this->sg_recv_data_state_ = FRAME_IDLE;
@@ -320,9 +318,8 @@ void MR24HPC1Component::r24_split_data_frame_(uint8_t value) {
       }
       break;
     case FRAME_DATA_BYTES:
-      this->sg_data_len_ -= 1;
       this->sg_frame_buf_[this->sg_frame_len_++] = value;
-      if (this->sg_data_len_ <= 0) {
+      if (--this->sg_data_len_ == 0) {
         this->sg_recv_data_state_ = FRAME_DATA_CRC;
       }
       break;

From 91e66cfd9d7e3a31ca4a0923463dcc107de321d1 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Tue, 17 Mar 2026 16:28:13 -0400
Subject: [PATCH 03/14] [gree] Fix IR checksum for YAA/YAC/YAC1FB9/GENERIC
 models (#14888)

---
 esphome/components/gree/gree.cpp | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/esphome/components/gree/gree.cpp b/esphome/components/gree/gree.cpp
index 8a9f264932..732ebd9632 100644
--- a/esphome/components/gree/gree.cpp
+++ b/esphome/components/gree/gree.cpp
@@ -87,19 +87,12 @@ void GreeClimate::transmit_state() {
   // Calculate the checksum
   if (this->model_ == GREE_YAN || this->model_ == GREE_YX1FF) {
     remote_state[7] = ((remote_state[0] << 4) + (remote_state[1] << 4) + 0xC0);
-  } else if (this->model_ == GREE_YAG) {
+  } else {
     remote_state[7] =
         ((((remote_state[0] & 0x0F) + (remote_state[1] & 0x0F) + (remote_state[2] & 0x0F) + (remote_state[3] & 0x0F) +
            ((remote_state[4] & 0xF0) >> 4) + ((remote_state[5] & 0xF0) >> 4) + ((remote_state[6] & 0xF0) >> 4) + 0x0A) &
           0x0F)
          << 4);
-  } else {
-    remote_state[7] =
-        ((((remote_state[0] & 0x0F) + (remote_state[1] & 0x0F) + (remote_state[2] & 0x0F) + (remote_state[3] & 0x0F) +
-           ((remote_state[5] & 0xF0) >> 4) + ((remote_state[6] & 0xF0) >> 4) + ((remote_state[7] & 0xF0) >> 4) + 0x0A) &
-          0x0F)
-         << 4) |
-        (remote_state[7] & 0x0F);
   }
 
   auto transmit = this->transmitter_->transmit();

From 4cb93d4df8c3661158ffb7e96966eccdb08bedad Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Tue, 17 Mar 2026 19:46:26 -0400
Subject: [PATCH 04/14] [sensor][ee895][hdc2010] Fix misc bugs found during
 component scan (#14890)

---
 esphome/components/ee895/ee895.cpp     | 15 ++---
 esphome/components/hdc2010/hdc2010.cpp | 76 +++++++++++---------------
 esphome/components/sensor/__init__.py  | 10 ++--
 3 files changed, 43 insertions(+), 58 deletions(-)

diff --git a/esphome/components/ee895/ee895.cpp b/esphome/components/ee895/ee895.cpp
index 22f28be9bc..93e5d4203b 100644
--- a/esphome/components/ee895/ee895.cpp
+++ b/esphome/components/ee895/ee895.cpp
@@ -24,7 +24,7 @@ void EE895Component::setup() {
   this->read(serial_number, 20);
 
   crc16_check = (serial_number[19] << 8) + serial_number[18];
-  if (crc16_check != calc_crc16_(serial_number, 19)) {
+  if (crc16_check != calc_crc16_(serial_number, 18)) {
     this->error_code_ = CRC_CHECK_FAILED;
     this->mark_failed();
     return;
@@ -84,7 +84,7 @@ void EE895Component::write_command_(uint16_t addr, uint16_t reg_cnt) {
   address[2] = addr & 0xFF;
   address[3] = (reg_cnt >> 8) & 0xFF;
   address[4] = reg_cnt & 0xFF;
-  crc16 = calc_crc16_(address, 6);
+  crc16 = calc_crc16_(address, 5);
   address[5] = crc16 & 0xFF;
   address[6] = (crc16 >> 8) & 0xFF;
   this->write(address, 7);
@@ -95,7 +95,7 @@ float EE895Component::read_float_() {
   uint8_t i2c_response[8];
   this->read(i2c_response, 8);
   crc16_check = (i2c_response[7] << 8) + i2c_response[6];
-  if (crc16_check != calc_crc16_(i2c_response, 7)) {
+  if (crc16_check != calc_crc16_(i2c_response, 6)) {
     this->error_code_ = CRC_CHECK_FAILED;
     this->status_set_warning();
     return 0;
@@ -107,12 +107,9 @@ float EE895Component::read_float_() {
 }
 
 uint16_t EE895Component::calc_crc16_(const uint8_t buf[], uint8_t len) {
-  uint8_t crc_check_buf[22];
-  for (int i = 0; i < len; i++) {
-    crc_check_buf[i + 1] = buf[i];
-  }
-  crc_check_buf[0] = this->address_;
-  return crc16(crc_check_buf, len);
+  uint8_t addr = this->address_;
+  uint16_t crc = crc16(&addr, 1);
+  return crc16(buf, len, crc);
 }
 }  // namespace ee895
 }  // namespace esphome
diff --git a/esphome/components/hdc2010/hdc2010.cpp b/esphome/components/hdc2010/hdc2010.cpp
index c53fdb3f5b..0334b30eec 100644
--- a/esphome/components/hdc2010/hdc2010.cpp
+++ b/esphome/components/hdc2010/hdc2010.cpp
@@ -7,50 +7,36 @@ namespace hdc2010 {
 
 static const char *const TAG = "hdc2010";
 
-static const uint8_t HDC2010_ADDRESS = 0x40;  // 0b1000000 or 0b1000001 from datasheet
-static const uint8_t HDC2010_CMD_CONFIGURATION_MEASUREMENT = 0x8F;
-static const uint8_t HDC2010_CMD_START_MEASUREMENT = 0xF9;
-static const uint8_t HDC2010_CMD_TEMPERATURE_LOW = 0x00;
-static const uint8_t HDC2010_CMD_TEMPERATURE_HIGH = 0x01;
-static const uint8_t HDC2010_CMD_HUMIDITY_LOW = 0x02;
-static const uint8_t HDC2010_CMD_HUMIDITY_HIGH = 0x03;
-static const uint8_t CONFIG = 0x0E;
-static const uint8_t MEASUREMENT_CONFIG = 0x0F;
+// Register addresses
+static constexpr uint8_t REG_TEMPERATURE_LOW = 0x00;
+static constexpr uint8_t REG_TEMPERATURE_HIGH = 0x01;
+static constexpr uint8_t REG_HUMIDITY_LOW = 0x02;
+static constexpr uint8_t REG_HUMIDITY_HIGH = 0x03;
+static constexpr uint8_t REG_RESET_DRDY_INT_CONF = 0x0E;
+static constexpr uint8_t REG_MEASUREMENT_CONF = 0x0F;
+
+// REG_MEASUREMENT_CONF (0x0F) bit masks
+static constexpr uint8_t MEAS_TRIG = 0x01;       // Bit 0: measurement trigger
+static constexpr uint8_t MEAS_CONF_MASK = 0x06;  // Bits 2:1: measurement mode
+static constexpr uint8_t HRES_MASK = 0x30;       // Bits 5:4: humidity resolution
+static constexpr uint8_t TRES_MASK = 0xC0;       // Bits 7:6: temperature resolution
+
+// REG_RESET_DRDY_INT_CONF (0x0E) bit masks
+static constexpr uint8_t AMM_MASK = 0x70;  // Bits 6:4: auto measurement mode
 
 void HDC2010Component::setup() {
   ESP_LOGCONFIG(TAG, "Running setup");
 
