Merge remote-tracking branch 'origin/dev' into web-server-logs

# Conflicts:
#	esphome/__main__.py
#	tests/unit_tests/test_main.py

.clang-tidy.hash

@@ -1 +0,0 @@
-72f02816e288b68ff4ef4b3d6fb66432c893b187a80ad3ebaa29afa443ff9ea6

.github/actions/cache-esp-idf/action.yml

@@ -2,8 +2,8 @@ name: Cache ESP-IDF
 description: >
   Resolve the pinned ESP-IDF version and cache the native ESP-IDF install
   (toolchains + source) at ~/.esphome-idf. Every job that installs ESP-IDF
-  natively (clang-tidy for IDF/Arduino and the native-IDF component build)
-  shares one cache, since the install is identical (ESPHOME_IDF_DEFAULT_TARGETS
+  natively (clang-tidy for IDF/Arduino and the component test batches) shares
+  one cache, since the install is identical (ESPHOME_IDF_DEFAULT_TARGETS
   defaults to "all", so all toolchains are present regardless of the chip).
   Callers must set env ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf and have the
   Python venv already restored.
@@ -11,6 +11,12 @@ inputs:
   framework:
     description: 'Which pinned IDF version to key on: "espidf" (recommended) or "arduino".'
     default: espidf
+  restore-only:
+    description: >
+      When "true", only restore -- never save the cache, even on dev. Use from
+      jobs that may not produce an ESP-IDF install (e.g. a component batch with
+      no esp32 target), so a partial/empty install is never written to the key.
+    default: "false"
 runs:
   using: composite
   steps:
@@ -33,13 +39,13 @@ runs:
     # PRs), and PRs are restore-only -- they never push multi-GB artifacts into
     # their own scope / the repo quota (e.g. on a version-bump PR).
     - name: Cache ESP-IDF install (write on dev)
-      if: github.ref == 'refs/heads/dev'
+      if: github.ref == 'refs/heads/dev' && inputs.restore-only != 'true'
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.esphome-idf
         key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}
     - name: Cache ESP-IDF install (restore-only off dev)
-      if: github.ref != 'refs/heads/dev'
+      if: github.ref != 'refs/heads/dev' || inputs.restore-only == 'true'
       uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.esphome-idf

.github/workflows/auto-label-pr.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.event.pull_request.state == 'open' && (github.event.action != 'labeled' || github.event.sender.type != 'Bot')
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Generate a token
         id: generate-token

.github/workflows/ci-api-proto.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:

.github/workflows/ci-clang-tidy-hash.yml

@@ -1,76 +0,0 @@
-name: Clang-tidy Hash CI
-
-on:
-  pull_request:
-    paths:
-      - ".clang-tidy"
-      - "platformio.ini"
-      - "requirements_dev.txt"
-      - "sdkconfig.defaults"
-      - ".clang-tidy.hash"
-      - "script/clang_tidy_hash.py"
-      - ".github/workflows/ci-clang-tidy-hash.yml"
-
-permissions:
-  contents: read        # actions/checkout for the PR head
-  pull-requests: write  # pulls.createReview / listReviews / dismissReview when the clang-tidy hash is out of date
-
-jobs:
-  verify-hash:
-    name: Verify clang-tidy hash
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.11"
-
-      - name: Verify hash
-        run: |
-          python script/clang_tidy_hash.py --verify
-
-      - if: failure()
-        name: Show hash details
-        run: |
-          python script/clang_tidy_hash.py
-          echo "## Job Failed" | tee -a $GITHUB_STEP_SUMMARY
-          echo "You have modified clang-tidy configuration but have not updated the hash." | tee -a $GITHUB_STEP_SUMMARY
-          echo "Please run 'script/clang_tidy_hash.py --update' and commit the changes." | tee -a $GITHUB_STEP_SUMMARY
-
-      - if: failure() && github.event.pull_request.head.repo.full_name == github.repository
-        name: Request changes
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            await github.rest.pulls.createReview({
-              pull_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              event: 'REQUEST_CHANGES',
-              body: 'You have modified clang-tidy configuration but have not updated the hash.\nPlease run `script/clang_tidy_hash.py --update` and commit the changes.'
-            })
-
-      - if: success() && github.event.pull_request.head.repo.full_name == github.repository
-        name: Dismiss review
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            let reviews = await github.rest.pulls.listReviews({
-              pull_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo
-            });
-            for (let review of reviews.data) {
-              if (review.user.login === 'github-actions[bot]' && review.state === 'CHANGES_REQUESTED') {
-                await github.rest.pulls.dismissReview({
-                  pull_number: context.issue.number,
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  review_id: review.id,
-                  message: 'Clang-tidy hash now matches configuration.'
-                });
-              }
-            }

