From 22f6791dea1f0d8602ead29cabe1360d09fd3ba8 Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Mon, 20 Apr 2026 23:13:42 +1000
Subject: [PATCH 01/16] [lvgl] Fix format of hello world page (#15868)

---
 esphome/components/lvgl/hello_world.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/esphome/components/lvgl/hello_world.yaml b/esphome/components/lvgl/hello_world.yaml
index bbbd34e30a..7bf068cc5d 100644
--- a/esphome/components/lvgl/hello_world.yaml
+++ b/esphome/components/lvgl/hello_world.yaml
@@ -89,10 +89,12 @@
                       id: hello_world_label_
                       text: "Hello World!"
                       align: center
-            - obj:
+            - container:
                 id: hello_world_qrcode_
                 outline_width: 0
                 border_width: 0
+                height: 100
+                width: 100
                 hidden: !lambda |-
                     return lv_obj_get_width(lv_screen_active()) < 300 && lv_obj_get_height(lv_screen_active()) < 400;
                 widgets:

From 3d0a2421a65a55f71b565feacc0ff6d5147ebc2a Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Mon, 20 Apr 2026 23:14:15 +1000
Subject: [PATCH 02/16] [lvgl] Fix overloads for setting images on styles
 (#15864)

---
 esphome/components/lvgl/lvgl_esphome.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/esphome/components/lvgl/lvgl_esphome.h b/esphome/components/lvgl/lvgl_esphome.h
index 3ec1d247d8..146866f5bd 100644
--- a/esphome/components/lvgl/lvgl_esphome.h
+++ b/esphome/components/lvgl/lvgl_esphome.h
@@ -88,6 +88,12 @@ inline void lv_obj_set_style_bitmap_mask_src(lv_obj_t *obj, image::Image *image,
 inline void lv_obj_set_style_bg_image_src(lv_obj_t *obj, image::Image *image, lv_style_selector_t selector) {
   ::lv_obj_set_style_bg_image_src(obj, image->get_lv_image_dsc(), selector);
 }
+inline void lv_style_set_bg_image_src(lv_style_t *style, image::Image *image) {
+  ::lv_style_set_bg_image_src(style, image->get_lv_image_dsc());
+}
+inline void lv_style_set_bitmap_mask_src(lv_style_t *style, image::Image *image) {
+  ::lv_style_set_bitmap_mask_src(style, image->get_lv_image_dsc());
+}
 #endif  // USE_LVGL_IMAGE
 #ifdef USE_LVGL_ANIMIMG
 inline void lv_animimg_set_src(lv_obj_t *img, std::vector<image::Image *> images) {

From dc5b06285d84a311b1b103db97756ebe9f662912 Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Mon, 20 Apr 2026 23:15:51 +1000
Subject: [PATCH 03/16] [lvgl] Fix update of textarea attached to keyboard
 (#15866)

---
 esphome/components/lvgl/widgets/keyboard.py | 26 ++++++++++++---------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/esphome/components/lvgl/widgets/keyboard.py b/esphome/components/lvgl/widgets/keyboard.py
index 029ca5f684..c5628cee3c 100644
--- a/esphome/components/lvgl/widgets/keyboard.py
+++ b/esphome/components/lvgl/widgets/keyboard.py
@@ -52,19 +52,23 @@ class KeyboardType(WidgetType):
         if mode := config.get(CONF_MODE):
             await w.set_property(CONF_MODE, await KEYBOARD_MODES.process(mode))
         if textarea := config.get(CONF_TEXTAREA):
-            # If a textarea is configured, it must be generated before the keyboard can attach it.
-            # If not yet configured, defer the attachment code.
+            if not is_widget_completed(textarea):
+                # Can only happen for an initial config, where the keyboard is configured before the
+                # textarea, so it's ok to always emit into the global context
+                async def add_textarea():
+                    async with LvContext():
+                        await w.set_property(
+                            CONF_TEXTAREA,
+                            (await get_widgets(config, CONF_TEXTAREA))[0].obj,
+                        )
 
-            async def add_textarea():
-                async with LvContext():
-                    await w.set_property(
-                        CONF_TEXTAREA, (await get_widgets(config, CONF_TEXTAREA))[0].obj
-                    )
-
-            if is_widget_completed(textarea):
-                await add_textarea()
-            else:
                 CORE.add_job(add_textarea)
+            else:
+                # Handles updates in automations, and properly ordered initial config. Code is generated
+                # into the enclosing context (main or lambda)
+                await w.set_property(
+                    CONF_TEXTAREA, (await get_widgets(config, CONF_TEXTAREA))[0].obj
+                )
 
 
 keyboard_spec = KeyboardType()

From 06e5931ad736abf32f71140f4943f7d90eff3f11 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Mon, 20 Apr 2026 16:27:34 -0400
Subject: [PATCH 04/16] [image] Fix rodata bloat for multi-frame RGB565+alpha
 animations (#15873)

---
 esphome/components/image/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/esphome/components/image/__init__.py b/esphome/components/image/__init__.py
index 7db50597e6..8375ab91d3 100644
--- a/esphome/components/image/__init__.py
+++ b/esphome/components/image/__init__.py
@@ -756,7 +756,7 @@ async def write_image(config, all_frames=False):
             for col in range(width):
                 encoder.encode(pixels[row * width + col])
             encoder.end_row()
-        encoder.end_image()
+    encoder.end_image()
 
     rhs = [HexInt(x) for x in encoder.data]
     prog_arr = cg.progmem_array(config[CONF_RAW_DATA_ID], rhs)

From 92cb6dd7fd3c15452643ef5b58fd327ecba0dc77 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Mon, 20 Apr 2026 22:33:48 -0400
Subject: [PATCH 05/16] [core] Fix Pvariable placement new losing subclass
 identity (#15881)

---
 esphome/cpp_generator.py                      | 50 ++++++++++++-------
 tests/component_tests/ili9xxx/__init__.py     |  0
 .../ili9xxx/config/ili9xxx_test.yaml          | 20 ++++++++
 tests/component_tests/ili9xxx/test_ili9xxx.py | 31 ++++++++++++
 4 files changed, 84 insertions(+), 17 deletions(-)
 create mode 100644 tests/component_tests/ili9xxx/__init__.py
 create mode 100644 tests/component_tests/ili9xxx/config/ili9xxx_test.yaml
 create mode 100644 tests/component_tests/ili9xxx/test_ili9xxx.py

diff --git a/esphome/cpp_generator.py b/esphome/cpp_generator.py
index cf90b878e1..c622207dac 100644
--- a/esphome/cpp_generator.py
+++ b/esphome/cpp_generator.py
@@ -606,33 +606,43 @@ def Pvariable(id_: ID, rhs: SafeExpType, type_: "MockObj" = None) -> "MockObj":
     if isinstance(rhs, MockObj) and rhs.is_new_expr:
         # For 'new' allocations, use placement new into static storage
         # to avoid heap fragmentation on embedded devices.
-        the_type = id_.type
+        #
+        # Storage must be sized and aligned for the actual instantiated class,
+        # which may be a subclass of id_.type (e.g. `cv.declare_id(BaseClass)`
+        # combined with `SubClass.new()` — used by ili9xxx, waveshare_epaper,
+        # etc. to select a model-specific constructor). Using id_.type would
+        # run the base-class default constructor instead, silently losing any
+        # subclass initialization. Template args live on the CallExpression
+        # and are re-emitted below.
+        call_expr = rhs.base
+        assert isinstance(call_expr, CallExpression), (
+            f"Expected CallExpression for placement new, got {type(call_expr)}"
+        )
+        actual_type = rhs.new_type if rhs.new_type is not None else id_.type
+        if call_expr.template_args is not None:
+            actual_type = f"{actual_type}{call_expr.template_args}"
+        pointer_type = id_.type
         # Extract component namespace from type for memory analysis attribution
-        component_ns = _extract_component_ns(str(the_type))
+        component_ns = _extract_component_ns(str(actual_type))
         storage_name = f"{component_ns}__{id_.id}__pstorage"
 