-  const uint8_t data[2] = {
-      0b00000000,  // resolution 14bit for both humidity and temperature
-      0b00000000   // reserved
-  };
-
-  if (!this->write_bytes(HDC2010_CMD_CONFIGURATION_MEASUREMENT, data, 2)) {
-    ESP_LOGW(TAG, "Initial config instruction error");
-    this->status_set_warning();
-    return;
-  }
-
-  // Set measurement mode to temperature and humidity
+  // Set 14-bit resolution for both sensors and measurement mode to temp + humidity
   uint8_t config_contents;
-  this->read_register(MEASUREMENT_CONFIG, &config_contents, 1);
-  config_contents = (config_contents & 0xF9);  // Always set to TEMP_AND_HUMID mode
-  this->write_bytes(MEASUREMENT_CONFIG, &config_contents, 1);
+  this->read_register(REG_MEASUREMENT_CONF, &config_contents, 1);
+  config_contents &= ~(TRES_MASK | HRES_MASK | MEAS_CONF_MASK);  // 14-bit temp, 14-bit humidity, temp+humidity mode
+  this->write_bytes(REG_MEASUREMENT_CONF, &config_contents, 1);
 
-  // Set rate to manual
-  this->read_register(CONFIG, &config_contents, 1);
-  config_contents &= 0x8F;
-  this->write_bytes(CONFIG, &config_contents, 1);
-
-  // Set temperature resolution to 14bit
-  this->read_register(CONFIG, &config_contents, 1);
-  config_contents &= 0x3F;
-  this->write_bytes(CONFIG, &config_contents, 1);
-
-  // Set humidity resolution to 14bit
-  this->read_register(CONFIG, &config_contents, 1);
-  config_contents &= 0xCF;
-  this->write_bytes(CONFIG, &config_contents, 1);
+  // Set auto measurement rate to manual (on-demand via MEAS_TRIG)
+  this->read_register(REG_RESET_DRDY_INT_CONF, &config_contents, 1);
+  config_contents &= ~AMM_MASK;
+  this->write_bytes(REG_RESET_DRDY_INT_CONF, &config_contents, 1);
 }
 
 void HDC2010Component::dump_config() {
@@ -67,9 +53,9 @@ void HDC2010Component::dump_config() {
 void HDC2010Component::update() {
   // Trigger measurement
   uint8_t config_contents;
-  this->read_register(CONFIG, &config_contents, 1);
-  config_contents |= 0x01;
-  this->write_bytes(MEASUREMENT_CONFIG, &config_contents, 1);
+  this->read_register(REG_MEASUREMENT_CONF, &config_contents, 1);
+  config_contents |= MEAS_TRIG;
+  this->write_bytes(REG_MEASUREMENT_CONF, &config_contents, 1);
 
   // 1ms delay after triggering the sample
   set_timeout(1, [this]() {
@@ -90,8 +76,8 @@ void HDC2010Component::update() {
 float HDC2010Component::read_temp() {
   uint8_t byte[2];
 
-  this->read_register(HDC2010_CMD_TEMPERATURE_LOW, &byte[0], 1);
-  this->read_register(HDC2010_CMD_TEMPERATURE_HIGH, &byte[1], 1);
+  this->read_register(REG_TEMPERATURE_LOW, &byte[0], 1);
+  this->read_register(REG_TEMPERATURE_HIGH, &byte[1], 1);
 
   uint16_t temp = encode_uint16(byte[1], byte[0]);
   return (float) temp * 0.0025177f - 40.0f;
@@ -100,8 +86,8 @@ float HDC2010Component::read_temp() {
 float HDC2010Component::read_humidity() {
   uint8_t byte[2];
 
-  this->read_register(HDC2010_CMD_HUMIDITY_LOW, &byte[0], 1);
-  this->read_register(HDC2010_CMD_HUMIDITY_HIGH, &byte[1], 1);
+  this->read_register(REG_HUMIDITY_LOW, &byte[0], 1);
+  this->read_register(REG_HUMIDITY_HIGH, &byte[1], 1);
 
   uint16_t humidity = encode_uint16(byte[1], byte[0]);
   return (float) humidity * 0.001525879f;
diff --git a/esphome/components/sensor/__init__.py b/esphome/components/sensor/__init__.py
index 4be6ed1b84..02db381ff4 100644
--- a/esphome/components/sensor/__init__.py
+++ b/esphome/components/sensor/__init__.py
@@ -403,10 +403,12 @@ async def filter_out_filter_to_code(config, filter_id):
 QUANTILE_SCHEMA = cv.All(
     cv.Schema(
         {
-            cv.Optional(CONF_WINDOW_SIZE, default=5): cv.positive_not_null_int,
-            cv.Optional(CONF_SEND_EVERY, default=5): cv.positive_not_null_int,
-            cv.Optional(CONF_SEND_FIRST_AT, default=1): cv.positive_not_null_int,
-            cv.Optional(CONF_QUANTILE, default=0.9): cv.zero_to_one_float,
+            cv.Optional(CONF_WINDOW_SIZE, default=5): cv.int_range(min=1, max=65535),
+            cv.Optional(CONF_SEND_EVERY, default=5): cv.int_range(min=1, max=65535),
+            cv.Optional(CONF_SEND_FIRST_AT, default=1): cv.int_range(min=1, max=65535),
+            cv.Optional(CONF_QUANTILE, default=0.9): cv.float_range(
+                min=0, min_included=False, max=1
+            ),
         }
     ),
     validate_send_first_at,

From 98d3dce6727f39dd0a0efd4fdabf0daa9b369140 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Tue, 17 Mar 2026 23:12:13 -0400
Subject: [PATCH 05/14] [voice_assistant][micro_wake_word] Fix null deref and
 missing error return (#14906)

---
 esphome/components/micro_wake_word/streaming_model.cpp | 1 +
 esphome/components/voice_assistant/voice_assistant.cpp | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/esphome/components/micro_wake_word/streaming_model.cpp b/esphome/components/micro_wake_word/streaming_model.cpp
index 47d2c70e13..0ab6cd3772 100644
--- a/esphome/components/micro_wake_word/streaming_model.cpp
+++ b/esphome/components/micro_wake_word/streaming_model.cpp
@@ -80,6 +80,7 @@ bool StreamingModel::load_model_() {
     TfLiteTensor *output = this->interpreter_->output(0);
     if ((output->dims->size != 2) || (output->dims->data[0] != 1) || (output->dims->data[1] != 1)) {
       ESP_LOGE(TAG, "Streaming model tensor output dimension is not 1x1.");
+      return false;
     }
 
     if (output->type != kTfLiteUInt8) {
diff --git a/esphome/components/voice_assistant/voice_assistant.cpp b/esphome/components/voice_assistant/voice_assistant.cpp
index 51d52a8af8..15124e422f 100644
--- a/esphome/components/voice_assistant/voice_assistant.cpp
+++ b/esphome/components/voice_assistant/voice_assistant.cpp
@@ -619,6 +619,8 @@ void VoiceAssistant::start_playback_timeout_() {
     this->cancel_timeout("speaker-timeout");
     this->set_state_(State::RESPONSE_FINISHED, State::RESPONSE_FINISHED);
 
+    if (this->api_client_ == nullptr)
+      return;
     api::VoiceAssistantAnnounceFinished msg;
     msg.success = true;
     this->api_client_->send_message(msg);

From fc67551edc0bfc4e5966e11b325c2d5277114df5 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Wed, 18 Mar 2026 07:48:43 -0400
Subject: [PATCH 06/14] [tc74][apds9960] Fix signed temperature and FIFO
 register address (#14907)