.github/workflows/ci-docker.yml

@@ -1,25 +1,38 @@
 ---
 name: CI for docker images
 
-# Only run when docker paths change
+# Only run on PRs that touch the docker image, its build inputs, or any code
+# whose toolchain the compile smoke test exercises (core + target platforms).
 
 on:
-  push:
-    branches: [dev, beta, release]
-    paths:
-      - "docker/**"
-      - ".github/workflows/ci-docker.yml"
-      - "requirements*.txt"
-      - "platformio.ini"
-      - "script/platformio_install_deps.py"
-
   pull_request:
     paths:
+      # Docker image and its build inputs.
       - "docker/**"
       - ".github/workflows/ci-docker.yml"
       - "requirements*.txt"
+      - "pyproject.toml"
       - "platformio.ini"
+      - "esphome/idf_component.yml"
       - "script/platformio_install_deps.py"
+      # Core, build pipeline, toolchain, and target-platform changes can change
+      # how a toolchain is set up or built, so re-run the per-toolchain compile
+      # smoke test when they change.
+      - "esphome/core/**"
+      - "esphome/writer.py"
+      - "esphome/build_gen/**"
+      - "esphome/espidf/**"
+      - "esphome/platformio/**"
+      - "esphome/components/bk72xx/**"
+      - "esphome/components/esp32/**"
+      - "esphome/components/esp8266/**"
+      - "esphome/components/host/**"
+      - "esphome/components/libretiny/**"
+      - "esphome/components/ln882x/**"
+      - "esphome/components/nrf52/**"
+      - "esphome/components/rp2040/**"
+      - "esphome/components/rtl87xx/**"
+      - "esphome/components/zephyr/**"
 
 permissions:
   contents: read  # actions/checkout only
@@ -48,7 +61,7 @@ jobs:
       tag: ${{ steps.tag.outputs.tag }}
       push: ${{ steps.tag.outputs.push }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -96,7 +109,26 @@ jobs:
             --arch "${{ matrix.os == 'ubuntu-24.04-arm' && 'aarch64' || 'amd64' }}" \
             --build-type "${{ matrix.build_type }}" \
             --registry ghcr \
-            build ${{ steps.tag.outputs.push == 'true' && '--push --no-cache-to' || '' }}
+            build ${{ steps.tag.outputs.push == 'true' && '--push --no-cache-to' || '' }} ${{ (matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker') && '--load' || '' }}
+
+      # The amd64 "docker" image is also loaded locally (above) and handed to
+      # compile-test as an artifact, so the smoke test reuses this build instead
+      # of building the image a second time. Using an artifact (rather than the
+      # pushed image) keeps it working for fork PRs, which never push to ghcr.io.
+      - name: Export image for compile-test
+        if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
+        run: docker save "ghcr.io/esphome/esphome-amd64:${{ steps.tag.outputs.tag }}" | gzip > compile-test-image.tar.gz
+
+      - name: Upload compile-test image artifact
+        if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          # The tar is already gzipped, so upload it as-is. archive: false skips
+          # the redundant zip and makes the file name the artifact name (the
+          # `name` input is ignored in that mode).
+          path: compile-test-image.tar.gz
+          retention-days: 1
+          archive: false
 
