From a497174da24cd864cade284a17e89c9732479ba6 Mon Sep 17 00:00:00 2001
From: "esphome[bot]" <115708604+esphome[bot]@users.noreply.github.com>
Date: Fri, 19 Jun 2026 10:05:20 +1200
Subject: [PATCH 01/29] Bump bundled esphome-device-builder to 1.0.10 (#17051)

---
 docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 18a99037351..221121c8d38 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -32,7 +32,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.0.9
+RUN uv pip install --no-cache-dir esphome-device-builder==1.0.10
 
 RUN \
     platformio settings set enable_telemetry No \

From ac5a28301a51ad3a68a8e863465e618d494e87a6 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Wed, 17 Jun 2026 22:11:24 -0500
Subject: [PATCH 02/29] [core] Honor transferred address cache in
 has_resolvable_address (#17025)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 esphome/__main__.py           |  6 ++++++
 tests/unit_tests/test_main.py | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/esphome/__main__.py b/esphome/__main__.py
index f7d3f8e834b..27dd878495d 100644
--- a/esphome/__main__.py
+++ b/esphome/__main__.py
@@ -504,6 +504,12 @@ def has_resolvable_address() -> bool:
     if has_ip_address():
         return True
 
+    # The dashboard pre-resolves the device and passes the IPs via
+    # --mdns-address-cache/--dns-address-cache; honor a cached address even when the
+    # device has mDNS disabled (e.g. a .local host found via ping).
+    if CORE.address_cache and CORE.address_cache.get_addresses(CORE.address):
+        return True
+
     if has_mdns():
         return True
 
diff --git a/tests/unit_tests/test_main.py b/tests/unit_tests/test_main.py
index 03c005dc276..e44f746a750 100644
--- a/tests/unit_tests/test_main.py
+++ b/tests/unit_tests/test_main.py
@@ -689,6 +689,25 @@ def test_choose_upload_log_host_with_ota_device_with_ota_config() -> None:
     assert result == ["192.168.1.100"]
 
 
+def test_choose_upload_log_host_ota_mdns_disabled_uses_address_cache() -> None:
+    """A .local device with mDNS disabled resolves via the dashboard-supplied cache."""
+    setup_core(
+        config={
+            CONF_API: {},
+            CONF_OTA: [{CONF_PLATFORM: CONF_ESPHOME}],
+            CONF_MDNS: {CONF_DISABLED: True},
+        },
+        address="esp32-a1s.local",
+    )
+    CORE.address_cache = AddressCache(mdns_cache={"esp32-a1s.local": ["192.168.1.50"]})
+
+    for purpose in (Purpose.LOGGING, Purpose.UPLOADING):
+        result = choose_upload_log_host(
+            default="OTA", check_default=None, purpose=purpose
+        )
+        assert result == ["192.168.1.50"]
+
+
 def test_choose_upload_log_host_with_ota_device_with_api_config() -> None:
     """Test OTA device when API is configured (no upload without OTA in config)."""
     setup_core(config={CONF_API: {}}, address="192.168.1.100")
@@ -3135,6 +3154,22 @@ def test_has_resolvable_address() -> None:
     setup_core(config={CONF_MDNS: {CONF_DISABLED: True}}, address=None)
     assert has_resolvable_address() is False
 
+    # mDNS disabled + .local, but the dashboard cached the address -> resolvable
+    setup_core(
+        config={CONF_MDNS: {CONF_DISABLED: True}}, address="esphome-device.local"
+    )
+    CORE.address_cache = AddressCache(
+        mdns_cache={"esphome-device.local": ["192.168.1.100"]}
+    )
+    assert has_resolvable_address() is True
+
+    # mDNS disabled + .local, cache present but missing this host -> not resolvable
+    setup_core(
+        config={CONF_MDNS: {CONF_DISABLED: True}}, address="esphome-device.local"
+    )
+    CORE.address_cache = AddressCache(mdns_cache={"other-device.local": ["10.0.0.1"]})
+    assert has_resolvable_address() is False
+
 
 def test_has_name_add_mac_suffix() -> None:
     """Test has_name_add_mac_suffix function."""

From 86096b96f583a1902de8c4b935826c4f69fdeac4 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Thu, 18 Jun 2026 15:38:57 -0400
Subject: [PATCH 03/29] [build] Skip target-platform deps when populating host
 unit-test config (#17039)

---
 script/build_helpers.py            | 21 ++++++---
 tests/script/test_build_helpers.py | 76 ++++++++++++++++++++++++++++++
 tests/script/test_test_helpers.py  |  2 +
 3 files changed, 93 insertions(+), 6 deletions(-)
 create mode 100644 tests/script/test_build_helpers.py

diff --git a/script/build_helpers.py b/script/build_helpers.py
index eaf3a1f1a7c..50830c221ea 100644
--- a/script/build_helpers.py
+++ b/script/build_helpers.py
@@ -70,12 +70,15 @@ def populate_dependency_config(
 
     * ``domain.platform`` form (e.g. ``sensor.gpio``) appends
       ``{platform: <name>}`` to ``config[domain]``, creating the list if needed.
-    * Bare components are looked up via ``get_component_fn``. Platform
-      components (``IS_PLATFORM_COMPONENT``) and ``MULTI_CONF`` components are
-      initialised as ``[]`` so the sibling ``domain.platform`` branch can
-      ``append`` into them. Everything else is populated by running the
-      component's schema with ``{}`` so defaults exist; if the schema requires
-      explicit input, an empty ``{}`` is used as a fallback.
+    * Bare components are looked up via ``get_component_fn``. Target-platform
+      components (``is_target_platform``, e.g. ``esp32``) are skipped entirely:
+      a host build targets ``host``, so a foreign target platform's sources are
+      guarded out and its schema must not run here (it would mutate global CORE
+      state as a side effect). Platform components (``IS_PLATFORM_COMPONENT``)
+      and ``MULTI_CONF`` components are initialised as ``[]`` so the sibling
+      ``domain.platform`` branch can ``append`` into them. Everything else is
+      populated by running the component's schema with ``{}`` so defaults exist;
+      if the schema requires explicit input, an empty ``{}`` is used as a fallback.
 