---
 esphome/components/apds9960/apds9960.cpp | 8 ++++----
 esphome/components/tc74/tc74.cpp         | 5 +++--
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/esphome/components/apds9960/apds9960.cpp b/esphome/components/apds9960/apds9960.cpp
index 260de82d14..a07175f2c9 100644
--- a/esphome/components/apds9960/apds9960.cpp
+++ b/esphome/components/apds9960/apds9960.cpp
@@ -251,11 +251,11 @@ void APDS9960::read_gesture_data_() {
 
   uint8_t buf[128];
   for (uint8_t pos = 0; pos < fifo_level * 4; pos += 32) {
-    // The ESP's i2c driver has a limited buffer size.
-    // This way of retrieving the data should be wrong according to the datasheet
-    // but it seems to work.
+    // Read in 32-byte chunks due to ESP8266 I2C buffer limit.
+    // Always read from 0xFC — the FIFO auto-increments through 0xFC-0xFF
+    // and advances its internal pointer after every 4th byte.
     uint8_t read = std::min(32, fifo_level * 4 - pos);
-    APDS9960_WARNING_CHECK(this->read_bytes(0xFC + pos, buf + pos, read), "Reading FIFO buffer failed.");
+    APDS9960_WARNING_CHECK(this->read_bytes(0xFC, buf + pos, read), "Reading FIFO buffer failed.");
   }
 
   if (millis() - this->gesture_start_ > 500) {
diff --git a/esphome/components/tc74/tc74.cpp b/esphome/components/tc74/tc74.cpp
index 969ef3671e..cb58e583dc 100644
--- a/esphome/components/tc74/tc74.cpp
+++ b/esphome/components/tc74/tc74.cpp
@@ -50,8 +50,9 @@ void TC74Component::read_temperature_() {
     }
   }
 
-  uint8_t temperature_reg;
-  if (this->read_register(TC74_REGISTER_TEMPERATURE, &temperature_reg, 1) != i2c::ERROR_OK) {
+  int8_t temperature_reg;
+  if (this->read_register(TC74_REGISTER_TEMPERATURE, reinterpret_cast<uint8_t *>(&temperature_reg), 1) !=
+      i2c::ERROR_OK) {
     this->status_set_warning();
     return;
   }

From 448402ca2cb49160c66472e3464dafe2209ab47b Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Wed, 18 Mar 2026 07:46:18 -1000
Subject: [PATCH 07/14] [http_request] Fix data race on update_info_ strings in
 update task (#14909)

---
 .../update/http_request_update.cpp            | 222 ++++++++++--------
 1 file changed, 121 insertions(+), 101 deletions(-)

diff --git a/esphome/components/http_request/update/http_request_update.cpp b/esphome/components/http_request/update/http_request_update.cpp
index c40590af95..a15dc61675 100644
--- a/esphome/components/http_request/update/http_request_update.cpp
+++ b/esphome/components/http_request/update/http_request_update.cpp
@@ -23,6 +23,12 @@ namespace http_request {
 
 static const char *const TAG = "http_request.update";
 
+// Wraps UpdateInfo + error for the task→main-loop handoff.
+struct TaskResult {
+  update::UpdateInfo info;
+  const LogString *error_str{nullptr};
+};
+
 static const size_t MAX_READ_SIZE = 256;
 static constexpr uint32_t INITIAL_CHECK_INTERVAL_ID = 0;
 static constexpr uint32_t INITIAL_CHECK_INTERVAL_MS = 10000;
@@ -77,134 +83,148 @@ void HttpRequestUpdate::update() {
 void HttpRequestUpdate::update_task(void *params) {
   HttpRequestUpdate *this_update = (HttpRequestUpdate *) params;
 
+  // Allocate once — every path below returns via the single defer at the end.
+  // On failure, error_str is set; on success it is nullptr.
+  auto *result = new TaskResult();
+  auto *info = &result->info;
+
   auto container = this_update->request_parent_->get(this_update->source_url_);
 
   if (container == nullptr || container->status_code != HTTP_STATUS_OK) {
     ESP_LOGE(TAG, "Failed to fetch manifest from %s", this_update->source_url_.c_str());
-    // Defer to main loop to avoid race condition on component_state_ read-modify-write
-    this_update->defer([this_update]() { this_update->status_set_error(LOG_STR("Failed to fetch manifest")); });
-    UPDATE_RETURN;
+    if (container != nullptr)
+      container->end();
+    result->error_str = LOG_STR("Failed to fetch manifest");
+    goto defer;  // NOLINT(cppcoreguidelines-avoid-goto)
   }
 
-  RAMAllocator<uint8_t> allocator;
-  uint8_t *data = allocator.allocate(container->content_length);
-  if (data == nullptr) {
-    ESP_LOGE(TAG, "Failed to allocate %zu bytes for manifest", container->content_length);
-    // Defer to main loop to avoid race condition on component_state_ read-modify-write
-    this_update->defer(
-        [this_update]() { this_update->status_set_error(LOG_STR("Failed to allocate memory for manifest")); });
-    container->end();
-    UPDATE_RETURN;
-  }
-
-  auto read_result = http_read_fully(container.get(), data, container->content_length, MAX_READ_SIZE,
-                                     this_update->request_parent_->get_timeout());
-  if (read_result.status != HttpReadStatus::OK) {
-    if (read_result.status == HttpReadStatus::TIMEOUT) {
-      ESP_LOGE(TAG, "Timeout reading manifest");
-    } else {
-      ESP_LOGE(TAG, "Error reading manifest: %d", read_result.error_code);
+  {
+    RAMAllocator<uint8_t> allocator;
+    uint8_t *data = allocator.allocate(container->content_length);
+    if (data == nullptr) {
+      ESP_LOGE(TAG, "Failed to allocate %zu bytes for manifest", container->content_length);
+      container->end();
+      result->error_str = LOG_STR("Failed to allocate memory for manifest");
+      goto defer;  // NOLINT(cppcoreguidelines-avoid-goto)
     }
-    // Defer to main loop to avoid race condition on component_state_ read-modify-write
-    this_update->defer([this_update]() { this_update->status_set_error(LOG_STR("Failed to read manifest")); });
-    allocator.deallocate(data, container->content_length);
-    container->end();
-    UPDATE_RETURN;
-  }
-  size_t read_index = container->get_bytes_read();
-  size_t content_length = container->content_length;
 
-  container->end();
-  container.reset();  // Release ownership of the container's shared_ptr
-
-  bool valid = false;
-  {  // Scope to ensure JsonDocument is destroyed before deallocating buffer
-    valid = json::parse_json(data, read_index, [this_update](JsonObject root) -> bool {
-      if (!root[ESPHOME_F("name")].is<const char *>() || !root[ESPHOME_F("version")].is<const char *>() ||
-          !root[ESPHOME_F("builds")].is<JsonArray>()) {
-        ESP_LOGE(TAG, "Manifest does not contain required fields");
-        return false;
+    auto read_result = http_read_fully(container.get(), data, container->content_length, MAX_READ_SIZE,
+                                       this_update->request_parent_->get_timeout());
+    if (read_result.status != HttpReadStatus::OK) {
+      if (read_result.status == HttpReadStatus::TIMEOUT) {
+        ESP_LOGE(TAG, "Timeout reading manifest");
+      } else {
+        ESP_LOGE(TAG, "Error reading manifest: %d", read_result.error_code);
       }
-      this_update->update_info_.title = root[ESPHOME_F("name")].as<std::string>();
-      this_update->update_info_.latest_version = root[ESPHOME_F("version")].as<std::string>();
+      allocator.deallocate(data, container->content_length);
+      container->end();
+      result->error_str = LOG_STR("Failed to read manifest");
+      goto defer;  // NOLINT(cppcoreguidelines-avoid-goto)
+    }
+    size_t read_index = container->get_bytes_read();
+    size_t content_length = container->content_length;
 