         # Declare aligned byte array for the object storage
         CORE.add_global(
             RawStatement(
-                f"alignas({the_type}) static unsigned char {storage_name}[sizeof({the_type})];"
+                f"alignas({actual_type}) static unsigned char {storage_name}[sizeof({actual_type})];"
             )
         )
+        # Pointer declaration uses id_.type to preserve the declared base-class
+        # pointer type for downstream callers (polymorphism through base ptr).
         CORE.add_global(
             AssignmentExpression(
-                f"static {the_type}",
+                f"static {pointer_type}",
                 "*const ",
                 id_,
-                MockObj(f"reinterpret_cast<{the_type} *>({storage_name})"),
+                MockObj(f"reinterpret_cast<{pointer_type} *>({storage_name})"),
             )
         )
-        # Extract args from the CallExpression and rebuild as placement new.
-        # Template args are already encoded in the_type (e.g. GlobalsComponent<int>),
-        # so we only pass the constructor args, not template_args.
-        call_expr = rhs.base
-        assert isinstance(call_expr, CallExpression), (
-            f"Expected CallExpression for placement new, got {type(call_expr)}"
-        )
-        placement_new = CallExpression(f"new({id_.id}) {the_type}", *call_expr.args)
+        placement_new = CallExpression(f"new({id_.id}) {actual_type}", *call_expr.args)
         CORE.add(ExpressionStatement(placement_new))
     else:
         decl = VariableDeclarationExpression(id_.type, "*", id_, static=True)
@@ -869,12 +879,16 @@ class MockObj(Expression):
     Mostly consists of magic methods that allow ESPHome's codegen syntax.
     """
 
-    __slots__ = ("base", "op", "is_new_expr")
+    __slots__ = ("base", "op", "is_new_expr", "new_type")
 
-    def __init__(self, base, op=".", is_new_expr=False) -> None:
+    def __init__(self, base, op=".", is_new_expr=False, new_type=None) -> None:
         self.base = base
         self.op = op
         self.is_new_expr = is_new_expr
+        # For `is_new_expr=True` objects, `new_type` holds the class name being
+        # constructed (e.g. "ili9xxx::ILI9XXXST7789V"). Needed by Pvariable so
+        # placement new uses the actual subclass rather than id_.type.
+        self.new_type = new_type
 
     def __getattr__(self, attr: str) -> "MockObj":
         # prevent python dunder methods being replaced by mock objects
@@ -889,7 +903,9 @@ class MockObj(Expression):
 
     def __call__(self, *args: SafeExpType) -> "MockObj":
         call = CallExpression(self.base, *args)
-        return MockObj(call, self.op, is_new_expr=self.is_new_expr)
+        return MockObj(
+            call, self.op, is_new_expr=self.is_new_expr, new_type=self.new_type
+        )
 
     def __str__(self):
         return str(self.base)
@@ -903,7 +919,7 @@ class MockObj(Expression):
 
     @property
     def new(self) -> "MockObj":
-        return MockObj(f"new {self.base}", "->", is_new_expr=True)
+        return MockObj(f"new {self.base}", "->", is_new_expr=True, new_type=self.base)
 
     def template(self, *args: SafeExpType) -> "MockObj":
         """Apply template parameters to this object."""
diff --git a/tests/component_tests/ili9xxx/__init__.py b/tests/component_tests/ili9xxx/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/component_tests/ili9xxx/config/ili9xxx_test.yaml b/tests/component_tests/ili9xxx/config/ili9xxx_test.yaml
new file mode 100644
index 0000000000..bc6148b8d8
--- /dev/null
+++ b/tests/component_tests/ili9xxx/config/ili9xxx_test.yaml
@@ -0,0 +1,20 @@
+esphome:
+  name: test
+
+esp32:
+  board: esp32dev
+  framework:
+    type: arduino
+
+spi:
+  clk_pin: GPIO18
+  mosi_pin: GPIO23
+
+display:
+  - platform: ili9xxx
+    id: tft_display
+    model: ST7789V
+    cs_pin: GPIO5
+    dc_pin: GPIO17
+    reset_pin: GPIO16
+    invert_colors: false
diff --git a/tests/component_tests/ili9xxx/test_ili9xxx.py b/tests/component_tests/ili9xxx/test_ili9xxx.py
new file mode 100644
index 0000000000..3919eb3823
--- /dev/null
+++ b/tests/component_tests/ili9xxx/test_ili9xxx.py
@@ -0,0 +1,31 @@
+"""Tests for the ili9xxx component."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from pathlib import Path
+
+
+def test_ili9xxx_placement_new_uses_model_subclass(
+    generate_main: Callable[[str | Path], str],
+    component_config_path: Callable[[str], Path],
+) -> None:
+    """Regression test for ili9xxx picking the right constructor under placement new.
+
+    ili9xxx declares the ID as the base ``ILI9XXXDisplay`` but constructs a
+    model-specific subclass (e.g. ``ILI9XXXST7789V``) via ``MODELS[...].new()``.
+    Pvariable must emit placement new for the subclass — otherwise the base
+    default constructor runs and the panel is left with a null init sequence
+    and 0x0 dimensions, producing a silent blank screen.
+    """
+    main_cpp = generate_main(component_config_path("ili9xxx_test.yaml"))
+
+    # Storage is sized for the subclass so the full object fits.
+    assert "sizeof(ili9xxx::ILI9XXXST7789V)" in main_cpp
+    assert "alignas(ili9xxx::ILI9XXXST7789V)" in main_cpp
+    # Pointer is declared as the base type for polymorphism.
+    assert "static ili9xxx::ILI9XXXDisplay *const tft_display" in main_cpp
+    # Placement new runs the subclass constructor — this is the actual regression fix.
+    assert "new(tft_display) ili9xxx::ILI9XXXST7789V()" in main_cpp
+    # Base-class default constructor must NOT be used.
+    assert "new(tft_display) ili9xxx::ILI9XXXDisplay()" not in main_cpp

From 5c2ceb63e030c567933a80cda8102da844355206 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Tue, 21 Apr 2026 07:47:07 -0400
Subject: [PATCH 06/16] [ld2412] Fix null deref in set_basic_config when
 entities unconfigured (#15893)