     Platform components must always be a list here even when no
     ``domain.platform`` entry follows, because the ``domain.platform`` branch
@@ -96,6 +99,12 @@ def populate_dependency_config(
         component = get_component_fn(component_name)
         if component is None:
             continue
+        # Skip target platforms (e.g. esp32): a host build targets `host`, so a
+        # foreign target's sources are guarded out, and running its schema with
+        # {} leaks global CORE state (esp32 pins CORE.toolchain to ESP-IDF),
+        # crashing the host compile. See #17035.
+        if component.is_target_platform:
+            continue
         if component.multi_conf or component.is_platform_component:
             config.setdefault(component_name, [])
         elif component_name not in config:
diff --git a/tests/script/test_build_helpers.py b/tests/script/test_build_helpers.py
new file mode 100644
index 00000000000..efa6a754839
--- /dev/null
+++ b/tests/script/test_build_helpers.py
@@ -0,0 +1,76 @@
+"""Unit tests for script/build_helpers.py."""
+
+from pathlib import Path
+import sys
+
+import pytest
+
+# Add the script directory to the path so we can import build_helpers.
+sys.path.insert(0, str(Path(__file__).parent.parent.parent / "script"))
+
+import build_helpers  # noqa: E402
+
+from esphome.core import CORE  # noqa: E402
+
+
+class _FakeComponent:
+    def __init__(self, config_schema, *, is_target_platform=False):
+        self.multi_conf = False
+        self.is_platform_component = False
+        self.is_target_platform = is_target_platform
+        self.config_schema = config_schema
+
+
+@pytest.fixture(autouse=True)
+def _restore_core_toolchain():
+    """Keep CORE.toolchain changes from leaking between tests."""
+    saved = CORE.toolchain
+    try:
+        yield
+    finally:
+        CORE.toolchain = saved
+
+
+def test_populate_dependency_config_skips_target_platforms() -> None:
+    """Target-platform deps must be skipped, not config-populated, in a host build.
+
+    Regression test for #17035: esp32 (a target platform) appears only as a
+    transitive dependency of a host C++ unit test. Running its schema with {}
+    set ``CORE.toolchain = ESP_IDF`` as a side effect before failing validation,
+    which crashed the host compile with KeyError('esp32'). The fix skips
+    target-platform components entirely so their schema never runs.
+    """
+    CORE.toolchain = None  # the state a host build starts from
+    schema_calls = []
+
+    def leaky_schema(value):
+        # If this ever runs for a target platform, the bug is back.
+        schema_calls.append(value)
+        CORE.toolchain = "esp-idf-leak"
+        raise ValueError("no board or variant")
+
+    config: dict = {}
+    build_helpers.populate_dependency_config(
+        config,
+        ["esp32"],
+        get_component_fn=lambda name: _FakeComponent(
+            leaky_schema, is_target_platform=True
+        ),
+        register_platform_fn=lambda domain: None,
+    )
+
+    assert "esp32" not in config  # skipped: no synthesized entry
+    assert schema_calls == []  # schema never run
+    assert CORE.toolchain is None  # no global side effect leaked
+
+
+def test_populate_dependency_config_populates_defaults() -> None:
+    """A non-target-platform dep still has its schema defaults harvested."""
+    config: dict = {}
+    build_helpers.populate_dependency_config(
+        config,
+        ["ok"],
+        get_component_fn=lambda name: _FakeComponent(lambda value: {"default": 1}),
+        register_platform_fn=lambda domain: None,
+    )
+    assert config["ok"] == {"default": 1}
diff --git a/tests/script/test_test_helpers.py b/tests/script/test_test_helpers.py
index a8100252da1..4b05cab3767 100644
--- a/tests/script/test_test_helpers.py
+++ b/tests/script/test_test_helpers.py
@@ -266,11 +266,13 @@ def _make_component_stub(
     *,
     multi_conf: bool = False,
     is_platform_component: bool = False,
+    is_target_platform: bool = False,
     config_schema=None,
 ) -> MagicMock:
     stub = MagicMock()
     stub.multi_conf = multi_conf
     stub.is_platform_component = is_platform_component
+    stub.is_target_platform = is_target_platform
     stub.config_schema = config_schema
     return stub
 

From a84ad7b1f8533138cb8552c3e6cd600875cb2607 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Thu, 18 Jun 2026 15:43:17 -0400
Subject: [PATCH 04/29] [uptime] Revert timestamp sensor device_class to
 timestamp (#17037)

---
 esphome/components/uptime/sensor/__init__.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/esphome/components/uptime/sensor/__init__.py b/esphome/components/uptime/sensor/__init__.py
index 6ce0795cdb7..e2a7aee1a2f 100644
--- a/esphome/components/uptime/sensor/__init__.py
+++ b/esphome/components/uptime/sensor/__init__.py
@@ -4,7 +4,7 @@ import esphome.config_validation as cv
 from esphome.const import (
     CONF_TIME_ID,
     DEVICE_CLASS_DURATION,
-    DEVICE_CLASS_UPTIME,
+    DEVICE_CLASS_TIMESTAMP,
     ENTITY_CATEGORY_DIAGNOSTIC,
     ICON_TIMER,
     STATE_CLASS_TOTAL_INCREASING,
@@ -33,8 +33,9 @@ CONFIG_SCHEMA = cv.typed_schema(
         ).extend(cv.polling_component_schema("60s")),
         "timestamp": sensor.sensor_schema(
             UptimeTimestampSensor,
+            icon=ICON_TIMER,
             accuracy_decimals=0,
-            device_class=DEVICE_CLASS_UPTIME,
+            device_class=DEVICE_CLASS_TIMESTAMP,
             entity_category=ENTITY_CATEGORY_DIAGNOSTIC,
         )
         .extend(

From 129aebe8f42277772d4b7280108cb3fcf2a74be9 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Thu, 18 Jun 2026 15:56:21 -0400
Subject: [PATCH 05/29] [esp32] Support `esphome idedata` with the native
 ESP-IDF toolchain (#17040)

---
 esphome/__main__.py                       | 15 ++++++++++++
 esphome/espidf/toolchain.py               |  1 +
 tests/unit_tests/test_espidf_toolchain.py | 28 +++++++++++++++++++----
 tests/unit_tests/test_main.py             | 26 +++++++++++++++++++++
 4 files changed, 66 insertions(+), 4 deletions(-)

diff --git a/esphome/__main__.py b/esphome/__main__.py
index 27dd878495d..bda3dcbd05a 100644
--- a/esphome/__main__.py
+++ b/esphome/__main__.py
@@ -1771,6 +1771,21 @@ def command_update_all(args: ArgsProtocol) -> int | None:
 def command_idedata(args: ArgsProtocol, config: ConfigType) -> int:
     import json
 
+    if CORE.using_toolchain_esp_idf:
+        # Native ESP-IDF derives idedata from the build's compile_commands.json,
+        # so the configuration must already be compiled.
+        from esphome.espidf import toolchain as espidf_toolchain
+
+        idedata = espidf_toolchain.get_idedata()
+        if idedata is None:
+            _LOGGER.error(
+                "No idedata available; compile the configuration first",
+            )
+            return 1
+
+        print(json.dumps(idedata, indent=2) + "\n")
+        return 0
+
     if not CORE.using_toolchain_platformio:
         _LOGGER.error(
             "The idedata command is not compatible with %s toolchain",
diff --git a/esphome/espidf/toolchain.py b/esphome/espidf/toolchain.py
index c622a2dd365..000ce739dbd 100644
--- a/esphome/espidf/toolchain.py
+++ b/esphome/espidf/toolchain.py
@@ -472,6 +472,7 @@ def get_idedata() -> dict | None:
             pass
 
     data = idedata_from_build(compile_commands)
+    data["prog_path"] = str(get_elf_path())
     cache.parent.mkdir(parents=True, exist_ok=True)
     cache.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
     return data
diff --git a/tests/unit_tests/test_espidf_toolchain.py b/tests/unit_tests/test_espidf_toolchain.py
index b2309439f98..017d8c49b4f 100644
--- a/tests/unit_tests/test_espidf_toolchain.py
+++ b/tests/unit_tests/test_espidf_toolchain.py
@@ -89,8 +89,9 @@ def test_get_idedata_generates_and_caches(setup_core: Path) -> None:
         result = toolchain.get_idedata()
 
     mock_transform.assert_called_once()
-    assert result == {"cxx_path": "g++"}
-    assert json.loads(cache.read_text()) == {"cxx_path": "g++"}
+    prog_path = str(toolchain.get_elf_path())
+    assert result == {"cxx_path": "g++", "prog_path": prog_path}
+    assert json.loads(cache.read_text()) == {"cxx_path": "g++", "prog_path": prog_path}
 