   manifest:
     name: Push ${{ matrix.build_type }} manifest to ghcr.io
@@ -113,7 +145,7 @@ jobs:
           - "ha-addon"
           - "docker"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -135,3 +167,51 @@ jobs:
             --build-type "${{ matrix.build_type }}" \
             --registry ghcr \
             manifest
+
+  # Smoke-test the built image by compiling one minimal config per target
+  # platform / toolchain. This catches missing system dependencies in the image
+  # that only surface when a given toolchain is downloaded and run. The image is
+  # the amd64 "docker" build produced by check-docker (shared as an artifact).
+  compile-test:
+    name: Compile ${{ matrix.id }}
+    needs: check-docker
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read  # actions/checkout to load the test configs
+    strategy:
+      fail-fast: false
+      # Cap concurrency so this smoke test doesn't hog all the shared runners.
+      max-parallel: 2
+      matrix:
+        # One entry per distinct toolchain. ESP32 variants (c3/c6/s2/s3/p4)
+        # share a toolchain bundle, so esp32 is exercised on the base variant
+        # across the full framework x toolchain cross-product (arduino/esp-idf
+        # framework, each built with the platformio and native esp-idf
+        # toolchains) so both toolchains stay covered regardless of which one is
+        # the default.
+        id:
+          - esp8266-arduino
+          - esp32-arduino-platformio
+          - esp32-arduino-esp-idf
+          - esp32-idf-platformio
+          - esp32-idf-esp-idf
+          - rp2040-arduino
+          - bk72xx-arduino
+          - rtl87xx-arduino
+          - ln882x-arduino
+          - nrf52
+          - host
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Download image artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: compile-test-image.tar.gz
+      - name: Load image
+        run: docker load --input compile-test-image.tar.gz
+      - name: Compile ${{ matrix.id }}
+        run: |
+          docker run --rm \
+            -v "${{ github.workspace }}/docker/test_configs:/config" \
+            "ghcr.io/esphome/esphome-amd64:${{ needs.check-docker.outputs.tag }}" \
+            compile "${{ matrix.id }}.yaml"

.github/workflows/ci-github-scripts.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Run tests
         working-directory: .github/scripts/auto-label-pr

.github/workflows/ci-memory-impact-comment.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Check out code from base repository
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Always check out from the base repository (esphome/esphome), never from forks
           # Use the PR's target branch to ensure we run trusted code from the main repo

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
       cache-key: ${{ steps.cache-key.outputs.key }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Generate cache-key
         id: cache-key
         run: echo key="${{ hashFiles('requirements.txt', 'requirements_dev.txt', 'requirements_test.txt', '.pre-commit-config.yaml') }}" >> $GITHUB_OUTPUT
@@ -74,7 +74,7 @@ jobs:
     if: needs.determine-jobs.outputs.python-linters == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -97,7 +97,7 @@ jobs:
     if: needs.determine-jobs.outputs.core-ci == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -124,7 +124,7 @@ jobs:
     if: needs.determine-jobs.outputs.import-time == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -152,11 +152,11 @@ jobs:
     if: needs.determine-jobs.outputs.device-builder == 'true'
     steps:
       - name: Check out esphome (this PR)
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: esphome
       - name: Check out esphome/device-builder
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: esphome/device-builder
           ref: main
@@ -225,7 +225,7 @@ jobs:
     if: needs.determine-jobs.outputs.core-ci == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Restore Python
         id: restore-python
         uses: ./.github/actions/restore-python
@@ -270,8 +270,8 @@ jobs:
       python-linters: ${{ steps.determine.outputs.python-linters }}
       import-time: ${{ steps.determine.outputs.import-time }}
       device-builder: ${{ steps.determine.outputs.device-builder }}
-      native-idf: ${{ steps.determine.outputs.native-idf }}
-      native-idf-components: ${{ steps.determine.outputs.native-idf-components }}
+      esp32-platformio: ${{ steps.determine.outputs.esp32-platformio }}
+      esp32-platformio-components: ${{ steps.determine.outputs.esp32-platformio-components }}
       changed-components: ${{ steps.determine.outputs.changed-components }}
       changed-components-with-tests: ${{ steps.determine.outputs.changed-components-with-tests }}
       directly-changed-components-with-tests: ${{ steps.determine.outputs.directly-changed-components-with-tests }}
@@ -285,7 +285,7 @@ jobs:
       benchmarks: ${{ steps.determine.outputs.benchmarks }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Fetch enough history to find the merge base
           fetch-depth: 2
@@ -324,8 +324,8 @@ jobs:
           echo "python-linters=$(echo "$output" | jq -r '.python_linters')" >> $GITHUB_OUTPUT
           echo "import-time=$(echo "$output" | jq -r '.import_time')" >> $GITHUB_OUTPUT
           echo "device-builder=$(echo "$output" | jq -r '.device_builder')" >> $GITHUB_OUTPUT
-          echo "native-idf=$(echo "$output" | jq -r '.native_idf')" >> $GITHUB_OUTPUT
-          echo "native-idf-components=$(echo "$output" | jq -r '.native_idf_components')" >> $GITHUB_OUTPUT
+          echo "esp32-platformio=$(echo "$output" | jq -r '.esp32_platformio')" >> $GITHUB_OUTPUT
+          echo "esp32-platformio-components=$(echo "$output" | jq -r '.esp32_platformio_components')" >> $GITHUB_OUTPUT
           echo "changed-components=$(echo "$output" | jq -c '.changed_components')" >> $GITHUB_OUTPUT
           echo "changed-components-with-tests=$(echo "$output" | jq -c '.changed_components_with_tests')" >> $GITHUB_OUTPUT
           echo "directly-changed-components-with-tests=$(echo "$output" | jq -c '.directly_changed_components_with_tests')" >> $GITHUB_OUTPUT
@@ -357,7 +357,7 @@ jobs:
         bucket: ${{ fromJson(needs.determine-jobs.outputs.integration-test-buckets) }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python 3.13
         id: python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -409,7 +409,7 @@ jobs:
     if: github.event_name == 'pull_request' && (needs.determine-jobs.outputs.cpp-unit-tests-run-all == 'true' || needs.determine-jobs.outputs.cpp-unit-tests-components != '[]')
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Restore Python
         uses: ./.github/actions/restore-python
@@ -438,7 +438,7 @@ jobs:
       (github.event_name == 'pull_request' && needs.determine-jobs.outputs.benchmarks == 'true')
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Restore Python
         uses: ./.github/actions/restore-python
@@ -456,7 +456,7 @@ jobs:
           echo "binary=$BINARY" >> $GITHUB_OUTPUT
 
       - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@9d332c4d90b43981c3e55ae8e38e68709996240f # v4.17.0
+        uses: CodSpeedHQ/action@63f3e98b61959fe67f146a3ff022e4136fe9bb9c # v4.17.6
         with:
           run: |
             . venv/bin/activate
@@ -496,7 +496,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -522,7 +522,6 @@ jobs:
           key: platformio-${{ matrix.pio_cache_key }}-${{ hashFiles('platformio.ini') }}
 
       - name: Cache ESP-IDF install
-        # Shared with the IDF tidy + native-IDF build jobs (same install).
         if: matrix.cache_idf
         uses: ./.github/actions/cache-esp-idf
         with:
@@ -537,15 +536,12 @@ jobs:
         id: check_full_scan
         run: |
           . venv/bin/activate
-          # determine-jobs.clang-tidy-full-scan is true when core C++ changed
-          # OR the ci-run-all label forced --force-all. Independent of the
-          # hash check, both must produce a full scan in the job itself.
+          # determine-jobs.clang-tidy-full-scan is true when core C++ or a
+          # clang-tidy-relevant config file changed, or the ci-run-all label
+          # forced --force-all.
           if [ "${{ needs.determine-jobs.outputs.clang-tidy-full-scan }}" = "true" ]; then
             echo "full_scan=true" >> $GITHUB_OUTPUT
             echo "reason=determine_jobs" >> $GITHUB_OUTPUT
-          elif python script/clang_tidy_hash.py --check; then
-            echo "full_scan=true" >> $GITHUB_OUTPUT
-            echo "reason=hash_changed" >> $GITHUB_OUTPUT
           else
             echo "full_scan=false" >> $GITHUB_OUTPUT
             echo "reason=normal" >> $GITHUB_OUTPUT
@@ -583,7 +579,7 @@ jobs:
       ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -595,7 +591,6 @@ jobs:
           cache-key: ${{ needs.common.outputs.cache-key }}
 
       - name: Cache ESP-IDF install
-        # Shared with the Arduino tidy + native-IDF build jobs (same install).
         uses: ./.github/actions/cache-esp-idf
 
       - name: Register problem matchers
@@ -607,15 +602,12 @@ jobs:
         id: check_full_scan
         run: |
           . venv/bin/activate
-          # determine-jobs.clang-tidy-full-scan is true when core C++ changed
-          # OR the ci-run-all label forced --force-all. Independent of the
-          # hash check, both must produce a full scan in the job itself.
+          # determine-jobs.clang-tidy-full-scan is true when core C++ or a
+          # clang-tidy-relevant config file changed, or the ci-run-all label
+          # forced --force-all.
           if [ "${{ needs.determine-jobs.outputs.clang-tidy-full-scan }}" = "true" ]; then
             echo "full_scan=true" >> $GITHUB_OUTPUT
             echo "reason=determine_jobs" >> $GITHUB_OUTPUT
-          elif python script/clang_tidy_hash.py --check; then
-            echo "full_scan=true" >> $GITHUB_OUTPUT
-            echo "reason=hash_changed" >> $GITHUB_OUTPUT
           else
             echo "full_scan=false" >> $GITHUB_OUTPUT
             echo "reason=normal" >> $GITHUB_OUTPUT
@@ -667,7 +659,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -679,7 +671,6 @@ jobs:
           cache-key: ${{ needs.common.outputs.cache-key }}
 