---
 esphome/components/ld2412/ld2412.cpp | 42 ++++++++++++++++------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/esphome/components/ld2412/ld2412.cpp b/esphome/components/ld2412/ld2412.cpp
index 38e1a59aba..2955852200 100644
--- a/esphome/components/ld2412/ld2412.cpp
+++ b/esphome/components/ld2412/ld2412.cpp
@@ -766,32 +766,38 @@ void LD2412Component::get_distance_resolution_() { this->send_command_(CMD_QUERY
 void LD2412Component::query_light_control_() { this->send_command_(CMD_QUERY_LIGHT_CONTROL, nullptr, 0); }
 
 void LD2412Component::set_basic_config() {
+  uint8_t min_gate = 1;
+  uint8_t max_gate = TOTAL_GATES;
+  uint16_t timeout = DEFAULT_PRESENCE_TIMEOUT;
+  uint8_t out_pin_level = 0x01;
+
 #ifdef USE_NUMBER
-  if (!this->min_distance_gate_number_->has_state() || !this->max_distance_gate_number_->has_state() ||
-      !this->timeout_number_->has_state()) {
-    return;
+  if (this->min_distance_gate_number_ != nullptr) {
+    if (!this->min_distance_gate_number_->has_state())
+      return;
+    min_gate = static_cast<int>(this->min_distance_gate_number_->state);
+  }
+  if (this->max_distance_gate_number_ != nullptr) {
+    if (!this->max_distance_gate_number_->has_state())
+      return;
+    max_gate = static_cast<int>(this->max_distance_gate_number_->state) + 1;
+  }
+  if (this->timeout_number_ != nullptr) {
+    if (!this->timeout_number_->has_state())
+      return;
+    timeout = static_cast<int>(this->timeout_number_->state);
   }
 #endif
 #ifdef USE_SELECT
-  if (!this->out_pin_level_select_->has_state()) {
-    return;
+  if (this->out_pin_level_select_ != nullptr) {
+    if (!this->out_pin_level_select_->has_state())
+      return;
+    out_pin_level = find_uint8(OUT_PIN_LEVELS_BY_STR, this->out_pin_level_select_->current_option().c_str());
   }
 #endif
 
   uint8_t value[5] = {
-#ifdef USE_NUMBER
-      lowbyte(static_cast<int>(this->min_distance_gate_number_->state)),
-      lowbyte(static_cast<int>(this->max_distance_gate_number_->state) + 1),
-      lowbyte(static_cast<int>(this->timeout_number_->state)),
-      highbyte(static_cast<int>(this->timeout_number_->state)),
-#else
-      1,    TOTAL_GATES, DEFAULT_PRESENCE_TIMEOUT, 0,
-#endif
-#ifdef USE_SELECT
-      find_uint8(OUT_PIN_LEVELS_BY_STR, this->out_pin_level_select_->current_option().c_str()),
-#else
-      0x01,  // Default value if not using select
-#endif
+      lowbyte(min_gate), lowbyte(max_gate), lowbyte(timeout), highbyte(timeout), out_pin_level,
   };
   this->set_config_mode_(true);
   this->send_command_(CMD_BASIC_CONF, value, sizeof(value));

From 629da4d878789f0f0da91ea5a633635738731c7d Mon Sep 17 00:00:00 2001
From: Keith Burzinski <kbx81x@gmail.com>
Date: Tue, 21 Apr 2026 18:25:05 -0500
Subject: [PATCH 07/16] [esp32] Add Secure Boot V1 ECDSA signing scheme for
 pre-rev-3.0 ESP32 (#15882)

---
 esphome/components/esp32/__init__.py          |  95 +++++++++++---
 esphome/components/esp32/post_build.py.script | 123 +++++++++++++++++-
 .../esp32/dummy_signing_key_v1_ecdsa.pem      |   7 +
 .../esp32/test-signed_ota_v1.esp32-idf.yaml   |  10 ++
 4 files changed, 212 insertions(+), 23 deletions(-)
 create mode 100644 tests/components/esp32/dummy_signing_key_v1_ecdsa.pem
 create mode 100644 tests/components/esp32/test-signed_ota_v1.esp32-idf.yaml

diff --git a/esphome/components/esp32/__init__.py b/esphome/components/esp32/__init__.py
index a68614cb43..77b405a449 100644
--- a/esphome/components/esp32/__init__.py
+++ b/esphome/components/esp32/__init__.py
@@ -128,23 +128,30 @@ ASSERTION_LEVELS = {
 SIGNING_SCHEMES = {
     "rsa3072": "CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME",
     "ecdsa256": "CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME",
+    "ecdsa_v1": "CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME",
 }
 
-# Chip variants that only support one signing scheme for Secure Boot V2.
+# Chip variants that only support one V2 signing scheme.
 # Based on SOC_SECURE_BOOT_V2_RSA / SOC_SECURE_BOOT_V2_ECC in soc_caps.h.
-# Variants not listed in either set support both RSA and ECDSA
+# Variants not listed in either set support both RSA and ECDSA V2
 # (e.g. C5, C6, H2, P4). New variants should be added to the
 # appropriate set if they only support one scheme.
-SIGNED_OTA_RSA_ONLY_VARIANTS = {
-    VARIANT_ESP32,
+# Note: VARIANT_ESP32 is not listed here because it supports V2 RSA only
+# when minimum_chip_revision >= 3.0, which requires special handling.
+SIGNED_OTA_V2_RSA_ONLY_VARIANTS = {
     VARIANT_ESP32S2,
     VARIANT_ESP32S3,
     VARIANT_ESP32C3,
 }
-SIGNED_OTA_ECC_ONLY_VARIANTS = {
+SIGNED_OTA_V2_ECC_ONLY_VARIANTS = {
     VARIANT_ESP32C2,
     VARIANT_ESP32C61,
 }
+# V1 ECDSA (Secure Boot V1) is only supported on the original ESP32.
+# Based on SOC_SECURE_BOOT_V1 in soc_caps.h.
+SIGNED_OTA_V1_ECDSA_VARIANTS = {
+    VARIANT_ESP32,
+}
 