 
 def test_get_idedata_uses_cache_when_valid(setup_core: Path) -> None:
@@ -127,7 +128,7 @@ def test_get_idedata_regenerates_when_compile_commands_newer(setup_core: Path) -
         result = toolchain.get_idedata()
 
     mock_transform.assert_called_once()
-    assert result == {"cxx_path": "fresh"}
+    assert result == {"cxx_path": "fresh", "prog_path": str(toolchain.get_elf_path())}
 
 
 def test_get_idedata_regenerates_on_corrupted_cache(setup_core: Path) -> None:
@@ -147,7 +148,26 @@ def test_get_idedata_regenerates_on_corrupted_cache(setup_core: Path) -> None:
         result = toolchain.get_idedata()
 
     mock_transform.assert_called_once()
-    assert result == {"cxx_path": "regen"}
+    assert result == {"cxx_path": "regen", "prog_path": str(toolchain.get_elf_path())}
+
+
+def test_get_idedata_prog_path_points_at_firmware_elf(setup_core: Path) -> None:
+    """The idedata exposes prog_path (the ELF) so consumers like build-action
+    can locate firmware.factory.bin / firmware.ota.bin as its siblings."""
+    compile_commands, _ = _setup_build(setup_core)
+    compile_commands.parent.mkdir(parents=True, exist_ok=True)
+    compile_commands.write_text("[]")
+
+    with patch(
+        "esphome.espidf.idedata.idedata_from_build",
+        return_value={"cxx_path": "g++"},
+    ):
+        result = toolchain.get_idedata()
+
+    # Use Path semantics so the contract holds on Windows too (backslashes).
+    prog_path = Path(result["prog_path"])
+    assert prog_path.name == "firmware.elf"
+    assert prog_path.parent.name == "build"
 
 
 def test_get_idf_env_sets_git_ceiling_directories(setup_core: Path) -> None:
diff --git a/tests/unit_tests/test_main.py b/tests/unit_tests/test_main.py
index e44f746a750..acd39cedc62 100644
--- a/tests/unit_tests/test_main.py
+++ b/tests/unit_tests/test_main.py
@@ -32,6 +32,7 @@ from esphome.__main__ import (
     command_clean_all,
     command_config,
     command_config_hash,
+    command_idedata,
     command_rename,
     command_run,
     command_update_all,
@@ -6257,3 +6258,28 @@ def test_command_run_defaults_subscribe_states_true(
     mock_run_logs.assert_called_once_with(
         CORE.config, ["192.168.1.100"], subscribe_states=True
     )
+
+
+def test_command_idedata_esp_idf_prints_json(capsys: CaptureFixture) -> None:
+    """Under the native ESP-IDF toolchain, idedata is emitted as JSON."""
+    setup_core()
+    CORE.toolchain = Toolchain.ESP_IDF
+    data = {"cxx_path": "g++", "prog_path": "/build/firmware.elf"}
+
+    with patch("esphome.espidf.toolchain.get_idedata", return_value=data) as mock_get:
+        result = command_idedata(MagicMock(), CORE.config)
+
+    assert result == 0
+    mock_get.assert_called_once_with()
+    assert json.loads(capsys.readouterr().out) == data
+
+
+def test_command_idedata_esp_idf_no_build_errors() -> None:
+    """Under ESP-IDF, a missing build (no idedata) returns an error, not a crash."""
+    setup_core()
+    CORE.toolchain = Toolchain.ESP_IDF
+
+    with patch("esphome.espidf.toolchain.get_idedata", return_value=None):
+        result = command_idedata(MagicMock(), CORE.config)
+
+    assert result == 1

From d27229a1c75774dd2ae279ae0dd5f43dd3634562 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Thu, 18 Jun 2026 17:15:38 -0400
Subject: [PATCH 06/29] [esp32] Don't overwrite PlatformIO's factory.bin
 (#17042)

---
 esphome/components/esp32/post_build.py.script | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/esphome/components/esp32/post_build.py.script b/esphome/components/esp32/post_build.py.script
index b329f6b82b9..f1a38f9e76f 100644
--- a/esphome/components/esp32/post_build.py.script
+++ b/esphome/components/esp32/post_build.py.script
@@ -224,6 +224,17 @@ def merge_factory_bin(source, target, env):
     flash_size = env.BoardConfig().get("upload.flash_size", "4MB")
     chip = env.BoardConfig().get("build.mcu", "esp32")
 
+    # PlatformIO's esp-idf builder already creates a correct firmware.factory.bin (right
+    # artifact names and partition offsets, including custom partition tables). The merge
+    # below is only a fallback and cannot honor custom layouts, so don't overwrite an image
+    # PlatformIO already produced. Post-build actions only run when firmware.bin is rebuilt,
+    # and PlatformIO's combined-image builder runs before us in that batch, so an existing
+    # file here is current.
+    output_path = firmware_path.with_suffix(".factory.bin")
+    if output_path.exists():
+        print(f"{output_path.name} already created by PlatformIO - skipping merge")
+        return
+
     sections = []
     flasher_args_path = build_dir / "flasher_args.json"
 
@@ -291,7 +302,6 @@ def merge_factory_bin(source, target, env):
         print("No valid flash sections found — skipping .factory.bin creation.")
         return
 
-    output_path = firmware_path.with_suffix(".factory.bin")
     python_exe = f'"{env.subst("$PYTHONEXE")}"'
     cmd = [
         python_exe,

From 20cd6a1771794f1f20f6d9e39c2e4d6e45b04c07 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Thu, 18 Jun 2026 16:16:14 -0500
Subject: [PATCH 07/29] [logger] Hold recursion guard while draining the task
 log buffer (#17044)

---
 esphome/components/logger/logger.cpp          |   4 +
 .../logger_buffered_recursion_guard.yaml      |  61 +++++++++
 .../test_logger_buffered_recursion_guard.py   | 119 ++++++++++++++++++
 3 files changed, 184 insertions(+)
 create mode 100644 tests/integration/fixtures/logger_buffered_recursion_guard.yaml
 create mode 100644 tests/integration/test_logger_buffered_recursion_guard.py