       - name: Cache ESP-IDF install
-        # Shared with the Arduino tidy + native-IDF build jobs (same install).
         uses: ./.github/actions/cache-esp-idf
 
       - name: Register problem matchers
@@ -691,15 +682,12 @@ jobs:
         id: check_full_scan
         run: |
           . venv/bin/activate
-          # determine-jobs.clang-tidy-full-scan is true when core C++ changed
-          # OR the ci-run-all label forced --force-all. Independent of the
-          # hash check, both must produce a full scan in the job itself.
+          # determine-jobs.clang-tidy-full-scan is true when core C++ or a
+          # clang-tidy-relevant config file changed, or the ci-run-all label
+          # forced --force-all.
           if [ "${{ needs.determine-jobs.outputs.clang-tidy-full-scan }}" = "true" ]; then
             echo "full_scan=true" >> $GITHUB_OUTPUT
             echo "reason=determine_jobs" >> $GITHUB_OUTPUT
-          elif python script/clang_tidy_hash.py --check; then
-            echo "full_scan=true" >> $GITHUB_OUTPUT
-            echo "reason=hash_changed" >> $GITHUB_OUTPUT
           else
             echo "full_scan=false" >> $GITHUB_OUTPUT
             echo "reason=normal" >> $GITHUB_OUTPUT
@@ -755,7 +743,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -767,7 +755,6 @@ jobs:
           cache-key: ${{ needs.common.outputs.cache-key }}
 
       - name: Cache ESP-IDF install
-        # Shared with the IDF/Arduino clang-tidy jobs + native-IDF build (same install).
         uses: ./.github/actions/cache-esp-idf
 
       - name: Register problem matchers
@@ -779,15 +766,12 @@ jobs:
         id: check_full_scan
         run: |
           . venv/bin/activate
-          # determine-jobs.clang-tidy-full-scan is true when core C++ changed
-          # OR the ci-run-all label forced --force-all. Independent of the
-          # hash check, both must produce a full scan in the job itself.
+          # determine-jobs.clang-tidy-full-scan is true when core C++ or a
+          # clang-tidy-relevant config file changed, or the ci-run-all label
+          # forced --force-all.
           if [ "${{ needs.determine-jobs.outputs.clang-tidy-full-scan }}" = "true" ]; then
             echo "full_scan=true" >> $GITHUB_OUTPUT
             echo "reason=determine_jobs" >> $GITHUB_OUTPUT
-          elif python script/clang_tidy_hash.py --check; then
-            echo "full_scan=true" >> $GITHUB_OUTPUT
-            echo "reason=hash_changed" >> $GITHUB_OUTPUT
           else
             echo "full_scan=false" >> $GITHUB_OUTPUT
             echo "reason=normal" >> $GITHUB_OUTPUT
@@ -817,6 +801,10 @@ jobs:
       - common
       - determine-jobs
     if: github.event_name == 'pull_request' && fromJSON(needs.determine-jobs.outputs.component-test-count) > 0
+    env:
+      # esp32 component builds use the native ESP-IDF toolchain (default), so
+      # share the tidy jobs' install location -- the restore below lands here.
+      ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
     strategy:
       fail-fast: false
       max-parallel: ${{ (startsWith(github.base_ref, 'beta') || startsWith(github.base_ref, 'release')) && 8 || 4 }}
@@ -838,12 +826,18 @@ jobs:
           version: 1.0
 
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
+      - name: Cache ESP-IDF install (restore-only)
+        # A batch may contain no esp32 build, so never save -- just reuse the
+        # shared install the dev tidy jobs already cached when present.
+        uses: ./.github/actions/cache-esp-idf
+        with:
+          restore-only: true
       - name: Validate and compile components with intelligent grouping
         run: |
           . venv/bin/activate
@@ -947,23 +941,22 @@ jobs:
             echo "All components in this batch are validate-only -- skipping compile stage."
           fi
 