 COMPILER_OPTIMIZATIONS = {
     "DEBUG": "CONFIG_COMPILER_OPTIMIZATION_DEBUG",
@@ -991,25 +998,73 @@ def final_validate(config):
     if signed_ota := advanced.get(CONF_SIGNED_OTA_VERIFICATION):
         scheme = signed_ota[CONF_SIGNING_SCHEME]
         variant = config[CONF_VARIANT]
-        scheme_variant_conflicts = {
-            "ecdsa256": (SIGNED_OTA_RSA_ONLY_VARIANTS, "rsa3072"),
-            "rsa3072": (SIGNED_OTA_ECC_ONLY_VARIANTS, "ecdsa256"),
-        }
-        if (conflict := scheme_variant_conflicts.get(scheme)) and variant in conflict[
-            0
-        ]:
+        min_rev = advanced.get(CONF_MINIMUM_CHIP_REVISION)
+        scheme_path = [
+            CONF_FRAMEWORK,
+            CONF_ADVANCED,
+            CONF_SIGNED_OTA_VERIFICATION,
+            CONF_SIGNING_SCHEME,
+        ]
+
+        # V1 ECDSA is only available on the original ESP32
+        if scheme == "ecdsa_v1" and variant not in SIGNED_OTA_V1_ECDSA_VARIANTS:
             errs.append(
                 cv.Invalid(
-                    f"Signing scheme '{scheme}' is not supported on "
-                    f"{VARIANT_FRIENDLY[variant]}. Use '{conflict[1]}' instead.",
-                    path=[
-                        CONF_FRAMEWORK,
-                        CONF_ADVANCED,
-                        CONF_SIGNED_OTA_VERIFICATION,
-                        CONF_SIGNING_SCHEME,
-                    ],
+                    f"Signing scheme 'ecdsa_v1' is only supported on "
+                    f"{VARIANT_FRIENDLY[VARIANT_ESP32]}. "
+                    f"Use 'rsa3072' or 'ecdsa256' instead.",
+                    path=scheme_path,
                 )
             )
+        elif variant == VARIANT_ESP32:
+            # On ESP32, V2 RSA requires minimum_chip_revision >= 3.0
+            # Note: string comparison works here because cv.one_of constrains
+            # min_rev to known ESP32_CHIP_REVISIONS values ("0.0".."3.1").
+            if scheme == "rsa3072" and (min_rev is None or min_rev < "3.0"):
+                errs.append(
+                    cv.Invalid(
+                        f"Signing scheme 'rsa3072' on {VARIANT_FRIENDLY[variant]} "
+                        f"requires minimum_chip_revision: '3.0' or higher "
+                        f"(Secure Boot V2 RSA needs chip revision 3.0+). "
+                        f"For older chip revisions, use 'ecdsa_v1' instead.",
+                        path=scheme_path,
+                    )
+                )
+            # ESP32 does not support V2 ECDSA (no SOC_SECURE_BOOT_V2_ECC)
+            elif scheme == "ecdsa256":
+                errs.append(
+                    cv.Invalid(
+                        f"Signing scheme 'ecdsa256' is not supported on "
+                        f"{VARIANT_FRIENDLY[variant]}. Use 'rsa3072' (with "
+                        f"minimum_chip_revision: '3.0') or 'ecdsa_v1' instead.",
+                        path=scheme_path,
+                    )
+                )
+            # V1 on rev 3.0+ -- suggest V2 RSA for stronger security
+            elif scheme == "ecdsa_v1" and min_rev is not None and min_rev >= "3.0":
+                _LOGGER.info(
+                    "Using Secure Boot V1 ECDSA on %s rev %s. "
+                    "Consider using 'rsa3072' (Secure Boot V2 RSA) for "
+                    "stronger security on chip revision 3.0+.",
+                    VARIANT_FRIENDLY[variant],
+                    min_rev,
+                )
+        else:
+            # Non-ESP32 variants: check V2 scheme-variant compatibility
+            scheme_variant_conflicts = {
+                "ecdsa256": (SIGNED_OTA_V2_RSA_ONLY_VARIANTS, "rsa3072"),
+                "rsa3072": (SIGNED_OTA_V2_ECC_ONLY_VARIANTS, "ecdsa256"),
+            }
+            if (
+                conflict := scheme_variant_conflicts.get(scheme)
+            ) and variant in conflict[0]:
+                errs.append(
+                    cv.Invalid(
+                        f"Signing scheme '{scheme}' is not supported on "
+                        f"{VARIANT_FRIENDLY[variant]}. Use '{conflict[1]}' instead.",
+                        path=scheme_path,
+                    )
+                )
         if CONF_OTA not in full_config:
             _LOGGER.warning(
                 "Signed OTA verification is enabled but no OTA component is configured. "
diff --git a/esphome/components/esp32/post_build.py.script b/esphome/components/esp32/post_build.py.script
index 8d13214259..b329f6b82b 100644
--- a/esphome/components/esp32/post_build.py.script
+++ b/esphome/components/esp32/post_build.py.script
@@ -5,6 +5,7 @@ import json  # noqa: E402
 import os  # noqa: E402
 import pathlib  # noqa: E402
 import shutil  # noqa: E402
+import subprocess  # noqa: E402
 from glob import glob  # noqa: E402
 
 
@@ -25,6 +26,114 @@ def _parse_sdkconfig(sdkconfig_path):
     return options
 
 
+def _generate_v1_verification_key(env):
+    """Generate the V1 ECDSA verification key binary and assembly source file.
+
+    Secure Boot V1 embeds the public verification key directly in the app binary
+    as a compiled object (via a .S assembly file). The ESP-IDF CMake build generates
+    these files via custom commands, but PlatformIO's SCons bridge does not execute
+    them. This function replicates that logic:
+      1. Extracts the raw public key from the PEM signing key using espsecure.
+      2. Generates the .S assembly source that embeds the key bytes.
+    """
+    build_dir = pathlib.Path(env.subst("$BUILD_DIR"))
+    project_dir = pathlib.Path(env.subst("$PROJECT_DIR"))
+    pioenv = env.subst("$PIOENV")
+    sdkconfig = _parse_sdkconfig(project_dir / f"sdkconfig.{pioenv}")
+
+    if sdkconfig.get("CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME") != "y":
+        return
+
+    bin_path = build_dir / "signature_verification_key.bin"
+    asm_path = build_dir / "signature_verification_key.bin.S"
+
+    # Determine the source of the verification key
+    if sdkconfig.get("CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES") == "y":
+        # Extract public key from the signing key
+        signing_key = sdkconfig.get("CONFIG_SECURE_BOOT_SIGNING_KEY")
+        if not signing_key:
+            return
+        signing_key_path = pathlib.Path(signing_key)
+        if not signing_key_path.exists():
+            print(f"Error: V1 ECDSA signing key not found: {signing_key_path}")
+            env.Exit(1)
+            return
+
+        if not bin_path.exists() or bin_path.stat().st_mtime < signing_key_path.stat().st_mtime:
+            python_exe = env.subst("$PYTHONEXE")
+            result = subprocess.run(
+                [python_exe, "-m", "espsecure", "extract_public_key",
+                 "--keyfile", str(signing_key_path), str(bin_path)],
+                capture_output=True, text=True,
+            )
+            if result.returncode != 0:
+                print(f"Error extracting V1 verification key: {result.stderr}")
+                env.Exit(1)
+                return
+            print(f"Extracted V1 ECDSA verification key from {signing_key_path.name}")
+    else:
+        # User-provided verification key -- should already be a raw binary file
+        verification_key = sdkconfig.get("CONFIG_SECURE_BOOT_VERIFICATION_KEY")
+        if not verification_key:
+            return
+        verification_key_path = pathlib.Path(verification_key)
+        if not verification_key_path.exists():
+            print(f"Error: Verification key not found: {verification_key_path}")
+            env.Exit(1)
+            return
+        shutil.copyfile(str(verification_key_path), str(bin_path))
+
+    if not bin_path.exists():
+        return
+
+    # Generate the .S assembly file from the binary key data.
+    # Replicates ESP-IDF's data_file_embed_asm.cmake with RENAME_TO=signature_verification_key_bin.
+    # The file is needed in both the app build dir and the bootloader build dir, since
+    # the bootloader also embeds the verification key when CONFIG_SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
+    # is enabled. PlatformIO's SCons bridge does not execute the CMake custom commands that
+    # normally generate these files.
+    data = bin_path.read_bytes()
+    varname = "signature_verification_key_bin"
+
+    lines = []
+    lines.append(f"/* Data converted from {bin_path.name} */")
+    lines.append(".data")
+    lines.append("#if !defined (__APPLE__) && !defined (__linux__)")
+    lines.append(".section .rodata.embedded")
+    lines.append("#endif")
+    lines.append(f"\n.global {varname}")
+    lines.append(f"{varname}:")
+    lines.append(f"\n.global _binary_{varname}_start")
+    lines.append(f"_binary_{varname}_start: /* for objcopy compatibility */")
+
+    # Format binary data as .byte lines (16 bytes per line)
+    for i in range(0, len(data), 16):
+        chunk = data[i:i + 16]
+        hex_bytes = ", ".join(f"0x{b:02x}" for b in chunk)
+        lines.append(f".byte {hex_bytes}")
+
+    lines.append(f"\n.global _binary_{varname}_end")
+    lines.append(f"_binary_{varname}_end: /* for objcopy compatibility */")
+    lines.append(f"\n.global {varname}_length")
+    lines.append(f"{varname}_length:")
+    lines.append(f".long {len(data)}")
+    lines.append("")
+    lines.append('#if defined (__linux__)')
+    lines.append('.section .note.GNU-stack,"",@progbits')
+    lines.append("#endif")
+
+    asm_content = "\n".join(lines) + "\n"
+
+    # Write to app build dir and bootloader build dir
+    asm_path.write_text(asm_content)
+    bootloader_dir = build_dir / "bootloader"
+    if bootloader_dir.is_dir():
+        bootloader_bin = bootloader_dir / "signature_verification_key.bin"
+        bootloader_asm = bootloader_dir / "signature_verification_key.bin.S"
+        shutil.copyfile(str(bin_path), str(bootloader_bin))
+        bootloader_asm.write_text(asm_content)
+
+
 def sign_firmware(source, target, env):
     """
     Sign the firmware binary using espsecure.py if signed OTA verification is enabled.
@@ -55,9 +164,12 @@ def sign_firmware(source, target, env):
         env.Exit(1)
         return
 