diff --git a/esphome/components/logger/logger.cpp b/esphome/components/logger/logger.cpp
index a035525101d..684da0202e4 100644
--- a/esphome/components/logger/logger.cpp
+++ b/esphome/components/logger/logger.cpp
@@ -175,6 +175,10 @@ void Logger::process_messages_() {
 #ifdef USE_ESPHOME_TASK_LOG_BUFFER
   // Process any buffered messages when available
   if (this->log_buffer_.has_messages()) {
+    // Prevent main-task logs emitted by listener callbacks (e.g. the API send path) from re-entering
+    // and corrupting the shared tx_buffer_ / API shared_write_buffer_ while we are draining here.
+    // Mirrors the guard held by log_message_to_buffer_and_send_ on the synchronous logging path.
+    RecursionGuard guard(this->main_task_recursion_guard_);
     logger::TaskLogBuffer::LogMessage *message;
     uint16_t text_length;
     while (this->log_buffer_.borrow_message_main_loop(message, text_length)) {
diff --git a/tests/integration/fixtures/logger_buffered_recursion_guard.yaml b/tests/integration/fixtures/logger_buffered_recursion_guard.yaml
new file mode 100644
index 00000000000..058adbff990
--- /dev/null
+++ b/tests/integration/fixtures/logger_buffered_recursion_guard.yaml
@@ -0,0 +1,61 @@
+esphome:
+  name: logger-recursion-test
+host:
+api:
+logger:
+  level: DEBUG
+  on_message:
+    # Fires on the main loop for every message delivered to listeners, including
+    # messages drained from the task log buffer (i.e. logged from a non-main thread).
+    # The lambda logs again on the main task. Without a recursion guard on the buffered
+    # drain path this re-entrant log reuses the shared tx_buffer_ and clobbers the
+    # buffered message that is still being delivered, corrupting its console output.
+    - level: VERY_VERBOSE
+      then:
+        - lambda: |-
+            ESP_LOGD("reentry", "REENTRANT_CLOBBER_MARKER");
+
+button:
+  - platform: template
+    name: "Start Race Test"
+    id: start_test_button
+    on_press:
+      - lambda: |-
+          // Keep the count well under the host task-log-buffer slot count so every
+          // message goes through the ring buffer (buffered drain path) instead of the
+          // emergency console fallback. The main loop is blocked in pthread_join while
+          // the thread logs, so all messages are drained together once it returns.
+          static const int NUM_MESSAGES = 30;
+
+          struct ThreadTest {
+            static void *thread_func(void *arg) {
+              char thread_name[16];
+              snprintf(thread_name, sizeof(thread_name), "LogThread");
+              #ifdef __APPLE__
+              pthread_setname_np(thread_name);
+              #else
+              pthread_setname_np(pthread_self(), thread_name);
+              #endif
+
+              for (int i = 0; i < NUM_MESSAGES; i++) {
+                // Verifiable payload: data is a deterministic function of the message
+                // index, so a clobbered buffer shows up as a missing or mismatched line.
+                ESP_LOGD("thread_test", "THREADMSG%03d_DATA_%08X", i, i * 12345);
+              }
+              return nullptr;
+            }
+          };
+
+          // RACE_TEST_START / RACE_TEST_COMPLETE are logged from the main task (the
+          // synchronous path, which already holds the recursion guard) so the test can
+          // always detect completion even when the buffered path is corrupted.
+          ESP_LOGI("thread_test", "RACE_TEST_START: logging %d messages from a thread", NUM_MESSAGES);
+
+          pthread_t thread;
+          if (pthread_create(&thread, nullptr, ThreadTest::thread_func, nullptr) != 0) {
+            ESP_LOGE("thread_test", "RACE_TEST_ERROR: Failed to create thread");
+            return;
+          }
+          pthread_join(thread, nullptr);
+
+          ESP_LOGI("thread_test", "RACE_TEST_COMPLETE: thread finished, expected %d messages", NUM_MESSAGES);
diff --git a/tests/integration/test_logger_buffered_recursion_guard.py b/tests/integration/test_logger_buffered_recursion_guard.py
new file mode 100644
index 00000000000..5bef915b284
--- /dev/null
+++ b/tests/integration/test_logger_buffered_recursion_guard.py
@@ -0,0 +1,119 @@
+"""Integration test for the recursion guard on the buffered logger drain path.
+
+Regression test for a crash where a log message drained from the task log buffer
+(i.e. logged from a non-main thread) re-entered the logger on the main task while it
+was still being delivered to listeners. The buffered drain in
+``Logger::process_messages_`` did not hold the main-task recursion guard that the
+synchronous logging path holds, so a listener callback that logged again on the main
+task (e.g. the API log-forwarding path, or a ``logger.on_message`` automation) reused
+the shared ``tx_buffer_`` and clobbered the message mid-delivery. On ESP32 this showed
+up as a ``StoreProhibited`` panic inside the API send path.
+
+The fixture logs a small batch of verifiable messages from a non-main thread (kept
+under the host task-log-buffer slot count so they all take the buffered drain path
+rather than the emergency console fallback) while an ``on_message`` automation re-logs
+``REENTRANT_CLOBBER_MARKER`` on the main task for every delivered message.
+
+Without the guard the re-entrant marker is written into the shared ``tx_buffer_`` while
+the buffered thread message is still being delivered, so the message the API receives is
+contaminated (it contains the marker and an embedded newline glued onto the thread
+payload). With the guard the re-entrant log is dropped during the drain, the marker
+never appears, and every thread message is delivered clean.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import re
+
+from aioesphomeapi import LogLevel
+import pytest
+
+from .types import APIClientConnectedFactory, RunCompiledFunction
+
+_ANSI = re.compile(r"\x1b\[[0-9;]*m")
+# THREADMSGnnn_DATA_xxxxxxxx where data is a deterministic checksum of the index
+THREAD_MSG_PATTERN = re.compile(r"THREADMSG(\d{3})_DATA_([0-9A-F]{8})")
+
+NUM_MESSAGES = 30
+
+
+@pytest.mark.asyncio
+async def test_logger_buffered_recursion_guard(
+    yaml_config: str,
+    run_compiled: RunCompiledFunction,
+    api_client_connected: APIClientConnectedFactory,
+) -> None:
+    """Buffered (non-main-thread) log messages survive a re-entrant main-task log."""
+    api_messages: list[str] = []
+    all_drained = asyncio.Event()
+
+    async with (
+        run_compiled(yaml_config),
+        api_client_connected() as client,
+    ):
+        device_info = await client.device_info()
+        assert device_info is not None
+        assert device_info.name == "logger-recursion-test"
+
+        # Subscribe over the API: this is the exact path that crashed in the field
+        # (the API log callback runs during the buffered drain). The API message field
+        # preserves embedded newlines, so it reliably exposes a clobbered buffer.
+        #
+        # Every buffered thread message is delivered here whether it survives intact or
+        # gets clobbered (a clobbered message still carries its THREADMSG payload), so
+        # counting THREADMSG occurrences is a deterministic "drain complete" signal: no
+        # arbitrary sleep, no dependence on the fix being present.
+        def on_log(msg) -> None:
+            text = msg.message.decode("utf-8", errors="replace")
+            api_messages.append(text)
+            received = sum(len(THREAD_MSG_PATTERN.findall(m)) for m in api_messages)
+            if received >= NUM_MESSAGES:
+                all_drained.set()
+
+        client.subscribe_logs(on_log, log_level=LogLevel.LOG_LEVEL_VERY_VERBOSE)
+
+        entities, _ = await client.list_entities_services()
+        buttons = [e for e in entities if e.name == "Start Race Test"]
+        assert buttons, "Could not find Start Race Test button"
+        client.button_command(buttons[0].key)
+
+        # Wait until every buffered thread message has been delivered over the API.
+        try:
+            await asyncio.wait_for(all_drained.wait(), timeout=30.0)
+        except TimeoutError:
+            received = sum(len(THREAD_MSG_PATTERN.findall(m)) for m in api_messages)
+            pytest.fail(
+                f"Only {received}/{NUM_MESSAGES} thread messages arrived before timeout; "
+                "device likely crashed or hung."
+            )
+
+    intact: set[int] = set()
+    contaminated: list[str] = []
+    for raw in api_messages:
+        text = _ANSI.sub("", raw)
+        if "THREADMSG" not in text:
+            continue
+        # A clean thread message is a single line carrying only its own payload. A
+        # clobbered buffer glues the re-entrant marker (and an embedded newline) onto it.
+        if "REENTRANT" in text or "\n" in text:
+            contaminated.append(repr(raw))
+            continue
+        match = THREAD_MSG_PATTERN.search(text)
+        assert match, f"Unexpected thread message format: {raw!r}"
+        msg_num = int(match.group(1))
+        expected = f"{msg_num * 12345:08X}"
+        if match.group(2) != expected:
+            contaminated.append(repr(raw))
+            continue
+        intact.add(msg_num)
+
+    assert not contaminated, (
+        "Buffered thread messages were clobbered by a re-entrant main-task log "
+        "(missing recursion guard on the buffered drain path):\n"
+        + "\n".join(contaminated[:10])
+    )
+    assert len(intact) == NUM_MESSAGES, (
+        f"Expected {NUM_MESSAGES} intact buffered thread messages over the API, got "
+        f"{len(intact)}. Missing ids: {sorted(set(range(NUM_MESSAGES)) - intact)}"
+    )