-  test-native-idf:
-    name: Test components with native ESP-IDF
+  test-esp32-platformio:
+    name: Test esp32 components with PlatformIO
     runs-on: ubuntu-24.04
     needs:
       - common
       - determine-jobs
-    if: github.event_name == 'pull_request' && needs.determine-jobs.outputs.native-idf == 'true'
+    if: github.event_name == 'pull_request' && needs.determine-jobs.outputs.esp32-platformio == 'true'
     env:
-      ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
-      # Comma-joined subset of the native-IDF representative component list,
-      # computed by script/determine-jobs.py (native_idf_components_to_test).
+      # Comma-joined subset of the esp32 PlatformIO representative component list,
+      # computed by script/determine-jobs.py (esp32_platformio_components_to_test).
       # Single source of truth -- the full list lives in
-      # script/determine-jobs.py::NATIVE_IDF_TEST_COMPONENTS.
-      TEST_COMPONENTS: ${{ needs.determine-jobs.outputs.native-idf-components }}
+      # script/determine-jobs.py::ESP32_PLATFORMIO_TEST_COMPONENTS.
+      TEST_COMPONENTS: ${{ needs.determine-jobs.outputs.esp32-platformio-components }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Restore Python
         uses: ./.github/actions/restore-python
@@ -971,66 +964,23 @@ jobs:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
 
-      - name: Prepare build storage on /mnt
-        # Bind-mount the larger /mnt disk over the IDF install + build dirs BEFORE
-        # restoring the cache, so the ~4.5GB restore lands on the roomier volume
-        # instead of being shadowed by a mount set up later in the run step.
-        run: |
-          root_avail=$(df -k / | awk 'NR==2 {print $4}')
-          mnt_avail=$(df -k /mnt 2>/dev/null | awk 'NR==2 {print $4}')
-          echo "Available space: / has ${root_avail}KB, /mnt has ${mnt_avail}KB"
-          if [ -n "$mnt_avail" ] && [ "$mnt_avail" -gt "$root_avail" ]; then
-            echo "Using /mnt for build files (more space available)"
-            sudo mkdir -p /mnt/esphome-idf
-            sudo chown $USER:$USER /mnt/esphome-idf
-            mkdir -p ~/.esphome-idf
-            sudo mount --bind /mnt/esphome-idf ~/.esphome-idf
-            sudo mkdir -p /mnt/test_build_components_build
-            sudo chown $USER:$USER /mnt/test_build_components_build
-            mkdir -p tests/test_build_components/build
-            sudo mount --bind /mnt/test_build_components_build tests/test_build_components/build
-          else
-            echo "Using / for build files (more space available than /mnt or /mnt unavailable)"
-          fi
-
-      - name: Cache ESP-IDF install
-        # Shared with the IDF/Arduino clang-tidy jobs (same install); restores
-        # into the /mnt bind-mount prepared above when present.
-        uses: ./.github/actions/cache-esp-idf
-
-      - name: Run native ESP-IDF compile test
+      - name: Run PlatformIO compile test
         run: |
           . venv/bin/activate
 
           echo "Testing components: $TEST_COMPONENTS"
           echo ""
 
-          # Show disk space before validation
-          echo "Disk space before config validation:"
-          df -h
-          echo ""
-
-          # Run config validation (auto-grouped by test_build_components.py)
-          python3 script/test_build_components.py -e config -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain esp-idf
+          # compile validates config first, so a separate config pass is
+          # redundant for this smoke test. ESP-IDF framework via PlatformIO:
+          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain platformio
 
           echo ""
-          echo "Config validation passed! Starting compilation..."
+          echo "ESP-IDF-via-PlatformIO build passed! Starting Arduino smoke test..."
           echo ""
 
-          # Show disk space before compilation
-          echo "Disk space before compilation:"
-          df -h
-          echo ""
-
-          # Run compilation (auto-grouped by test_build_components.py)
-          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain esp-idf
-
-      - name: Save ESPHome cache
-        if: github.ref == 'refs/heads/dev'
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ~/.esphome-idf
-          key: ${{ runner.os }}-esphome-${{ needs.common.outputs.cache-key }}
+          # Arduino framework via PlatformIO (only components with an esp32-ard test are built):
+          python3 script/test_build_components.py -e compile -t esp32-ard -c "$TEST_COMPONENTS" -f --toolchain platformio
 
   pre-commit-ci-lite:
     name: pre-commit.ci lite
@@ -1041,7 +991,7 @@ jobs:
     if: github.event_name == 'pull_request' && !startsWith(github.base_ref, 'beta') && !startsWith(github.base_ref, 'release') && needs.determine-jobs.outputs.core-ci == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -1049,7 +999,7 @@ jobs:
           cache-key: ${{ needs.common.outputs.cache-key }}
       - uses: esphome/pre-commit-action@43cd1109c09c544d97196f7730ee5b2e0cc6d81e # v3.0.1 fork with pinned actions/cache
         env:
-          SKIP: pylint,clang-tidy-hash,ci-custom
+          SKIP: pylint,ci-custom
       - uses: pre-commit-ci/lite-action@5d6cc0eb514c891a40562a58a8e71576c5c7fb43 # v1.1.0
         if: always()
 