-      auto builds_array = root[ESPHOME_F("builds")].as<JsonArray>();
-      for (auto build : builds_array) {
-        if (!build[ESPHOME_F("chipFamily")].is<const char *>()) {
+    container->end();
+    container.reset();  // Release ownership of the container's shared_ptr
+
+    bool valid = false;
+    {  // Scope to ensure JsonDocument is destroyed before deallocating buffer
+      valid = json::parse_json(data, read_index, [info](JsonObject root) -> bool {
+        if (!root[ESPHOME_F("name")].is<const char *>() || !root[ESPHOME_F("version")].is<const char *>() ||
+            !root[ESPHOME_F("builds")].is<JsonArray>()) {
           ESP_LOGE(TAG, "Manifest does not contain required fields");
           return false;
         }
-        if (build[ESPHOME_F("chipFamily")] == ESPHOME_VARIANT) {
-          if (!build[ESPHOME_F("ota")].is<JsonObject>()) {
+        info->title = root[ESPHOME_F("name")].as<std::string>();
+        info->latest_version = root[ESPHOME_F("version")].as<std::string>();
+
+        auto builds_array = root[ESPHOME_F("builds")].as<JsonArray>();
+        for (auto build : builds_array) {
+          if (!build[ESPHOME_F("chipFamily")].is<const char *>()) {
             ESP_LOGE(TAG, "Manifest does not contain required fields");
             return false;
           }
-          JsonObject ota = build[ESPHOME_F("ota")].as<JsonObject>();
-          if (!ota[ESPHOME_F("path")].is<const char *>() || !ota[ESPHOME_F("md5")].is<const char *>()) {
-            ESP_LOGE(TAG, "Manifest does not contain required fields");
-            return false;
+          if (build[ESPHOME_F("chipFamily")] == ESPHOME_VARIANT) {
+            if (!build[ESPHOME_F("ota")].is<JsonObject>()) {
+              ESP_LOGE(TAG, "Manifest does not contain required fields");
+              return false;
+            }
+            JsonObject ota = build[ESPHOME_F("ota")].as<JsonObject>();
+            if (!ota[ESPHOME_F("path")].is<const char *>() || !ota[ESPHOME_F("md5")].is<const char *>()) {
+              ESP_LOGE(TAG, "Manifest does not contain required fields");
+              return false;
+            }
+            info->firmware_url = ota[ESPHOME_F("path")].as<std::string>();
+            info->md5 = ota[ESPHOME_F("md5")].as<std::string>();
+
+            if (ota[ESPHOME_F("summary")].is<const char *>())
+              info->summary = ota[ESPHOME_F("summary")].as<std::string>();
+            if (ota[ESPHOME_F("release_url")].is<const char *>())
+              info->release_url = ota[ESPHOME_F("release_url")].as<std::string>();
+
+            return true;
           }
-          this_update->update_info_.firmware_url = ota[ESPHOME_F("path")].as<std::string>();
-          this_update->update_info_.md5 = ota[ESPHOME_F("md5")].as<std::string>();
-
-          if (ota[ESPHOME_F("summary")].is<const char *>())
-            this_update->update_info_.summary = ota[ESPHOME_F("summary")].as<std::string>();
-          if (ota[ESPHOME_F("release_url")].is<const char *>())
-            this_update->update_info_.release_url = ota[ESPHOME_F("release_url")].as<std::string>();
-
-          return true;
         }
-      }
-      return false;
-    });
-  }
-  allocator.deallocate(data, content_length);
+        return false;
+      });
+    }
+    allocator.deallocate(data, content_length);
 
-  if (!valid) {
-    ESP_LOGE(TAG, "Failed to parse JSON from %s", this_update->source_url_.c_str());
-    // Defer to main loop to avoid race condition on component_state_ read-modify-write
-    this_update->defer([this_update]() { this_update->status_set_error(LOG_STR("Failed to parse manifest JSON")); });
-    UPDATE_RETURN;
-  }
+    if (!valid) {
+      ESP_LOGE(TAG, "Failed to parse JSON from %s", this_update->source_url_.c_str());
+      result->error_str = LOG_STR("Failed to parse manifest JSON");
+      goto defer;  // NOLINT(cppcoreguidelines-avoid-goto)
+    }
 
-  // Merge source_url_ and this_update->update_info_.firmware_url
-  if (this_update->update_info_.firmware_url.find("http") == std::string::npos) {
-    std::string path = this_update->update_info_.firmware_url;
-    if (path[0] == '/') {
-      std::string domain = this_update->source_url_.substr(0, this_update->source_url_.find('/', 8));
-      this_update->update_info_.firmware_url = domain + path;
-    } else {
-      std::string domain = this_update->source_url_.substr(0, this_update->source_url_.rfind('/') + 1);
-      this_update->update_info_.firmware_url = domain + path;
+    // Merge source_url_ and firmware_url
+    if (!info->firmware_url.empty() && info->firmware_url.find("http") == std::string::npos) {
+      std::string path = info->firmware_url;
+      if (path[0] == '/') {
+        std::string domain = this_update->source_url_.substr(0, this_update->source_url_.find('/', 8));
+        info->firmware_url = domain + path;
+      } else {
+        std::string domain = this_update->source_url_.substr(0, this_update->source_url_.rfind('/') + 1);
+        info->firmware_url = domain + path;
+      }
     }
-  }
 
 #ifdef ESPHOME_PROJECT_VERSION
-  this_update->update_info_.current_version = ESPHOME_PROJECT_VERSION;
+    info->current_version = ESPHOME_PROJECT_VERSION;
 #else
-  this_update->update_info_.current_version = ESPHOME_VERSION;
+    info->current_version = ESPHOME_VERSION;
 #endif
-
-  bool trigger_update_available = false;
-
-  if (this_update->update_info_.latest_version.empty() ||
-      this_update->update_info_.latest_version == this_update->update_info_.current_version) {
-    this_update->state_ = update::UPDATE_STATE_NO_UPDATE;
-  } else {
-    if (this_update->state_ != update::UPDATE_STATE_AVAILABLE) {
-      trigger_update_available = true;
-    }
-    this_update->state_ = update::UPDATE_STATE_AVAILABLE;
   }
 
-  // Defer to main loop to ensure thread-safe execution of:
-  // - status_clear_error() performs non-atomic read-modify-write on component_state_
-  // - publish_state() triggers API callbacks that write to the shared protobuf buffer
-  //   which can be corrupted if accessed concurrently from task and main loop threads
-  // - update_available trigger to ensure consistent state when the trigger fires
-  this_update->defer([this_update, trigger_update_available]() {
-    this_update->update_info_.has_progress = false;
-    this_update->update_info_.progress = 0.0f;
+defer:
+  // Release container before vTaskDelete (which doesn't call destructors)
+  container.reset();
+
+  // Defer to the main loop so all update_info_ and state_ writes happen on the
+  // same thread as readers (API, MQTT, web server). This is a single defer for
+  // both success and error paths to avoid multiple std::function instantiations.
+  // Lambda captures only 2 pointers (8 bytes) — fits in std::function SBO on supported toolchains.
+  this_update->defer([this_update, result]() {
+    if (result->error_str != nullptr) {
+      this_update->status_set_error(result->error_str);
+      delete result;
+      return;
+    }
+
+    // Determine new state on main loop (avoids extra lambda captures from task)
+    bool trigger_update_available = false;
+    update::UpdateState new_state;
+    if (result->info.latest_version.empty() || result->info.latest_version == result->info.current_version) {
+      new_state = update::UPDATE_STATE_NO_UPDATE;
+    } else {
+      new_state = update::UPDATE_STATE_AVAILABLE;
+      if (this_update->state_ != update::UPDATE_STATE_AVAILABLE) {
+        trigger_update_available = true;
+      }
+    }
+
+    this_update->update_info_ = std::move(result->info);
+    this_update->state_ = new_state;
+    delete result;  // Safe: moved-from state is valid for destruction
 
     this_update->status_clear_error();
     this_update->publish_state();