From e3d68deef904c11683b3d32eee9fe67c4fb7e920 Mon Sep 17 00:00:00 2001
From: "esphome[bot]" <115708604+esphome[bot]@users.noreply.github.com>
Date: Fri, 19 Jun 2026 10:05:20 +1200
Subject: [PATCH 08/29] Bump bundled esphome-device-builder to 1.0.10 (#17051)

---
 docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 18a99037351..221121c8d38 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -32,7 +32,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.0.9
+RUN uv pip install --no-cache-dir esphome-device-builder==1.0.10
 
 RUN \
     platformio settings set enable_telemetry No \

From 1b1c8d767d29674a4245d9c13af3df0f6df8a3b0 Mon Sep 17 00:00:00 2001
From: Jesse Hills <3060199+jesserockz@users.noreply.github.com>
Date: Fri, 19 Jun 2026 10:06:13 +1200
Subject: [PATCH 09/29] Bump version to 2026.6.1

---
 Doxyfile         | 2 +-
 esphome/const.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doxyfile b/Doxyfile
index 56879237d49..d8c6bdbcdcd 100644
--- a/Doxyfile
+++ b/Doxyfile
@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.6.0
+PROJECT_NUMBER         = 2026.6.1
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
diff --git a/esphome/const.py b/esphome/const.py
index c045e452f7e..0bcf60a510f 100644
--- a/esphome/const.py
+++ b/esphome/const.py
@@ -4,7 +4,7 @@ from enum import Enum
 
 from esphome.enum import StrEnum
 
-__version__ = "2026.6.0"
+__version__ = "2026.6.1"
 
 ALLOWED_NAME_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789-_"
 VALID_SUBSTITUTIONS_CHARACTERS = (

From 1dbd9af6179bcae2c758758c5d7d70b2965ee06d Mon Sep 17 00:00:00 2001
From: Big Mike <mikelawrence@users.noreply.github.com>
Date: Fri, 19 Jun 2026 00:04:11 -0500
Subject: [PATCH 10/29] [sen6x] Remove codeowner (#17056)

---
 CODEOWNERS                         | 2 +-
 esphome/components/sen6x/sensor.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CODEOWNERS b/CODEOWNERS
index 3265627c030..d425614582c 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -445,7 +445,7 @@ esphome/components/select/* @esphome/core
 esphome/components/sen0321/* @notjj
 esphome/components/sen21231/* @shreyaskarnik
 esphome/components/sen5x/* @martgras
-esphome/components/sen6x/* @martgras @mebner86 @mikelawrence @tuct
+esphome/components/sen6x/* @martgras @mebner86 @tuct
 esphome/components/sendspin/* @kahrendt
 esphome/components/sendspin/media_player/* @kahrendt
 esphome/components/sendspin/media_source/* @kahrendt
diff --git a/esphome/components/sen6x/sensor.py b/esphome/components/sen6x/sensor.py
index 19c0cb500e4..5eb34add65c 100644
--- a/esphome/components/sen6x/sensor.py
+++ b/esphome/components/sen6x/sensor.py
@@ -32,7 +32,7 @@ from esphome.const import (
     UNIT_PERCENT,
 )
 
-CODEOWNERS = ["@martgras", "@mebner86", "@mikelawrence", "@tuct"]
+CODEOWNERS = ["@martgras", "@mebner86", "@tuct"]
 DEPENDENCIES = ["i2c"]
 AUTO_LOAD = ["sensirion_common"]
 

From 6a79dfb5c5a954cf3d0ba1da2cfd3351e165d3f0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:07:32 +1200
Subject: [PATCH 11/29] Bump ruff from 0.15.17 to 0.15.18 (#17046)

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements_test.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements_test.txt b/requirements_test.txt
index fc9681921a6..b0e917566e6 100644
--- a/requirements_test.txt
+++ b/requirements_test.txt
@@ -1,6 +1,6 @@
 pylint==4.0.6
 flake8==7.3.0  # also change in .pre-commit-config.yaml when updating
-ruff==0.15.17  # also change in .pre-commit-config.yaml when updating
+ruff==0.15.18  # also change in .pre-commit-config.yaml when updating
 pyupgrade==3.21.2  # also change in .pre-commit-config.yaml when updating
 pre-commit
 

From 4ae6dc355f1e525f0ebe1e2cd8d2965588ec4b3e Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Fri, 19 Jun 2026 00:08:07 -0500
Subject: [PATCH 12/29] [select] Remove deprecated state member (#17027)

---
 esphome/components/select/select.cpp                 |  4 ----
 esphome/components/select/select.h                   |  7 -------
 .../fixtures/multi_device_preferences.yaml           | 12 ++++++------
 3 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/esphome/components/select/select.cpp b/esphome/components/select/select.cpp
index 7c3dab15ad5..17c6c811dd8 100644
--- a/esphome/components/select/select.cpp
+++ b/esphome/components/select/select.cpp
@@ -27,10 +27,6 @@ void Select::publish_state(size_t index) {
   const char *option = this->option_at(index);
   this->set_has_state(true);
   this->active_index_ = index;
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-  this->state = option;  // Update deprecated member for backward compatibility
-#pragma GCC diagnostic pop
   ESP_LOGV(TAG, "'%s' >> %s (%zu)", this->get_name().c_str(), option, index);
   this->state_callback_.call(index);
 #if defined(USE_SELECT) && defined(USE_CONTROLLER_REGISTRY)
diff --git a/esphome/components/select/select.h b/esphome/components/select/select.h
index 465283d92a2..34d92485234 100644
--- a/esphome/components/select/select.h
+++ b/esphome/components/select/select.h
@@ -30,15 +30,8 @@ class Select : public EntityBase {
  public:
   SelectTraits traits;
 
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-  /// @deprecated Use current_option() instead. This member will be removed in ESPHome 2026.7.0.
-  ESPDEPRECATED("Use current_option() instead of .state. Will be removed in 2026.7.0", "2026.1.0")
-  std::string state{};
-
   Select() = default;
   ~Select() = default;
-#pragma GCC diagnostic pop
 
   void publish_state(const std::string &state);
   void publish_state(const char *state);
diff --git a/tests/integration/fixtures/multi_device_preferences.yaml b/tests/integration/fixtures/multi_device_preferences.yaml
index 634d7157b2a..01e4394559b 100644
--- a/tests/integration/fixtures/multi_device_preferences.yaml
+++ b/tests/integration/fixtures/multi_device_preferences.yaml
@@ -109,7 +109,7 @@ select:
     set_action:
       - lambda: |-
           ESP_LOGI("test", "Device A Mode set to %s", x.c_str());
-          id(mode_device_a).state = x;
+          id(mode_device_a).publish_state(x);
 
   - platform: template
     name: Mode
@@ -124,7 +124,7 @@ select:
     set_action:
       - lambda: |-
           ESP_LOGI("test", "Device B Mode set to %s", x.c_str());
-          id(mode_device_b).state = x;
+          id(mode_device_b).publish_state(x);
 