-    # ESPHome only exposes RSA3072 and ECDSA256 (both Secure Boot V2 schemes),
-    # so the espsecure signature version is always 2.
-    sign_version = "2"
+    # Determine espsecure signature version from the signing scheme:
+    # V1 ECDSA (Secure Boot V1) uses --version 1, V2 RSA/ECDSA use --version 2.
+    if sdkconfig.get("CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME") == "y":
+        sign_version = "1"
+    else:
+        sign_version = "2"
 
     firmware_name = os.path.basename(env.subst("$PROGNAME")) + ".bin"
     firmware_path = build_dir / firmware_name
@@ -217,6 +329,11 @@ def esp32_copy_ota_bin(source, target, env):
     print(f"Copied firmware to {new_file_name}")
 
 
+# Generate V1 ECDSA verification key files before build starts.
+# Workaround for PlatformIO not executing CMake custom commands that extract
+# the public key and generate the .S assembly file for Secure Boot V1.
+_generate_v1_verification_key(env)  # noqa: F821
+
 # Run signing first, then merge, then ota copy
 env.AddPostAction("$BUILD_DIR/${PROGNAME}.bin", sign_firmware)  # noqa: F821
 env.AddPostAction("$BUILD_DIR/${PROGNAME}.bin", merge_factory_bin)  # noqa: F821
diff --git a/tests/components/esp32/dummy_signing_key_v1_ecdsa.pem b/tests/components/esp32/dummy_signing_key_v1_ecdsa.pem
new file mode 100644
index 0000000000..bd09205606
--- /dev/null
+++ b/tests/components/esp32/dummy_signing_key_v1_ecdsa.pem
@@ -0,0 +1,7 @@
+*** DO NOT USE THIS KEY...EVER ***
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIEZIp96p7Z7QN6vxOFE5FdRNm535vW81Ax07KnGxVjiMoAoGCCqGSM49
+AwEHoUQDQgAEK+fBQDn1Q+r5lGwcDoMUgeg2Aq16LLrLUz7xWI6mS0PUClzolDIo
+eaV/Pfjl7zAvkbQQsZq3rTNnr1eGAk5P+A==
+-----END EC PRIVATE KEY-----
+*** DO NOT USE THIS KEY...EVER ***
diff --git a/tests/components/esp32/test-signed_ota_v1.esp32-idf.yaml b/tests/components/esp32/test-signed_ota_v1.esp32-idf.yaml
new file mode 100644
index 0000000000..b32e157daf
--- /dev/null
+++ b/tests/components/esp32/test-signed_ota_v1.esp32-idf.yaml
@@ -0,0 +1,10 @@
+esp32:
+  variant: esp32
+  framework:
+    type: esp-idf
+    advanced:
+      signed_ota_verification:
+        signing_key: ../../components/esp32/dummy_signing_key_v1_ecdsa.pem
+        signing_scheme: ecdsa_v1
+
+<<: !include common.yaml

From 2a3bd8bc85d8fc63ec4f6e7b52c07af93873b1d1 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Wed, 22 Apr 2026 17:05:15 -0400
Subject: [PATCH 08/16] [io_expanders] Self-heal interrupt-driven expanders
 when INT stays asserted across the read (#15923)

---
 esphome/components/mcp23016/mcp23016.cpp         | 5 ++++-
 esphome/components/mcp23xxx_base/mcp23xxx_base.h | 5 ++++-
 esphome/components/pca6416a/pca6416a.cpp         | 5 ++++-
 esphome/components/pca9554/pca9554.cpp           | 6 ++++--
 esphome/components/pcf8574/pcf8574.cpp           | 6 ++++--
 esphome/components/pi4ioe5v6408/pi4ioe5v6408.cpp | 5 ++++-
 esphome/components/tca9555/tca9555.cpp           | 5 ++++-
 7 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/esphome/components/mcp23016/mcp23016.cpp b/esphome/components/mcp23016/mcp23016.cpp
index 118a77ce37..b7a9cfd0ce 100644
--- a/esphome/components/mcp23016/mcp23016.cpp
+++ b/esphome/components/mcp23016/mcp23016.cpp
@@ -37,7 +37,10 @@ void IRAM_ATTR MCP23016::gpio_intr(MCP23016 *arg) { arg->enable_loop_soon_any_co
 void MCP23016::loop() {
   // Invalidate cache at the start of each loop
   this->reset_pin_cache_();
-  if (this->interrupt_pin_ != nullptr) {
+  // Only disable the loop once INT has actually gone HIGH. Input transitions that straddle the
+  // I2C read leave INT asserted without re-firing a falling edge, which would strand us with
+  // stale state forever; keep looping until the line is released so we self-heal.
+  if (this->interrupt_pin_ != nullptr && this->interrupt_pin_->digital_read()) {
     this->disable_loop();
   }
 }
diff --git a/esphome/components/mcp23xxx_base/mcp23xxx_base.h b/esphome/components/mcp23xxx_base/mcp23xxx_base.h
index 6efd04e246..8a87dac143 100644
--- a/esphome/components/mcp23xxx_base/mcp23xxx_base.h
+++ b/esphome/components/mcp23xxx_base/mcp23xxx_base.h
@@ -21,7 +21,10 @@ template<uint8_t N> class MCP23XXXBase : public Component, public gpio_expander:
 