From af9366fdd4822cb5e8a1a7c571c08d6901993cc3 Mon Sep 17 00:00:00 2001
From: Jesse Hills <3060199+jesserockz@users.noreply.github.com>
Date: Thu, 19 Mar 2026 08:19:26 +1300
Subject: [PATCH 08/14] Bump version to 2026.3.0b5

---
 Doxyfile         | 2 +-
 esphome/const.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doxyfile b/Doxyfile
index ea34106f36..53eae48966 100644
--- a/Doxyfile
+++ b/Doxyfile
@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.3.0b4
+PROJECT_NUMBER         = 2026.3.0b5
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
diff --git a/esphome/const.py b/esphome/const.py
index 4ba8b1a23f..579235ff69 100644
--- a/esphome/const.py
+++ b/esphome/const.py
@@ -4,7 +4,7 @@ from enum import Enum
 
 from esphome.enum import StrEnum
 
-__version__ = "2026.3.0b4"
+__version__ = "2026.3.0b5"
 
 ALLOWED_NAME_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789-_"
 VALID_SUBSTITUTIONS_CHARACTERS = (

From 273419a2379eb53c848613d7e4b21a690d6468c2 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Wed, 18 Mar 2026 09:51:59 -1000
Subject: [PATCH 09/14] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 esphome/components/ota/ota_backend.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/esphome/components/ota/ota_backend.h b/esphome/components/ota/ota_backend.h
index cc6ef365be..bcefcf4f0d 100644
--- a/esphome/components/ota/ota_backend.h
+++ b/esphome/components/ota/ota_backend.h
@@ -75,7 +75,7 @@ class OTAComponent : public Component {
    */
   void notify_state_deferred_(OTAState state, float progress, uint8_t error) {
     // Pack state, error, and progress into a single uint32_t so the lambda
-    // captures only [this, packed] (8 bytes) — fits in std::function SBO.
+    // captures only [this, packed] (8 bytes) — intended to fit in std::function SBO on supported toolchains.
     // Layout: [state:8][error:8][progress_fixed:16] where progress is 0–10000 (0.01% resolution)
     uint32_t packed = (static_cast<uint32_t>(state) << 24) | (static_cast<uint32_t>(error) << 16) |
                       static_cast<uint16_t>(progress * 100.0f);

From cc0655a9048202ccd62fcca881b2fb6fc3a1b12d Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Wed, 18 Mar 2026 16:42:13 -0400
Subject: [PATCH 10/14] [bedjet][light][i2s_audio][ld2412] Fix uninitialized
 pointers, div-by-zero, and buffer validation (#14925)

---
 esphome/components/bedjet/bedjet_codec.h      |  2 +-
 .../i2s_audio/speaker/i2s_audio_speaker.h     |  2 +-
 esphome/components/ld2412/ld2412.cpp          | 41 +++++++------------
 esphome/components/light/effects.py           |  2 +-
 4 files changed, 18 insertions(+), 29 deletions(-)

diff --git a/esphome/components/bedjet/bedjet_codec.h b/esphome/components/bedjet/bedjet_codec.h
index 07aee32d54..3936ba2315 100644
--- a/esphome/components/bedjet/bedjet_codec.h
+++ b/esphome/components/bedjet/bedjet_codec.h
@@ -183,7 +183,7 @@ class BedjetCodec {
 
   BedjetPacket packet_;
 
-  BedjetStatusPacket *status_packet_;
+  BedjetStatusPacket *status_packet_{nullptr};
   BedjetStatusPacket buf_;
 };
 
diff --git a/esphome/components/i2s_audio/speaker/i2s_audio_speaker.h b/esphome/components/i2s_audio/speaker/i2s_audio_speaker.h
index 1d03a4c495..93ec754178 100644
--- a/esphome/components/i2s_audio/speaker/i2s_audio_speaker.h
+++ b/esphome/components/i2s_audio/speaker/i2s_audio_speaker.h
@@ -110,7 +110,7 @@ class I2SAudioSpeaker : public I2SAudioOut, public speaker::Speaker, public Comp
   TaskHandle_t speaker_task_handle_{nullptr};
   EventGroupHandle_t event_group_{nullptr};
 
-  QueueHandle_t i2s_event_queue_;
+  QueueHandle_t i2s_event_queue_{nullptr};
 
   std::weak_ptr<RingBuffer> audio_ring_buffer_;
 
diff --git a/esphome/components/ld2412/ld2412.cpp b/esphome/components/ld2412/ld2412.cpp
index 37578dd8da..6ff6963e9f 100644
--- a/esphome/components/ld2412/ld2412.cpp
+++ b/esphome/components/ld2412/ld2412.cpp
@@ -455,12 +455,10 @@ void LD2412Component::handle_periodic_data_() {
 }
 
 #ifdef USE_NUMBER
-std::function<void(void)> set_number_value(number::Number *n, float value) {
+void set_number_value(number::Number *n, float value) {
   if (n != nullptr && (!n->has_state() || n->state != value)) {
-    n->state = value;
-    return [n, value]() { n->publish_state(value); };
+    n->publish_state(value);
   }
-  return []() {};
 }
 #endif
 
@@ -504,6 +502,9 @@ bool LD2412Component::handle_ack_data_() {
       break;
 
     case CMD_QUERY_VERSION: {
+      if (this->buffer_pos_ < 12 + sizeof(this->version_)) {
+        return false;
+      }
       std::memcpy(this->version_, &this->buffer_data_[12], sizeof(this->version_));
       char version_s[20];
       ld24xx::format_version_str(this->version_, version_s);
@@ -596,13 +597,8 @@ bool LD2412Component::handle_ack_data_() {
 
     case CMD_QUERY_MOTION_GATE_SENS: {
 #ifdef USE_NUMBER
-      std::vector<std::function<void(void)>> updates;
-      updates.reserve(this->gate_still_threshold_numbers_.size());
-      for (size_t i = 0; i < this->gate_still_threshold_numbers_.size(); i++) {
-        updates.push_back(set_number_value(this->gate_move_threshold_numbers_[i], this->buffer_data_[10 + i]));
-      }
-      for (auto &update : updates) {
-        update();
+      for (size_t i = 0; i < this->gate_move_threshold_numbers_.size() && (10 + i) < this->buffer_pos_; i++) {
+        set_number_value(this->gate_move_threshold_numbers_[i], this->buffer_data_[10 + i]);
       }
 #endif
       break;
@@ -610,13 +606,8 @@ bool LD2412Component::handle_ack_data_() {
 