   - platform: template
     name: Mode
@@ -138,7 +138,7 @@ select:
     set_action:
       - lambda: |-
           ESP_LOGI("test", "Main Mode set to %s", x.c_str());
-          id(mode_main).state = x;
+          id(mode_main).publish_state(x);
 
 # Button to trigger preference logging test
 button:
@@ -153,9 +153,9 @@ button:
           ESP_LOGI("test", "Device A Setpoint: %.1f", id(setpoint_device_a).state);
           ESP_LOGI("test", "Device B Setpoint: %.1f", id(setpoint_device_b).state);
           ESP_LOGI("test", "Main Setpoint: %.1f", id(setpoint_main).state);
-          ESP_LOGI("test", "Device A Mode: %s", id(mode_device_a).state.c_str());
-          ESP_LOGI("test", "Device B Mode: %s", id(mode_device_b).state.c_str());
-          ESP_LOGI("test", "Main Mode: %s", id(mode_main).state.c_str());
+          ESP_LOGI("test", "Device A Mode: %s", id(mode_device_a).current_option().c_str());
+          ESP_LOGI("test", "Device B Mode: %s", id(mode_device_b).current_option().c_str());
+          ESP_LOGI("test", "Main Mode: %s", id(mode_main).current_option().c_str());
           // Log preference hashes for entities that actually store preferences
           ESP_LOGI("test", "Device A Switch Pref Hash: %u", id(light_device_a).get_preference_hash());
           ESP_LOGI("test", "Device B Switch Pref Hash: %u", id(light_device_b).get_preference_hash());

From 350e7bb7638b0e8551d1e5f1244bbe62e952cb77 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Fri, 19 Jun 2026 01:17:06 -0400
Subject: [PATCH 13/29] [espidf] Resolve IDF tools path to avoid unnormalized
 path warning (#17055)

---
 esphome/espidf/framework.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/esphome/espidf/framework.py b/esphome/espidf/framework.py
index c0e9a0051f9..6f4aeef9f07 100644
--- a/esphome/espidf/framework.py
+++ b/esphome/espidf/framework.py
@@ -81,8 +81,13 @@ def _get_idf_tools_path() -> Path:
         Path object pointing to the ESP-IDF tools directory
     """
     if "ESPHOME_ESP_IDF_PREFIX" in os.environ:
-        return Path(get_str_env("ESPHOME_ESP_IDF_PREFIX", None)).expanduser()
-    return CORE.data_dir / "idf"
+        path = Path(get_str_env("ESPHOME_ESP_IDF_PREFIX", None)).expanduser()
+    else:
+        path = CORE.data_dir / "idf"
+    # Resolve so an unnormalized config path (e.g. compiling ``../config/x.yaml``)
+    # doesn't leave ``..`` segments in the IDF_TOOLS_PATH handed to idf.py, which
+    # otherwise warns that the venv interpreter path doesn't match the install.
+    return path.resolve()
 
 
 # Windows' default MAX_PATH is 260 characters. ESP-IDF toolchains nest deeply

From 50994704a39397db0672f0fb16cdaa5fd4366c7c Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Fri, 19 Jun 2026 23:19:17 -0400
Subject: [PATCH 14/29] [fastled_base] Fix RMT5 intr_priority conflict (#17072)

---
 esphome/components/fastled_base/__init__.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/esphome/components/fastled_base/__init__.py b/esphome/components/fastled_base/__init__.py
index d99dffdc081..a26a235da73 100644
--- a/esphome/components/fastled_base/__init__.py
+++ b/esphome/components/fastled_base/__init__.py
@@ -50,6 +50,11 @@ async def new_fastled_light(config):
             ref="d44c800a9e876a8394caefc2ce4915dd96dac77b",
         )
         cg.add_library("SPI", None)
+        # FastLED's RMT5 driver hard-codes intr_priority=3, which conflicts with
+        # esphome's RMT channels (remote_transmitter etc., priority 0): the IDF
+        # driver rejects FastLED's channel and show() then hangs ~3s with no
+        # output. Override to 0 so it shares the interrupt. See #17063.
+        cg.add_build_flag("-DFL_RMT5_INTERRUPT_LEVEL=0")
     else:
         cg.add_library("fastled/FastLED", "3.9.16")
     await light.register_light(var, config)

From f57d31374e1cc88bdd5f16e16fface70ef9184fb Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Fri, 19 Jun 2026 23:19:30 -0400
Subject: [PATCH 15/29] [packet_transport] Mark encryption key as cv.sensitive
 (#17066)

---
 esphome/components/packet_transport/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/esphome/components/packet_transport/__init__.py b/esphome/components/packet_transport/__init__.py
index 0b166bb65c2..4293dffb151 100644
--- a/esphome/components/packet_transport/__init__.py
+++ b/esphome/components/packet_transport/__init__.py
@@ -69,7 +69,7 @@ ENCRYPTION_SCHEMA = {
     cv.Optional(CONF_ENCRYPTION): cv.maybe_simple_value(
         cv.Schema(
             {
-                cv.Required(CONF_KEY): cv.string,
+                cv.Required(CONF_KEY): cv.sensitive(cv.string),
             }
         ),
         key=CONF_KEY,

From db6bd36cf90eccbec52cba89feddecb6178ca14f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 19 Jun 2026 23:20:17 -0400
Subject: [PATCH 16/29] Bump py7zr from 1.1.0 to 1.1.3 (#17071)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index efb5ec8723a..717f3b7e210 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -25,7 +25,7 @@ jinja2==3.1.6
 bleak==2.1.1
 smpclient==6.0.0
 requests==2.34.2
-py7zr==1.1.0
+py7zr==1.1.3
 
 # esp-idf >= 5.0 requires this
 pyparsing >= 3.3.2

From d8bd80ef3888b9c30b0a5690c2b6c4ec018bb71a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 19 Jun 2026 23:20:28 -0400
Subject: [PATCH 17/29] Bump resvg-py from 0.3.2 to 0.3.3 (#17070)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 717f3b7e210..06a383b00aa 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -19,7 +19,7 @@ ruamel.yaml==0.19.1 # dashboard_import
 ruamel.yaml.clib==0.2.15 # dashboard_import
 esphome-glyphsets==0.2.0
 pillow==12.2.0
-resvg-py==0.3.2
+resvg-py==0.3.3
 freetype-py==2.5.1
 jinja2==3.1.6
 bleak==2.1.1

From 3fb250133fe12af47c1b9d8d7b6e4e92363d4e0d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 19 Jun 2026 23:20:37 -0400
Subject: [PATCH 18/29] Bump pytest from 9.1.0 to 9.1.1 (#17069)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements_test.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements_test.txt b/requirements_test.txt
index b0e917566e6..4e498abc21e 100644
--- a/requirements_test.txt
+++ b/requirements_test.txt
@@ -5,7 +5,7 @@ pyupgrade==3.21.2  # also change in .pre-commit-config.yaml when updating
 pre-commit
 
 # Unit tests
-pytest==9.1.0
+pytest==9.1.1
 pytest-cov==7.1.0
 pytest-mock==3.15.1
 pytest-asyncio==1.4.0

From 657d9bf4d094e13b7c7e5d3c7ff67566dfa53a8b Mon Sep 17 00:00:00 2001
From: "esphome[bot]" <115708604+esphome[bot]@users.noreply.github.com>
Date: Sat, 20 Jun 2026 00:30:30 -0500
Subject: [PATCH 19/29] Bump bundled esphome-device-builder to 1.0.11 (#17081)