   void loop() override {
     this->reset_pin_cache_();
-    if (this->interrupt_pin_ != nullptr) {
+    // Only disable the loop once INT has actually gone HIGH. Input transitions that straddle the
+    // I2C read leave INT asserted without re-firing a falling edge, which would strand us with
+    // stale state forever; keep looping until the line is released so we self-heal.
+    if (this->interrupt_pin_ != nullptr && this->interrupt_pin_->digital_read()) {
       this->disable_loop();
     }
   }
diff --git a/esphome/components/pca6416a/pca6416a.cpp b/esphome/components/pca6416a/pca6416a.cpp
index dc7463b01b..d617336e7e 100644
--- a/esphome/components/pca6416a/pca6416a.cpp
+++ b/esphome/components/pca6416a/pca6416a.cpp
@@ -62,7 +62,10 @@ void IRAM_ATTR PCA6416AComponent::gpio_intr(PCA6416AComponent *arg) { arg->enabl
 void PCA6416AComponent::loop() {
   // Invalidate cache at the start of each loop
   this->reset_pin_cache_();
-  if (this->interrupt_pin_ != nullptr) {
+  // Only disable the loop once INT has actually gone HIGH. Input transitions that straddle the
+  // I2C read leave INT asserted without re-firing a falling edge, which would strand us with
+  // stale state forever; keep looping until the line is released so we self-heal.
+  if (this->interrupt_pin_ != nullptr && this->interrupt_pin_->digital_read()) {
     this->disable_loop();
   }
 }
diff --git a/esphome/components/pca9554/pca9554.cpp b/esphome/components/pca9554/pca9554.cpp
index ac4f119dfe..393bbfd61e 100644
--- a/esphome/components/pca9554/pca9554.cpp
+++ b/esphome/components/pca9554/pca9554.cpp
@@ -50,8 +50,10 @@ void IRAM_ATTR PCA9554Component::gpio_intr(PCA9554Component *arg) { arg->enable_
 void PCA9554Component::loop() {
   // Invalidate the cache so the next digital_read() triggers a fresh I2C read
   this->reset_pin_cache_();
-  if (this->interrupt_pin_ != nullptr) {
-    // Interrupt-driven: disable loop until next interrupt fires
+  // Only disable the loop once INT has actually gone HIGH. Input transitions that straddle the
+  // I2C read leave INT asserted without re-firing a falling edge, which would strand us with
+  // stale state forever; keep looping until the line is released so we self-heal.
+  if (this->interrupt_pin_ != nullptr && this->interrupt_pin_->digital_read()) {
     this->disable_loop();
   }
 }
diff --git a/esphome/components/pcf8574/pcf8574.cpp b/esphome/components/pcf8574/pcf8574.cpp
index bf4a9442a2..8fe8526797 100644
--- a/esphome/components/pcf8574/pcf8574.cpp
+++ b/esphome/components/pcf8574/pcf8574.cpp
@@ -31,8 +31,10 @@ void IRAM_ATTR PCF8574Component::gpio_intr(PCF8574Component *arg) { arg->enable_
 void PCF8574Component::loop() {
   // Invalidate the cache so the next digital_read() triggers a fresh I2C read
   this->reset_pin_cache_();
-  if (this->interrupt_pin_ != nullptr) {
-    // Interrupt-driven: disable loop until next interrupt fires
+  // Only disable the loop once INT has actually gone HIGH. Input transitions that straddle the
+  // I2C read leave INT asserted without re-firing a falling edge, which would strand us with
+  // stale state forever; keep looping until the line is released so we self-heal.
+  if (this->interrupt_pin_ != nullptr && this->interrupt_pin_->digital_read()) {
     this->disable_loop();
   }
 }
diff --git a/esphome/components/pi4ioe5v6408/pi4ioe5v6408.cpp b/esphome/components/pi4ioe5v6408/pi4ioe5v6408.cpp
index 6e8631022a..00f29983be 100644
--- a/esphome/components/pi4ioe5v6408/pi4ioe5v6408.cpp
+++ b/esphome/components/pi4ioe5v6408/pi4ioe5v6408.cpp
@@ -82,7 +82,10 @@ void PI4IOE5V6408Component::pin_mode(uint8_t pin, gpio::Flags flags) {
 
 void PI4IOE5V6408Component::loop() {
   this->reset_pin_cache_();
-  if (this->interrupt_pin_ != nullptr) {
+  // Only disable the loop once INT has actually gone HIGH. Input transitions that straddle the
+  // I2C read leave INT asserted without re-firing a falling edge, which would strand us with
+  // stale state forever; keep looping until the line is released so we self-heal.
+  if (this->interrupt_pin_ != nullptr && this->interrupt_pin_->digital_read()) {
     this->disable_loop();
   }
 }
diff --git a/esphome/components/tca9555/tca9555.cpp b/esphome/components/tca9555/tca9555.cpp
index 3eb794df44..2fefe08c0d 100644
--- a/esphome/components/tca9555/tca9555.cpp
+++ b/esphome/components/tca9555/tca9555.cpp
@@ -57,7 +57,10 @@ void TCA9555Component::pin_mode(uint8_t pin, gpio::Flags flags) {
 }
 void TCA9555Component::loop() {
   this->reset_pin_cache_();
-  if (this->interrupt_pin_ != nullptr) {
+  // Only disable the loop once INT has actually gone HIGH. Input transitions that straddle the
+  // I2C read leave INT asserted without re-firing a falling edge, which would strand us with
+  // stale state forever; keep looping until the line is released so we self-heal.
+  if (this->interrupt_pin_ != nullptr && this->interrupt_pin_->digital_read()) {
     this->disable_loop();
   }
 }

From 76eb8f697f43b4777dffa66a327024b027a46d0e Mon Sep 17 00:00:00 2001
From: Keith Burzinski <kbx81x@gmail.com>
Date: Wed, 22 Apr 2026 16:16:14 -0500
Subject: [PATCH 09/16] [usb_uart] Derive TX output chunk count from
 `buffer_size` config (#15909)

---
 esphome/components/usb_uart/__init__.py | 13 ++++++++++++-
 esphome/components/usb_uart/usb_uart.h  |  5 +++--
 esphome/core/defines.h                  |  1 +
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/esphome/components/usb_uart/__init__.py b/esphome/components/usb_uart/__init__.py
index 0e8994a3ed..d542788fb9 100644
--- a/esphome/components/usb_uart/__init__.py
+++ b/esphome/components/usb_uart/__init__.py
@@ -116,12 +116,23 @@ CONFIG_SCHEMA = cv.ensure_list(
 
 
 async def to_code(config):
+    # The output chunk pool/queue are compile-time-sized templates shared by all
+    # USBUartChannel instances, so use the largest buffer_size across every channel
+    # of every device.  Each chunk is 64 bytes (USB FS MPS); add one extra slot
+    # because LockFreeQueue<T,N> is a ring buffer that wastes one entry.
+    max_buffer_size = max(
+        channel[CONF_BUFFER_SIZE]
+        for device in config
+        for channel in device[CONF_CHANNELS]
+    )
+    output_chunk_count = max_buffer_size // 64 + 1
+    cg.add_define("USB_UART_OUTPUT_CHUNK_COUNT", output_chunk_count)
+
     for device in config:
         var = await register_usb_client(device)
         for index, channel in enumerate(device[CONF_CHANNELS]):
             chvar = cg.new_Pvariable(channel[CONF_ID], index, channel[CONF_BUFFER_SIZE])
             await cg.register_parented(chvar, var)
-            cg.add(chvar.set_rx_buffer_size(channel[CONF_BUFFER_SIZE]))
             cg.add(chvar.set_stop_bits(channel[CONF_STOP_BITS]))
             cg.add(chvar.set_data_bits(channel[CONF_DATA_BITS]))
             cg.add(chvar.set_parity(channel[CONF_PARITY]))
diff --git a/esphome/components/usb_uart/usb_uart.h b/esphome/components/usb_uart/usb_uart.h
index 8e8e65032d..f9648b795b 100644
--- a/esphome/components/usb_uart/usb_uart.h
+++ b/esphome/components/usb_uart/usb_uart.h
@@ -132,8 +132,9 @@ class USBUartChannel : public uart::UARTComponent, public Parented<USBUartCompon
   friend class USBUartTypeCH34X;
 
  public:
-  // Number of output chunk slots per channel (8 × 64 bytes = 512 bytes peak, lazily allocated)
-  static constexpr uint8_t USB_OUTPUT_CHUNK_COUNT = 8;
+  // Number of output chunk slots per channel, derived from buffer_size config.
+  // Computed as ceil(buffer_size / 64) + 1 in Python codegen; defaults to 5 (256 / 64 + 1).
+  static constexpr uint8_t USB_OUTPUT_CHUNK_COUNT = USB_UART_OUTPUT_CHUNK_COUNT;
 