     case CMD_QUERY_STATIC_GATE_SENS: {
 #ifdef USE_NUMBER
-      std::vector<std::function<void(void)>> updates;
-      updates.reserve(this->gate_still_threshold_numbers_.size());
-      for (size_t i = 0; i < this->gate_still_threshold_numbers_.size(); i++) {
-        updates.push_back(set_number_value(this->gate_still_threshold_numbers_[i], this->buffer_data_[10 + i]));
-      }
-      for (auto &update : updates) {
-        update();
+      for (size_t i = 0; i < this->gate_still_threshold_numbers_.size() && (10 + i) < this->buffer_pos_; i++) {
+        set_number_value(this->gate_still_threshold_numbers_[i], this->buffer_data_[10 + i]);
       }
 #endif
       break;
@@ -625,20 +616,21 @@ bool LD2412Component::handle_ack_data_() {
     case CMD_QUERY_BASIC_CONF:  // Query parameters response
     {
 #ifdef USE_NUMBER
+      if (this->buffer_pos_ < 15) {
+        return false;
+      }
       /*
         Moving distance range: 9th byte
         Still distance range: 10th byte
       */
-      std::vector<std::function<void(void)>> updates;
-      updates.push_back(set_number_value(this->min_distance_gate_number_, this->buffer_data_[10]));
-      updates.push_back(set_number_value(this->max_distance_gate_number_, this->buffer_data_[11] - 1));
+      set_number_value(this->min_distance_gate_number_, this->buffer_data_[10]);
+      set_number_value(this->max_distance_gate_number_, this->buffer_data_[11] - 1);
       ESP_LOGV(TAG, "min_distance_gate_number_: %u, max_distance_gate_number_ %u", this->buffer_data_[10],
                this->buffer_data_[11]);
       /*
         None Duration: 11~12th bytes
       */
-      updates.push_back(
-          set_number_value(this->timeout_number_, encode_uint16(this->buffer_data_[13], this->buffer_data_[12])));
+      set_number_value(this->timeout_number_, encode_uint16(this->buffer_data_[13], this->buffer_data_[12]));
       ESP_LOGV(TAG, "timeout_number_: %u", encode_uint16(this->buffer_data_[13], this->buffer_data_[12]));
       /*
         Output pin configuration: 13th bytes
@@ -650,9 +642,6 @@ bool LD2412Component::handle_ack_data_() {
         this->out_pin_level_select_->publish_state(out_pin_level_str);
       }
 #endif
-      for (auto &update : updates) {
-        update();
-      }
 #endif
     } break;
     default:
diff --git a/esphome/components/light/effects.py b/esphome/components/light/effects.py
index 15d9272d1a..4088a78e0d 100644
--- a/esphome/components/light/effects.py
+++ b/esphome/components/light/effects.py
@@ -392,7 +392,7 @@ async def addressable_lambda_effect_to_code(config, effect_id):
     "Rainbow",
     {
         cv.Optional(CONF_SPEED, default=10): cv.uint32_t,
-        cv.Optional(CONF_WIDTH, default=50): cv.uint32_t,
+        cv.Optional(CONF_WIDTH, default=50): cv.int_range(min=1, max=65535),
     },
 )
 async def addressable_rainbow_effect_to_code(config, effect_id):

From 4a93d5b54465647a8abfa226e2091650d9057b4c Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Wed, 18 Mar 2026 16:42:53 -0400
Subject: [PATCH 11/14] [vl53l0x][ld2420][ble_client][inkplate] Fix state
 corruption, crash, OOB read, and shift UB (#14919)

---
 .../ble_client/sensor/ble_sensor.cpp          |  8 +++++++-
 .../text_sensor/ble_text_sensor.cpp           |  4 ++++
 esphome/components/inkplate/inkplate.cpp      |  2 +-
 esphome/components/inkplate/inkplate.h        | 20 +++++++++----------
 esphome/components/ld2420/ld2420.cpp          | 20 +++++++++++--------
 esphome/components/vl53l0x/vl53l0x_sensor.cpp |  1 +
 6 files changed, 35 insertions(+), 20 deletions(-)

diff --git a/esphome/components/ble_client/sensor/ble_sensor.cpp b/esphome/components/ble_client/sensor/ble_sensor.cpp
index fe5f11bbc2..4bd871dc81 100644
--- a/esphome/components/ble_client/sensor/ble_sensor.cpp
+++ b/esphome/components/ble_client/sensor/ble_sensor.cpp
@@ -102,6 +102,10 @@ void BLESensor::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t ga
       break;
     }
     case ESP_GATTC_NOTIFY_EVT: {
+      if (param->notify.value_len == 0) {
+        ESP_LOGW(TAG, "[%s] ESP_GATTC_NOTIFY_EVT: empty value", this->get_name().c_str());
+        break;
+      }
       ESP_LOGD(TAG, "[%s] ESP_GATTC_NOTIFY_EVT: handle=0x%x, value=0x%x", this->get_name().c_str(),
                param->notify.handle, param->notify.value[0]);
       if (param->notify.handle != this->handle)
@@ -131,8 +135,10 @@ float BLESensor::parse_data_(uint8_t *value, uint16_t value_len) {
   if (this->has_data_to_value_) {
     std::vector<uint8_t> data(value, value + value_len);
     return this->data_to_value_func_(data);
-  } else {
+  } else if (value_len > 0) {
     return value[0];
+  } else {
+    return NAN;
   }
 }
 
diff --git a/esphome/components/ble_client/text_sensor/ble_text_sensor.cpp b/esphome/components/ble_client/text_sensor/ble_text_sensor.cpp
index cacf1b4835..7eaa6af076 100644
--- a/esphome/components/ble_client/text_sensor/ble_text_sensor.cpp
+++ b/esphome/components/ble_client/text_sensor/ble_text_sensor.cpp
@@ -104,6 +104,10 @@ void BLETextSensor::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_
     case ESP_GATTC_NOTIFY_EVT: {
       if (param->notify.handle != this->handle)
         break;
+      if (param->notify.value_len == 0) {
+        ESP_LOGW(TAG, "[%s] ESP_GATTC_NOTIFY_EVT: empty value", this->get_name().c_str());
+        break;
+      }
       ESP_LOGV(TAG, "[%s] ESP_GATTC_NOTIFY_EVT: handle=0x%x, value=0x%x", this->get_name().c_str(),
                param->notify.handle, param->notify.value[0]);
       this->publish_state(reinterpret_cast<const char *>(param->notify.value), param->notify.value_len);
diff --git a/esphome/components/inkplate/inkplate.cpp b/esphome/components/inkplate/inkplate.cpp
index 7551c6fc77..326bdff774 100644
--- a/esphome/components/inkplate/inkplate.cpp
+++ b/esphome/components/inkplate/inkplate.cpp
@@ -229,7 +229,7 @@ void Inkplate::eink_off_() {
   this->oe_pin_->digital_write(false);
   this->gmod_pin_->digital_write(false);
 
-  GPIO.out &= ~(this->get_data_pin_mask_() | (1 << this->cl_pin_->get_pin()) | (1 << this->le_pin_->get_pin()));
+  GPIO.out &= ~(this->get_data_pin_mask_() | (1UL << this->cl_pin_->get_pin()) | (1UL << this->le_pin_->get_pin()));
   this->ckv_pin_->digital_write(false);
   this->sph_pin_->digital_write(false);
   this->spv_pin_->digital_write(false);
diff --git a/esphome/components/inkplate/inkplate.h b/esphome/components/inkplate/inkplate.h
index fb4674b522..bcd56b829a 100644
--- a/esphome/components/inkplate/inkplate.h
+++ b/esphome/components/inkplate/inkplate.h
@@ -152,16 +152,16 @@ class Inkplate : public display::DisplayBuffer, public i2c::I2CDevice {
 
   size_t get_buffer_length_();
 
-  int get_data_pin_mask_() {
-    int data = 0;
-    data |= (1 << this->display_data_0_pin_->get_pin());
-    data |= (1 << this->display_data_1_pin_->get_pin());
-    data |= (1 << this->display_data_2_pin_->get_pin());
-    data |= (1 << this->display_data_3_pin_->get_pin());
-    data |= (1 << this->display_data_4_pin_->get_pin());
-    data |= (1 << this->display_data_5_pin_->get_pin());
-    data |= (1 << this->display_data_6_pin_->get_pin());
-    data |= (1 << this->display_data_7_pin_->get_pin());
+  uint32_t get_data_pin_mask_() {
+    uint32_t data = 0;
+    data |= (1UL << this->display_data_0_pin_->get_pin());
+    data |= (1UL << this->display_data_1_pin_->get_pin());
+    data |= (1UL << this->display_data_2_pin_->get_pin());
+    data |= (1UL << this->display_data_3_pin_->get_pin());
+    data |= (1UL << this->display_data_4_pin_->get_pin());
+    data |= (1UL << this->display_data_5_pin_->get_pin());
+    data |= (1UL << this->display_data_6_pin_->get_pin());
+    data |= (1UL << this->display_data_7_pin_->get_pin());
     return data;
   }
 
diff --git a/esphome/components/ld2420/ld2420.cpp b/esphome/components/ld2420/ld2420.cpp
index 1e671363c9..ae622cda28 100644
--- a/esphome/components/ld2420/ld2420.cpp
+++ b/esphome/components/ld2420/ld2420.cpp
@@ -170,14 +170,18 @@ static uint8_t calc_checksum(void *data, size_t size) {
   return checksum;
 }
 
