From e54d5ee8980dbf138813ae678289280c0f95fdad Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Fri, 16 Jan 2026 17:16:38 -1000
Subject: [PATCH] [hmac_sha256] Replace unsafe sprintf with format_hex_to
 (#13290)

---
 esphome/components/hmac_sha256/hmac_sha256.cpp | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/esphome/components/hmac_sha256/hmac_sha256.cpp b/esphome/components/hmac_sha256/hmac_sha256.cpp
index cf5daf63af..2146e961bc 100644
--- a/esphome/components/hmac_sha256/hmac_sha256.cpp
+++ b/esphome/components/hmac_sha256/hmac_sha256.cpp
@@ -1,4 +1,3 @@
-#include <cstdio>
 #include <cstring>
 #include "hmac_sha256.h"
 #if defined(USE_ESP32) || defined(USE_ESP8266) || defined(USE_RP2040) || defined(USE_LIBRETINY) || defined(USE_HOST)
@@ -26,9 +25,7 @@ void HmacSHA256::calculate() { mbedtls_md_hmac_finish(&this->ctx_, this->digest_
 void HmacSHA256::get_bytes(uint8_t *output) { memcpy(output, this->digest_, SHA256_DIGEST_SIZE); }
 
 void HmacSHA256::get_hex(char *output) {
-  for (size_t i = 0; i < SHA256_DIGEST_SIZE; i++) {
-    sprintf(output + (i * 2), "%02x", this->digest_[i]);
-  }
+  format_hex_to(output, SHA256_DIGEST_SIZE * 2 + 1, this->digest_, SHA256_DIGEST_SIZE);
 }
 
 bool HmacSHA256::equals_bytes(const uint8_t *expected) {