   USBUartChannel(uint8_t index, uint16_t buffer_size) : index_(index), input_buffer_(RingBuffer(buffer_size)) {}
   void write_array(const uint8_t *data, size_t len) override;
diff --git a/esphome/core/defines.h b/esphome/core/defines.h
index d8b4faced9..1a8f3ef0bf 100644
--- a/esphome/core/defines.h
+++ b/esphome/core/defines.h
@@ -284,6 +284,7 @@
 #define ESPHOME_WIFI_POWER_SAVE_LISTENERS 2
 #define USE_WIFI_RUNTIME_POWER_SAVE
 #define USB_HOST_MAX_REQUESTS 16
+#define USB_UART_OUTPUT_CHUNK_COUNT 5
 
 #ifdef USE_ARDUINO
 #define USE_ARDUINO_VERSION_CODE VERSION_CODE(3, 3, 7)

From 00b71208a604bd84f8cee874e4794a2600c59f6d Mon Sep 17 00:00:00 2001
From: Jesse Hills <3060199+jesserockz@users.noreply.github.com>
Date: Thu, 23 Apr 2026 11:18:39 +1200
Subject: [PATCH 10/16] Bump version to 2026.4.2

---
 Doxyfile         | 2 +-
 esphome/const.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doxyfile b/Doxyfile
index deb57df1d3..1cd12551dd 100644
--- a/Doxyfile
+++ b/Doxyfile
@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.4.1
+PROJECT_NUMBER         = 2026.4.2
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
diff --git a/esphome/const.py b/esphome/const.py
index 1f5b3b6c57..ef37cb2df6 100644
--- a/esphome/const.py
+++ b/esphome/const.py
@@ -4,7 +4,7 @@ from enum import Enum
 
 from esphome.enum import StrEnum
 
-__version__ = "2026.4.1"
+__version__ = "2026.4.2"
 
 ALLOWED_NAME_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789-_"
 VALID_SUBSTITUTIONS_CHARACTERS = (

From 6253947311c112ef24de67ca785aab622b974139 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 22 Apr 2026 19:12:02 -0500
Subject: [PATCH 11/16] Bump click from 8.3.2 to 8.3.3 (#15927)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 9e59bb59d0..821ca1927a 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -10,7 +10,7 @@ tzdata>=2026.1  # from time
 pyserial==3.5
 platformio==6.1.19
 esptool==5.2.0
-click==8.3.2
+click==8.3.3
 esphome-dashboard==20260408.1
 aioesphomeapi==44.19.0
 zeroconf==0.148.0

From 17f92698410301ee21a7546b45f945f7270406dd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 22 Apr 2026 19:12:15 -0500
Subject: [PATCH 12/16] Update wheel requirement from <0.47,>=0.43 to
 >=0.43,<0.48 (#15926)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index a744286e88..dc6785001d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools==82.0.1", "wheel>=0.43,<0.47"]
+requires = ["setuptools==82.0.1", "wheel>=0.43,<0.48"]
 build-backend = "setuptools.build_meta"
 
 [project]

From 224cc7b4199a01d5c365996c602379b7fc078135 Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Thu, 23 Apr 2026 12:35:00 +1000
Subject: [PATCH 13/16] [lvgl] Triggers on tabview tabs fix (#15935)

---
 esphome/components/lvgl/widgets/tabview.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/esphome/components/lvgl/widgets/tabview.py b/esphome/components/lvgl/widgets/tabview.py
index 108bb38df5..5e9e0494dd 100644
--- a/esphome/components/lvgl/widgets/tabview.py
+++ b/esphome/components/lvgl/widgets/tabview.py
@@ -22,7 +22,7 @@ from ..defines import (
     literal,
 )
 from ..lv_validation import animated, lv_int, size
-from ..lvcode import LocalVariable, lv, lv_assign, lv_expr, lv_obj
+from ..lvcode import LocalVariable, lv, lv_assign, lv_expr, lv_obj, lv_Pvariable
 from ..schemas import container_schema, part_schema
 from ..types import LV_EVENT, LvType, ObjUpdateAction, lv_obj_t, lv_obj_t_ptr
 from . import Widget, WidgetType, add_widgets, get_widgets, set_obj_properties
@@ -83,8 +83,8 @@ class TabviewType(WidgetType):
         await w.set_property("tab_bar_size", await size.process(config[CONF_SIZE]))
         for tab_conf in config[CONF_TABS]:
             w_id = tab_conf[CONF_ID]
-            tab_obj = cg.Pvariable(w_id, cg.nullptr, type_=lv_tab_t)
-            tab_widget = Widget.create(w_id, tab_obj, obj_spec)
+            tab_obj = lv_Pvariable(lv_tab_t, w_id)
+            tab_widget = Widget.create(w_id, tab_obj, obj_spec, tab_conf)
             lv_assign(tab_obj, lv_expr.tabview_add_tab(w.obj, tab_conf[CONF_NAME]))
             await set_obj_properties(tab_widget, tab_conf)
             await add_widgets(tab_widget, tab_conf)

From e1d629f0d2f739de4b04f4c7d1b10ef90c2aa513 Mon Sep 17 00:00:00 2001
From: Jesse Hills <3060199+jesserockz@users.noreply.github.com>
Date: Thu, 23 Apr 2026 14:35:13 +1200
Subject: [PATCH 14/16] [time] Handle Windows EINVAL when validating POSIX TZ
 strings (#15934)

---
 esphome/components/time/__init__.py      |  7 +++
 tests/unit_tests/components/test_time.py | 67 +++++++++++++++++++++++-
 2 files changed, 73 insertions(+), 1 deletion(-)

diff --git a/esphome/components/time/__init__.py b/esphome/components/time/__init__.py
index 37c08b3a12..3295366fea 100644
--- a/esphome/components/time/__init__.py
+++ b/esphome/components/time/__init__.py
@@ -1,3 +1,4 @@
+import errno
 from importlib import resources
 import logging
 
@@ -74,6 +75,12 @@ def _load_tzdata(iana_key: str) -> bytes | None:
         return (resources.files(package) / resource).read_bytes()
     except (FileNotFoundError, ModuleNotFoundError, IsADirectoryError):
         return None
+    except OSError as e:
+        # Windows raises EINVAL for paths with NTFS-illegal chars (e.g. '<'/'>'
+        # in POSIX TZ strings like "<+08>-8" that validate_tz feeds back here).
+        if e.errno == errno.EINVAL:
+            return None
+        raise
 
 
 def _extract_tz_string(tzfile: bytes) -> str:
diff --git a/tests/unit_tests/components/test_time.py b/tests/unit_tests/components/test_time.py
index 48988fb03f..6325bfbe75 100644
--- a/tests/unit_tests/components/test_time.py
+++ b/tests/unit_tests/components/test_time.py
@@ -1,6 +1,11 @@
 """Tests for time component cron expression parsing."""
 