-static int get_firmware_int(const char *version_string) {
-  std::string version_str = version_string;
-  if (version_str[0] == 'v') {
-    version_str.erase(0, 1);
+static int32_t get_firmware_int(const char *version_string) {
+  // Convert "v1.5.4" -> 154 by skipping 'v' and '.', accumulating digits
+  const char *p = (*version_string == 'v') ? version_string + 1 : version_string;
+  int32_t result = 0;
+  for (; *p != '\0'; p++) {
+    if (*p == '.')
+      continue;
+    if (*p < '0' || *p > '9')
+      return 0;
+    result = result * 10 + (*p - '0');
   }
-  version_str.erase(remove(version_str.begin(), version_str.end(), '.'), version_str.end());
-  int version_integer = stoi(version_str);
-  return version_integer;
+  return result;
 }
 
 float LD2420Component::get_setup_priority() const { return setup_priority::BUS; }
@@ -683,7 +687,7 @@ int LD2420Component::send_cmd_from_array(CmdFrameT frame) {
       retry = 0;
     }
     if (this->cmd_reply_.error > 0) {
-      this->handle_cmd_error(error);
+      this->handle_cmd_error(this->cmd_reply_.error);
     }
   }
   return error;
diff --git a/esphome/components/vl53l0x/vl53l0x_sensor.cpp b/esphome/components/vl53l0x/vl53l0x_sensor.cpp
index 0b2b40d723..8a76ed7760 100644
--- a/esphome/components/vl53l0x/vl53l0x_sensor.cpp
+++ b/esphome/components/vl53l0x/vl53l0x_sensor.cpp
@@ -266,6 +266,7 @@ void VL53L0XSensor::update() {
     this->status_momentary_warning("update", 5000);
     ESP_LOGW(TAG, "%s - update called before prior reading complete - initiated:%d waiting_for_interrupt:%d",
              this->name_.c_str(), this->initiated_read_, this->waiting_for_interrupt_);
+    return;
   }
 
   // initiate single shot measurement

From 73a49493a261a2a7fb748875e66d85bf0ff2b050 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Wed, 18 Mar 2026 16:43:42 -0400
Subject: [PATCH 12/14] [vbus][shelly_dimmer][st7789v][modbus_controller] Fix
 integer overflows, off-by-one, and coordinate swap (#14916)

---
 .../modbus_controller/modbus_controller.h     |  2 +-
 .../shelly_dimmer/shelly_dimmer.cpp           |  2 +-
 esphome/components/st7789v/st7789v.cpp        |  4 +--
 .../components/vbus/sensor/vbus_sensor.cpp    | 26 ++++++++++++-------
 esphome/components/vbus/vbus.cpp              |  3 +--
 5 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/esphome/components/modbus_controller/modbus_controller.h b/esphome/components/modbus_controller/modbus_controller.h
index fca2926568..bd3d4d705e 100644
--- a/esphome/components/modbus_controller/modbus_controller.h
+++ b/esphome/components/modbus_controller/modbus_controller.h
@@ -178,7 +178,7 @@ template<typename N> N mask_and_shift_by_rightbit(N data, uint32_t mask) {
     return result;
   }
   for (size_t pos = 0; pos < sizeof(N) << 3; pos++) {
-    if ((mask & (1 << pos)) != 0)
+    if ((mask & (1UL << pos)) != 0)
       return result >> pos;
   }
   return 0;
diff --git a/esphome/components/shelly_dimmer/shelly_dimmer.cpp b/esphome/components/shelly_dimmer/shelly_dimmer.cpp
index 88fcbcbfe1..230fb963b1 100644
--- a/esphome/components/shelly_dimmer/shelly_dimmer.cpp
+++ b/esphome/components/shelly_dimmer/shelly_dimmer.cpp
@@ -402,7 +402,7 @@ bool ShellyDimmer::handle_frame_() {
   // Handle response.
   switch (cmd) {
     case SHELLY_DIMMER_PROTO_CMD_POLL: {
-      if (payload_len < 16) {
+      if (payload_len < 17) {
         return false;
       }
 
diff --git a/esphome/components/st7789v/st7789v.cpp b/esphome/components/st7789v/st7789v.cpp
index 6e4360ae74..dc03fb04ca 100644
--- a/esphome/components/st7789v/st7789v.cpp
+++ b/esphome/components/st7789v/st7789v.cpp
@@ -156,9 +156,9 @@ void ST7789V::update() {
 void ST7789V::set_model_str(const char *model_str) { this->model_str_ = model_str; }
 
 void ST7789V::write_display_data() {
-  uint16_t x1 = this->offset_height_;
+  uint16_t x1 = this->offset_width_;
   uint16_t x2 = x1 + get_width_internal() - 1;
-  uint16_t y1 = this->offset_width_;
+  uint16_t y1 = this->offset_height_;
   uint16_t y2 = y1 + get_height_internal() - 1;
 