---
 docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 221121c8d38..aa0406320c1 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -32,7 +32,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.0.10
+RUN uv pip install --no-cache-dir esphome-device-builder==1.0.11
 
 RUN \
     platformio settings set enable_telemetry No \

From d77c0d2bc544a9c94e4e317ce485c59081f48b5c Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Sat, 20 Jun 2026 11:33:54 -0500
Subject: [PATCH 20/29] [ha-addon] Expose the device-builder public port only
 when port 6052 is mapped (#17076)

---
 .../etc/s6-overlay/s6-rc.d/esphome/run           | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run b/docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run
index a61f237a5a1..d4628ffa832 100755
--- a/docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run
+++ b/docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run
@@ -49,7 +49,21 @@ if bashio::fs.directory_exists '/config/esphome/.esphome'; then
     rm -rf /config/esphome/.esphome
 fi
 
+# Only signal device-builder to expose the public LAN port when the operator
+# mapped port 6052, matching the legacy dashboard where nginx listened on the
+# fixed port 6052 only when it was configured. We use the mapping purely as a
+# presence check and don't forward the published value; device-builder binds
+# its default port 6052 (the fixed container port, as the legacy
+# "listen 6052" did). --ha-addon-allow-public is inert on its own: the no-auth
+# gate is the DISABLE_HA_AUTHENTICATION env var set above, so both opt-ins are
+# required to bind 6052 unauthenticated; either alone stays ingress-only.
+set --
+if bashio::var.has_value "$(bashio::addon.port 6052)"; then
+    set -- --ha-addon-allow-public
+fi
+
 bashio::log.info "Starting ESPHome Device Builder..."
 exec esphome-device-builder /config/esphome \
     --ha-addon \
-    --ingress-port "$(bashio::addon.ingress_port)"
+    --ingress-port "$(bashio::addon.ingress_port)" \
+    "$@"

From 59711b8e6a39bb5db7b8b79067298feb0a268a77 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Sat, 20 Jun 2026 11:51:42 -0500
Subject: [PATCH 21/29] Add THREAT_MODEL.md (#17089)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 THREAT_MODEL.md | 104 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)
 create mode 100644 THREAT_MODEL.md

diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
new file mode 100644
index 00000000000..a4640467c98
--- /dev/null
+++ b/THREAT_MODEL.md
@@ -0,0 +1,104 @@
+# ESPHome Threat Model
+
+This document defines the trust boundary for the **ESPHome** repository — the
+Python compiler/CLI and the device firmware it generates — so that real security
+bugs can be told apart from defense-in-depth improvements. It gives contributors,
+reviewers, and security researchers a clear answer to one question:
+**does this issue let an _unauthenticated_ attacker do something they shouldn't?**
+
+Related documents:
+
+- Deployment guidance for operators:
+  https://esphome.io/guides/security_best_practices/
+- The **Device Builder dashboard** (the web UI, its authentication, ingress,
+  Origin/Host gates, and peer-link pairing) lives in a separate repository and
+  has its own threat model. If your report concerns any of that, please read and
+  report there instead:
+  https://github.com/esphome/device-builder/blob/main/docs/THREAT_MODEL.md
+
+## The trust boundary
+
+For this repository there are two trusted inputs by design:
+
+1. **The configuration.** Anyone who can supply or edit a YAML config is trusted
+   (see below).
+2. **Authenticated peers of a running device** — clients holding the device's
+   API encryption key / password, OTA password, or web server credentials.
+
+The security boundary is therefore **unauthenticated network traffic vs. those
+trusted inputs.** A bug that lets an unauthenticated attacker cross it is a
+security bug.
+
+## Config authors are host-equivalent by design
+
+Anyone who can supply or edit a configuration is **trusted with full code
+execution on the host that runs `esphome`**, on purpose. This is what the product
+does, not a flaw. A config author can already, through fully supported features:
+
+- Run arbitrary **Python** at validation/compile time via `external_components:`
+  (and other component-import mechanisms) — ESPHome imports those packages as
+  ordinary Python.
+- Run arbitrary **shell** commands through the compile/validate/flash toolchain
+  that ESPHome invokes as subprocesses.
+- Read and write arbitrary files reachable by the process (e.g. via `!include`,
+  `packages:`, `dashboard_import:`, and generated build output).
+
+Because of this, a malicious config author is equivalent to shell access on the
+host running the build.
+
+## What is *not* a security vulnerability
+
+If exploiting an issue requires the ability to supply or edit configuration, it
+is **not** a vulnerability in ESPHome, because that ability already grants host
+code execution. This explicitly includes, among others:
+
+- Template / expression injection in substitutions or any YAML string value
+  (e.g. Jinja `${...}` evaluation reaching Python internals). This grants no
+  capability a config author lacks.
+- `!include` / `packages:` / `dashboard_import:` reading or fetching content
+  from surprising or remote locations.
+- The validator or compiler crashing or behaving unexpectedly on adversarial
+  YAML.
+- ESPHome running as root in the official container — that is the documented
+  deployment posture, reachable by the same caller through the features above.
+
+These do not warrant a CVE or coordinated disclosure. Hardening in these areas
+(for example, sandboxing template evaluation as least-surprise defense-in-depth)
+is welcome as a normal enhancement PR, framed as cleanliness rather than a
+security fix — not as a vulnerability remediation.
+
+## What we do defend
+
+These *are* security bugs in this repo, and we want to hear about them privately:
+
+- Memory-safety or protocol bugs in the generated **device firmware** that are
+  remotely triggerable over the network (native API, web server, OTA, BLE,
+  captive portal, etc.) **without** valid credentials.
+- Authentication or encryption bypass on the device — reaching API calls, OTA
+  updates, or the web server without the configured key/password.
+- Flaws that weaken the device's API encryption (Noise), OTA, or web server auth
+  below their documented guarantees.
+
+## Explicitly out of scope
+
+- Local attackers who already have shell access on the host that runs `esphome`.
+- Supply-chain attacks against ESPHome or its dependencies.
+- Operator-supplied hostile YAML (covered above — config authoring is trusted).
+- Attacks that require an already-authenticated device peer (someone who already
+  holds the API key / OTA / web credentials).
+- Anything in the dashboard / device-builder — report that in its own repository
+  (linked at the top).
+- The legacy bundled dashboard in this repo (`esphome/dashboard/`) — it is
+  deprecated and being replaced by Device Builder; report dashboard issues there.
+- Deployments where the operator removed protections or exposed credentials. See
+  the security best practices guide:
+  https://esphome.io/guides/security_best_practices/
+
+## Reporting a vulnerability
+
+If you believe you've found an issue that crosses the unauthenticated boundary
+above, please report it privately via GitHub Security Advisories rather than a
+public issue. For issues that require config-write access, please review this
+document first — they are very likely out of scope by design. For dashboard /
+device-builder issues, report against that repository and consult its threat
+model (linked at the top).