@@ -1067,7 +1017,7 @@ jobs:
       skip: ${{ steps.check-script.outputs.skip || steps.check-tests.outputs.skip }}
     steps:
       - name: Check out target branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.base_ref }}
 
@@ -1249,7 +1199,7 @@ jobs:
       flash_usage: ${{ steps.extract.outputs.flash_usage }}
     steps:
       - name: Check out PR branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -1318,7 +1268,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -1365,7 +1315,7 @@ jobs:
       - determine-jobs
       - device-builder
       - test-build-components-split
-      - test-native-idf
+      - test-esp32-platformio
       - pre-commit-ci-lite
       - memory-impact-target-branch
       - memory-impact-pr-branch
@@ -1381,4 +1331,7 @@ jobs:
           # 1. The target branch has a build issue independent of this PR
           # 2. This PR fixes a build issue on the target branch
           # In either case, we only care that the PR branch builds successfully.
-          echo "$NEEDS_JSON" | jq -e 'del(.["memory-impact-target-branch"]) | all(.result != "failure")'
+          # Every other job must have succeeded or been skipped; a "cancelled" or
+          # "failure" result fails this check so CI is not reported green when the
+          # workflow was cancelled.
+          echo "$NEEDS_JSON" | jq -e 'del(.["memory-impact-target-branch"]) | all(.result == "success" or .result == "skipped")'

.github/workflows/codeowner-approved-label-update.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout base branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           sparse-checkout: |

.github/workflows/codeowner-review-request.yml

@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout base branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.base.sha }}
 

.github/workflows/codeql.yml

@@ -52,7 +52,7 @@ jobs:
             # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/pr-title-check.yml

@@ -16,7 +16,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
       branch_build: ${{ steps.tag.outputs.branch_build }}
       deploy_env: ${{ steps.tag.outputs.deploy_env }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Get tag
         id: tag
         # yamllint disable rule:line-length
@@ -60,7 +60,7 @@ jobs:
       contents: read   # actions/checkout to build the sdist/wheel
       id-token: write  # OIDC token for PyPI Trusted Publishing (pypa/gh-action-pypi-publish)
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -92,7 +92,7 @@ jobs:
             os: "ubuntu-24.04-arm"
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -168,7 +168,7 @@ jobs:
           - ghcr
           - dockerhub
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Download digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/sync-device-classes.yml

@@ -28,10 +28,10 @@ jobs:
           permission-pull-requests: write  # pulls.create / pulls.update to open or refresh the sync PR
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Checkout Home Assistant
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: home-assistant/core
           path: lib/home-assistant

.pre-commit-config.yaml

@@ -6,7 +6,7 @@ ci:
   autoupdate_commit_msg: 'pre-commit: autoupdate'
   autoupdate_schedule: off  # Disabled until ruff versions are synced between deps and pre-commit
   # Skip hooks that have issues in pre-commit CI environment
-  skip: [pylint, clang-tidy-hash]
+  skip: [pylint]
 
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
@@ -59,13 +59,6 @@ repos:
         language: system
         types: [python]
         files: ^esphome/.+\.py$
-      - id: clang-tidy-hash
-        name: Update clang-tidy hash
-        entry: python script/clang_tidy_hash.py --update-if-changed
-        language: python
-        files: ^(\.clang-tidy|platformio\.ini|requirements_dev\.txt|sdkconfig\.defaults|esphome/idf_component\.yml)$
-        pass_filenames: false
-        additional_dependencies: []
       - id: ci-custom
         name: ci-custom
         entry: python script/run-in-env.py script/ci-custom.py

AGENTS.md

@@ -59,6 +59,19 @@ This document provides essential context for AI models interacting with this pro
         - Protected/private fields: `lower_snake_case_with_trailing_underscore_`
         - Favor descriptive names over abbreviations
 