-from esphome.components.time import _parse_cron_part
+import errno
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from esphome.components.time import _load_tzdata, _parse_cron_part, validate_tz
 
 
 def test_star_slash_seconds() -> None:
@@ -78,3 +83,63 @@ def test_range() -> None:
 
 def test_single_value() -> None:
     assert _parse_cron_part("30", 0, 59, {}) == {30}
+
+
+def _mock_resources_with_error(error: Exception) -> MagicMock:
+    """Return a mock of importlib.resources.files where read_bytes raises error."""
+    leaf = MagicMock()
+    leaf.read_bytes.side_effect = error
+    package = MagicMock()
+    package.__truediv__.return_value = leaf
+    return MagicMock(return_value=package)
+
+
+def test_load_tzdata_returns_none_on_windows_einval() -> None:
+    """On Windows, opening a tzdata path with NTFS-illegal chars raises OSError(EINVAL).
+
+    Regression test for crash when the system TZ resolves to a POSIX string like
+    "<+08>-8" (Asia/Shanghai, IST, etc.) and is fed back into _load_tzdata by
+    validate_tz to check whether it is also a valid IANA key.
+    """
+    err = OSError(errno.EINVAL, "Invalid argument")
+    with patch(
+        "esphome.components.time.resources.files",
+        _mock_resources_with_error(err),
+    ):
+        assert _load_tzdata("<+08>-8") is None
+
+
+def test_load_tzdata_propagates_unexpected_oserror() -> None:
+    """Unrelated OSErrors (e.g. PermissionError) must not be swallowed."""
+    with (
+        patch(
+            "esphome.components.time.resources.files",
+            _mock_resources_with_error(
+                PermissionError(errno.EACCES, "Permission denied")
+            ),
+        ),
+        pytest.raises(PermissionError),
+    ):
+        _load_tzdata("Some/Zone")
+
+
+def test_load_tzdata_returns_none_on_file_not_found() -> None:
+    """Existing behavior: missing tz file returns None rather than raising."""
+    with patch(
+        "esphome.components.time.resources.files",
+        _mock_resources_with_error(FileNotFoundError()),
+    ):
+        assert _load_tzdata("Not/A/Zone") is None
+
+
+def test_validate_tz_accepts_posix_string_when_read_bytes_raises_einval() -> None:
+    """validate_tz must not crash when _load_tzdata hits the Windows EINVAL path.
+
+    Simulates the Windows case where the auto-detected POSIX TZ string is fed
+    back through _load_tzdata and the underlying read_bytes raises errno 22.
+    """
+    with patch(
+        "esphome.components.time.resources.files",
+        _mock_resources_with_error(OSError(errno.EINVAL, "Invalid argument")),
+    ):
+        assert validate_tz("<+08>-8") == "<+08>-8"

From f8167c9a70d129e2a1c1ca9cf9cea5878fe1ec30 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Apr 2026 02:40:19 +0000
Subject: [PATCH 15/16] Bump aioesphomeapi from 44.19.0 to 44.20.0 (#15936)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 821ca1927a..e7ab9bc2ad 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -12,7 +12,7 @@ platformio==6.1.19
 esptool==5.2.0
 click==8.3.3
 esphome-dashboard==20260408.1
-aioesphomeapi==44.19.0
+aioesphomeapi==44.20.0
 zeroconf==0.148.0
 puremagic==1.30
 ruamel.yaml==0.19.1 # dashboard_import

From a881121110111ba829ab830b338dfb7675b9a979 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Wed, 22 Apr 2026 23:06:31 -0400
Subject: [PATCH 16/16] [ota] Make set_auth_password() lambda-callable via
 empty-password opt-in (#15928)

---
 esphome/components/esphome/ota/__init__.py         | 10 +++++++---
 esphome/components/esphome/ota/ota_esphome.h       |  8 ++++++++
 .../ota/test-empty_password.esp8266-ard.yaml       | 14 ++++++++++++++
 3 files changed, 29 insertions(+), 3 deletions(-)
 create mode 100644 tests/components/ota/test-empty_password.esp8266-ard.yaml

diff --git a/esphome/components/esphome/ota/__init__.py b/esphome/components/esphome/ota/__init__.py
index 5d35910fbd..bfa5ffb55c 100644
--- a/esphome/components/esphome/ota/__init__.py
+++ b/esphome/components/esphome/ota/__init__.py
@@ -150,10 +150,14 @@ async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     cg.add(var.set_port(config[CONF_PORT]))
 
-    # Password could be set to an empty string and we can assume that means no password
-    if config.get(CONF_PASSWORD):
-        cg.add(var.set_auth_password(config[CONF_PASSWORD]))
+    # Compile the auth path whenever `password:` is present in YAML, even if empty.
+    # An empty password opts in to the auth code path so set_auth_password() can be
+    # called at runtime (e.g. to rotate the password from a lambda). When `password:`
+    # is omitted entirely, the auth path is excluded to save flash on small devices.
+    if CONF_PASSWORD in config:
         cg.add_define("USE_OTA_PASSWORD")
+        if config[CONF_PASSWORD]:
+            cg.add(var.set_auth_password(config[CONF_PASSWORD]))
     cg.add_define("USE_OTA_VERSION", config[CONF_VERSION])
     # Build flag so lwip_fast_select.c (a .c file that can't include defines.h) sees it.
     cg.add_build_flag("-DUSE_OTA_PLATFORM_ESPHOME")
diff --git a/esphome/components/esphome/ota/ota_esphome.h b/esphome/components/esphome/ota/ota_esphome.h
index f3a5952398..53288fc000 100644
--- a/esphome/components/esphome/ota/ota_esphome.h
+++ b/esphome/components/esphome/ota/ota_esphome.h
@@ -28,6 +28,14 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   };
 #ifdef USE_OTA_PASSWORD
   void set_auth_password(const std::string &password) { password_ = password; }
+#else
+  // Stub so lambdas referencing set_auth_password() produce a clear error instead of
+  // a cryptic "no member" diagnostic. Only fires if the stub is actually instantiated.
+  template<bool B = false> void set_auth_password(const std::string &) {
+    static_assert(B, "set_auth_password() requires the OTA auth path to be compiled. "
+                     "Add 'password: \"\"' (empty string) to your 'ota: - platform: esphome' "
+                     "config to enable runtime password rotation.");
+  }
 #endif  // USE_OTA_PASSWORD
 
   /// Manually set the port OTA should listen on
diff --git a/tests/components/ota/test-empty_password.esp8266-ard.yaml b/tests/components/ota/test-empty_password.esp8266-ard.yaml
new file mode 100644
index 0000000000..e48f67e47e
--- /dev/null
+++ b/tests/components/ota/test-empty_password.esp8266-ard.yaml
@@ -0,0 +1,14 @@
+wifi:
+  ssid: MySSID
+  password: password1
+
+ota:
+  - platform: esphome
+    id: my_ota
+    port: 3287
+    password: ""
+
+esphome:
+  on_boot:
+    then:
+      - lambda: id(my_ota).set_auth_password("runtime_password");