From 9609d370c09a1bdcdedffe7061625455e23fbf2a Mon Sep 17 00:00:00 2001
From: "esphome[bot]" <115708604+esphome[bot]@users.noreply.github.com>
Date: Sat, 20 Jun 2026 12:22:19 -0500
Subject: [PATCH 22/29] Bump bundled esphome-device-builder to 1.0.12 (#17091)

---
 docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index aa0406320c1..1d39644ab8c 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -32,7 +32,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.0.11
+RUN uv pip install --no-cache-dir esphome-device-builder==1.0.12
 
 RUN \
     platformio settings set enable_telemetry No \

From 8d77051b9a2d80e07cade2971f95050892ee5339 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Fri, 19 Jun 2026 01:17:06 -0400
Subject: [PATCH 23/29] [espidf] Resolve IDF tools path to avoid unnormalized
 path warning (#17055)

---
 esphome/espidf/framework.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/esphome/espidf/framework.py b/esphome/espidf/framework.py
index c0e9a0051f9..6f4aeef9f07 100644
--- a/esphome/espidf/framework.py
+++ b/esphome/espidf/framework.py
@@ -81,8 +81,13 @@ def _get_idf_tools_path() -> Path:
         Path object pointing to the ESP-IDF tools directory
     """
     if "ESPHOME_ESP_IDF_PREFIX" in os.environ:
-        return Path(get_str_env("ESPHOME_ESP_IDF_PREFIX", None)).expanduser()
-    return CORE.data_dir / "idf"
+        path = Path(get_str_env("ESPHOME_ESP_IDF_PREFIX", None)).expanduser()
+    else:
+        path = CORE.data_dir / "idf"
+    # Resolve so an unnormalized config path (e.g. compiling ``../config/x.yaml``)
+    # doesn't leave ``..`` segments in the IDF_TOOLS_PATH handed to idf.py, which
+    # otherwise warns that the venv interpreter path doesn't match the install.
+    return path.resolve()
 
 
 # Windows' default MAX_PATH is 260 characters. ESP-IDF toolchains nest deeply

From fe794a26e845c33a0e9ae86e8c7363fd78cca09e Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Fri, 19 Jun 2026 23:19:17 -0400
Subject: [PATCH 24/29] [fastled_base] Fix RMT5 intr_priority conflict (#17072)

---
 esphome/components/fastled_base/__init__.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/esphome/components/fastled_base/__init__.py b/esphome/components/fastled_base/__init__.py
index d99dffdc081..a26a235da73 100644
--- a/esphome/components/fastled_base/__init__.py
+++ b/esphome/components/fastled_base/__init__.py
@@ -50,6 +50,11 @@ async def new_fastled_light(config):
             ref="d44c800a9e876a8394caefc2ce4915dd96dac77b",
         )
         cg.add_library("SPI", None)
+        # FastLED's RMT5 driver hard-codes intr_priority=3, which conflicts with
+        # esphome's RMT channels (remote_transmitter etc., priority 0): the IDF
+        # driver rejects FastLED's channel and show() then hangs ~3s with no
+        # output. Override to 0 so it shares the interrupt. See #17063.
+        cg.add_build_flag("-DFL_RMT5_INTERRUPT_LEVEL=0")
     else:
         cg.add_library("fastled/FastLED", "3.9.16")
     await light.register_light(var, config)

From f5697b0ae574104bd69ec4fc8da5919c596918c1 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Fri, 19 Jun 2026 23:19:30 -0400
Subject: [PATCH 25/29] [packet_transport] Mark encryption key as cv.sensitive
 (#17066)

---
 esphome/components/packet_transport/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/esphome/components/packet_transport/__init__.py b/esphome/components/packet_transport/__init__.py
index 0b166bb65c2..4293dffb151 100644
--- a/esphome/components/packet_transport/__init__.py
+++ b/esphome/components/packet_transport/__init__.py
@@ -69,7 +69,7 @@ ENCRYPTION_SCHEMA = {
     cv.Optional(CONF_ENCRYPTION): cv.maybe_simple_value(
         cv.Schema(
             {
-                cv.Required(CONF_KEY): cv.string,
+                cv.Required(CONF_KEY): cv.sensitive(cv.string),
             }
         ),
         key=CONF_KEY,

From 2354165e41e02205e465b17364f523ecd513b8f3 Mon Sep 17 00:00:00 2001
From: "esphome[bot]" <115708604+esphome[bot]@users.noreply.github.com>
Date: Sat, 20 Jun 2026 00:30:30 -0500
Subject: [PATCH 26/29] Bump bundled esphome-device-builder to 1.0.11 (#17081)

---
 docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 221121c8d38..aa0406320c1 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -32,7 +32,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.0.10
+RUN uv pip install --no-cache-dir esphome-device-builder==1.0.11
 
 RUN \
     platformio settings set enable_telemetry No \

From 039a1f063e1e3754f8199c2bae6f9b2ed92ad06f Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Sat, 20 Jun 2026 11:33:54 -0500
Subject: [PATCH 27/29] [ha-addon] Expose the device-builder public port only
 when port 6052 is mapped (#17076)

---
 .../etc/s6-overlay/s6-rc.d/esphome/run           | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run b/docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run
index a61f237a5a1..d4628ffa832 100755
--- a/docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run
+++ b/docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run
@@ -49,7 +49,21 @@ if bashio::fs.directory_exists '/config/esphome/.esphome'; then
     rm -rf /config/esphome/.esphome
 fi
 
+# Only signal device-builder to expose the public LAN port when the operator
+# mapped port 6052, matching the legacy dashboard where nginx listened on the
+# fixed port 6052 only when it was configured. We use the mapping purely as a
+# presence check and don't forward the published value; device-builder binds
+# its default port 6052 (the fixed container port, as the legacy
+# "listen 6052" did). --ha-addon-allow-public is inert on its own: the no-auth
+# gate is the DISABLE_HA_AUTHENTICATION env var set above, so both opt-ins are
+# required to bind 6052 unauthenticated; either alone stays ingress-only.
+set --
+if bashio::var.has_value "$(bashio::addon.port 6052)"; then
+    set -- --ha-addon-allow-public
+fi
+
 bashio::log.info "Starting ESPHome Device Builder..."
 exec esphome-device-builder /config/esphome \
     --ha-addon \
-    --ingress-port "$(bashio::addon.ingress_port)"
+    --ingress-port "$(bashio::addon.ingress_port)" \
+    "$@"

From b079be756f5d92076fd20bdb5ac53283e67503e2 Mon Sep 17 00:00:00 2001
From: "esphome[bot]" <115708604+esphome[bot]@users.noreply.github.com>
Date: Sat, 20 Jun 2026 12:22:19 -0500
Subject: [PATCH 28/29] Bump bundled esphome-device-builder to 1.0.12 (#17091)

---
 docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index aa0406320c1..1d39644ab8c 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -32,7 +32,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.0.11
+RUN uv pip install --no-cache-dir esphome-device-builder==1.0.12
 
 RUN \
     platformio settings set enable_telemetry No \

From 99d1c4eb694e600914b17321a165516101e542b1 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Sat, 20 Jun 2026 13:33:41 -0400
Subject: [PATCH 29/29] Bump version to 2026.6.2

---
 Doxyfile         | 2 +-
 esphome/const.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doxyfile b/Doxyfile
index d8c6bdbcdcd..ea36d45fee7 100644
--- a/Doxyfile
+++ b/Doxyfile
@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.6.1
+PROJECT_NUMBER         = 2026.6.2
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
diff --git a/esphome/const.py b/esphome/const.py
index 0bcf60a510f..7cc9b604d98 100644
--- a/esphome/const.py
+++ b/esphome/const.py
@@ -4,7 +4,7 @@ from enum import Enum
 
 from esphome.enum import StrEnum
 
-__version__ = "2026.6.1"
+__version__ = "2026.6.2"
 
 ALLOWED_NAME_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789-_"
 VALID_SUBSTITUTIONS_CHARACTERS = (