   this->enable();
diff --git a/esphome/components/vbus/sensor/vbus_sensor.cpp b/esphome/components/vbus/sensor/vbus_sensor.cpp
index 1cabb49703..407a81c83b 100644
--- a/esphome/components/vbus/sensor/vbus_sensor.cpp
+++ b/esphome/components/vbus/sensor/vbus_sensor.cpp
@@ -48,8 +48,8 @@ void DeltaSolBSPlusSensor::handle_message(std::vector<uint8_t> &message) {
   if (this->operating_hours2_sensor_ != nullptr)
     this->operating_hours2_sensor_->publish_state(get_u16(message, 18));
   if (this->heat_quantity_sensor_ != nullptr) {
-    this->heat_quantity_sensor_->publish_state(get_u16(message, 20) + get_u16(message, 22) * 1000 +
-                                               get_u16(message, 24) * 1000000);
+    this->heat_quantity_sensor_->publish_state(get_u16(message, 20) + get_u16(message, 22) * 1000.0f +
+                                               get_u16(message, 24) * 1000000.0f);
   }
   if (this->time_sensor_ != nullptr)
     this->time_sensor_->publish_state(get_u16(message, 12));
@@ -130,8 +130,8 @@ void DeltaSolCSensor::handle_message(std::vector<uint8_t> &message) {
   if (this->operating_hours2_sensor_ != nullptr)
     this->operating_hours2_sensor_->publish_state(get_u16(message, 14));
   if (this->heat_quantity_sensor_ != nullptr) {
-    this->heat_quantity_sensor_->publish_state(get_u16(message, 16) + get_u16(message, 18) * 1000 +
-                                               get_u16(message, 20) * 1000000);
+    this->heat_quantity_sensor_->publish_state(get_u16(message, 16) + get_u16(message, 18) * 1000.0f +
+                                               get_u16(message, 20) * 1000000.0f);
   }
   if (this->time_sensor_ != nullptr)
     this->time_sensor_->publish_state(get_u16(message, 22));
@@ -162,8 +162,10 @@ void DeltaSolCS2Sensor::handle_message(std::vector<uint8_t> &message) {
     this->pump_speed_sensor_->publish_state(message[12]);
   if (this->operating_hours_sensor_ != nullptr)
     this->operating_hours_sensor_->publish_state(get_u16(message, 14));
-  if (this->heat_quantity_sensor_ != nullptr)
-    this->heat_quantity_sensor_->publish_state((get_u16(message, 26) << 16) + get_u16(message, 24));
+  if (this->heat_quantity_sensor_ != nullptr) {
+    this->heat_quantity_sensor_->publish_state((static_cast<uint32_t>(get_u16(message, 26)) << 16) |
+                                               get_u16(message, 24));
+  }
   if (this->version_sensor_ != nullptr)
     this->version_sensor_->publish_state(get_u16(message, 28) * 0.01f);
 }
@@ -204,8 +206,10 @@ void DeltaSolCS4Sensor::handle_message(std::vector<uint8_t> &message) {
     this->operating_hours1_sensor_->publish_state(get_u16(message, 10));
   if (this->operating_hours2_sensor_ != nullptr)
     this->operating_hours2_sensor_->publish_state(get_u16(message, 14));
-  if (this->heat_quantity_sensor_ != nullptr)
-    this->heat_quantity_sensor_->publish_state((get_u16(message, 30) << 16) + get_u16(message, 28));
+  if (this->heat_quantity_sensor_ != nullptr) {
+    this->heat_quantity_sensor_->publish_state((static_cast<uint32_t>(get_u16(message, 30)) << 16) |
+                                               get_u16(message, 28));
+  }
   if (this->time_sensor_ != nullptr)
     this->time_sensor_->publish_state(get_u16(message, 22));
   if (this->version_sensor_ != nullptr)
@@ -250,8 +254,10 @@ void DeltaSolCSPlusSensor::handle_message(std::vector<uint8_t> &message) {
     this->operating_hours1_sensor_->publish_state(get_u16(message, 10));
   if (this->operating_hours2_sensor_ != nullptr)
     this->operating_hours2_sensor_->publish_state(get_u16(message, 14));
-  if (this->heat_quantity_sensor_ != nullptr)
-    this->heat_quantity_sensor_->publish_state((get_u16(message, 30) << 16) + get_u16(message, 28));
+  if (this->heat_quantity_sensor_ != nullptr) {
+    this->heat_quantity_sensor_->publish_state((static_cast<uint32_t>(get_u16(message, 30)) << 16) |
+                                               get_u16(message, 28));
+  }
   if (this->time_sensor_ != nullptr)
     this->time_sensor_->publish_state(get_u16(message, 22));
   if (this->version_sensor_ != nullptr)
diff --git a/esphome/components/vbus/vbus.cpp b/esphome/components/vbus/vbus.cpp
index c6786ee31e..195d6ed568 100644
--- a/esphome/components/vbus/vbus.cpp
+++ b/esphome/components/vbus/vbus.cpp
@@ -67,8 +67,7 @@ void VBus::loop() {
         }
         septet_spread(this->buffer_.data(), 7, 6, this->buffer_[13]);
         uint16_t id = (this->buffer_[8] << 8) + this->buffer_[7];
-        uint32_t value =
-            (this->buffer_[12] << 24) + (this->buffer_[11] << 16) + (this->buffer_[10] << 8) + this->buffer_[9];
+        uint32_t value = encode_uint32(this->buffer_[12], this->buffer_[11], this->buffer_[10], this->buffer_[9]);
         ESP_LOGV(TAG, "P1 C%04x %04x->%04x: %04x %04" PRIx32 " (%" PRIu32 ")", this->command_, this->source_,
                  this->dest_, id, value, value);
       } else if ((this->protocol_ == 0x10) && (this->buffer_.size() == 9)) {

From 8ee6392b0154378ca336e48b2fd9729ea3343952 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Wed, 18 Mar 2026 10:45:57 -1000
Subject: [PATCH 13/14] [ota] Add static_assert for OTAState packing assumption

---
 esphome/components/ota/ota_backend.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/esphome/components/ota/ota_backend.h b/esphome/components/ota/ota_backend.h
index bcefcf4f0d..8a71135477 100644
--- a/esphome/components/ota/ota_backend.h
+++ b/esphome/components/ota/ota_backend.h
@@ -77,6 +77,7 @@ class OTAComponent : public Component {
     // Pack state, error, and progress into a single uint32_t so the lambda
     // captures only [this, packed] (8 bytes) — intended to fit in std::function SBO on supported toolchains.
     // Layout: [state:8][error:8][progress_fixed:16] where progress is 0–10000 (0.01% resolution)
+    static_assert(OTA_ERROR <= 0xFF, "OTAState must fit in 8 bits for packing");
     uint32_t packed = (static_cast<uint32_t>(state) << 24) | (static_cast<uint32_t>(error) << 16) |
                       static_cast<uint16_t>(progress * 100.0f);
     this->defer([this, packed]() {

From 7cc3bf64254f20a8d7aa570b47397238b3d52a5a Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Wed, 18 Mar 2026 10:54:46 -1000
Subject: [PATCH 14/14] [ota] Move notify_state_deferred_ out of header to
 avoid inlining at 8 call sites

---
 esphome/components/ota/ota_backend.cpp | 13 +++++++++++++
 esphome/components/ota/ota_backend.h   | 13 +------------
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/esphome/components/ota/ota_backend.cpp b/esphome/components/ota/ota_backend.cpp
index 8fb9f67214..01a18a58ef 100644
--- a/esphome/components/ota/ota_backend.cpp
+++ b/esphome/components/ota/ota_backend.cpp
@@ -13,6 +13,19 @@ OTAGlobalCallback *get_global_ota_callback() {
   return global_ota_callback;
 }
 
+void OTAComponent::notify_state_deferred_(OTAState state, float progress, uint8_t error) {
+  // Pack state, error, and progress into a single uint32_t so the lambda
+  // captures only [this, packed] (8 bytes) — fits in std::function SBO.
+  // Layout: [state:8][error:8][progress_fixed:16] where progress is 0–10000 (0.01% resolution)
+  static_assert(OTA_ERROR <= 0xFF, "OTAState must fit in 8 bits for packing");
+  uint32_t packed = (static_cast<uint32_t>(state) << 24) | (static_cast<uint32_t>(error) << 16) |
+                    static_cast<uint16_t>(progress * 100.0f);
+  this->defer([this, packed]() {
+    this->notify_state_(static_cast<OTAState>(packed >> 24), static_cast<float>(packed & 0xFFFF) / 100.0f,
+                        static_cast<uint8_t>(packed >> 16));
+  });
+}
+
 void OTAComponent::notify_state_(OTAState state, float progress, uint8_t error) {
   for (auto *listener : this->state_listeners_) {
     listener->on_ota_state(state, progress, error);
diff --git a/esphome/components/ota/ota_backend.h b/esphome/components/ota/ota_backend.h
index 8a71135477..ab0ec58e8a 100644
--- a/esphome/components/ota/ota_backend.h
+++ b/esphome/components/ota/ota_backend.h
@@ -73,18 +73,7 @@ class OTAComponent : public Component {
    * This should be used by OTA implementations that run in separate tasks
    * (like web_server OTA) to ensure listeners execute in the main loop.
    */
-  void notify_state_deferred_(OTAState state, float progress, uint8_t error) {
-    // Pack state, error, and progress into a single uint32_t so the lambda
-    // captures only [this, packed] (8 bytes) — intended to fit in std::function SBO on supported toolchains.
-    // Layout: [state:8][error:8][progress_fixed:16] where progress is 0–10000 (0.01% resolution)
-    static_assert(OTA_ERROR <= 0xFF, "OTAState must fit in 8 bits for packing");
-    uint32_t packed = (static_cast<uint32_t>(state) << 24) | (static_cast<uint32_t>(error) << 16) |
-                      static_cast<uint16_t>(progress * 100.0f);
-    this->defer([this, packed]() {
-      this->notify_state_(static_cast<OTAState>(packed >> 24), static_cast<float>(packed & 0xFFFF) / 100.0f,
-                          static_cast<uint8_t>(packed >> 16));
-    });
-  }
+  void notify_state_deferred_(OTAState state, float progress, uint8_t error);
 
   std::vector<OTAStateListener *> state_listeners_;
 #endif