+*   **Python Idioms:**
+    *   **Assignment expressions (PEP 572):** Prefer the walrus operator (`:=`) wherever it removes a redundant lookup or a throwaway temporary. The most common case in component code is presence-checking a config key and then indexing it separately — fetch once with `.get()` and bind in the condition instead:
+        ```python
+        # Bad - looks up CONF_BLAH twice
+        if CONF_BLAH in config:
+            cg.add(var.set_blah(config[CONF_BLAH]))
+
+        # Good - single lookup, value bound inline
+        if (blah := config.get(CONF_BLAH)) is not None:
+            cg.add(var.set_blah(blah))
+        ```
+        The same applies to `while` loops and comprehensions where it avoids recomputing a value. Don't contort code to use it — reach for `:=` only when it genuinely cuts repetition or an extra assignment line.
+
 *   **C++ Field Visibility:**
     *   **Prefer `protected`:** Use `protected` for most class fields to enable extensibility and testing. Fields should be `lower_snake_case_with_trailing_underscore_`.
     *   **Use `private` for safety-critical cases:** Use `private` visibility when direct field access could introduce bugs or violate invariants:

CODEOWNERS

@@ -445,7 +445,7 @@ esphome/components/select/* @esphome/core
 esphome/components/sen0321/* @notjj
 esphome/components/sen21231/* @shreyaskarnik
 esphome/components/sen5x/* @martgras
-esphome/components/sen6x/* @martgras @mebner86 @mikelawrence @tuct
+esphome/components/sen6x/* @martgras @mebner86 @tuct
 esphome/components/sendspin/* @kahrendt
 esphome/components/sendspin/media_player/* @kahrendt
 esphome/components/sendspin/media_source/* @kahrendt
@@ -561,6 +561,7 @@ esphome/components/uart/packet_transport/* @clydebarrow
 esphome/components/udp/* @clydebarrow
 esphome/components/ufire_ec/* @pvizeli
 esphome/components/ufire_ise/* @pvizeli
+esphome/components/ufm01/* @ljungqvist
 esphome/components/ultrasonic/* @ssieb @swoboda1337
 esphome/components/update/* @jesserockz
 esphome/components/uponor_smatrix/* @kroimon

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.6.2
+PROJECT_NUMBER         = 2026.7.0-dev
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

THREAT_MODEL.md

@@ -0,0 +1,104 @@
+# ESPHome Threat Model
+
+This document defines the trust boundary for the **ESPHome** repository — the
+Python compiler/CLI and the device firmware it generates — so that real security
+bugs can be told apart from defense-in-depth improvements. It gives contributors,
+reviewers, and security researchers a clear answer to one question:
+**does this issue let an _unauthenticated_ attacker do something they shouldn't?**
+
+Related documents:
+
+- Deployment guidance for operators:
+  https://esphome.io/guides/security_best_practices/
+- The **Device Builder dashboard** (the web UI, its authentication, ingress,
+  Origin/Host gates, and peer-link pairing) lives in a separate repository and
+  has its own threat model. If your report concerns any of that, please read and
+  report there instead:
+  https://github.com/esphome/device-builder/blob/main/docs/THREAT_MODEL.md
+
+## The trust boundary
+
+For this repository there are two trusted inputs by design:
+
+1. **The configuration.** Anyone who can supply or edit a YAML config is trusted
+   (see below).
+2. **Authenticated peers of a running device** — clients holding the device's
+   API encryption key / password, OTA password, or web server credentials.
+
+The security boundary is therefore **unauthenticated network traffic vs. those
+trusted inputs.** A bug that lets an unauthenticated attacker cross it is a
+security bug.
+
+## Config authors are host-equivalent by design
+
+Anyone who can supply or edit a configuration is **trusted with full code
+execution on the host that runs `esphome`**, on purpose. This is what the product
+does, not a flaw. A config author can already, through fully supported features:
+
+- Run arbitrary **Python** at validation/compile time via `external_components:`
+  (and other component-import mechanisms) — ESPHome imports those packages as
+  ordinary Python.
+- Run arbitrary **shell** commands through the compile/validate/flash toolchain
+  that ESPHome invokes as subprocesses.
+- Read and write arbitrary files reachable by the process (e.g. via `!include`,
+  `packages:`, `dashboard_import:`, and generated build output).
+
+Because of this, a malicious config author is equivalent to shell access on the
+host running the build.
+
+## What is *not* a security vulnerability
+
+If exploiting an issue requires the ability to supply or edit configuration, it
+is **not** a vulnerability in ESPHome, because that ability already grants host
+code execution. This explicitly includes, among others:
+
+- Template / expression injection in substitutions or any YAML string value
+  (e.g. Jinja `${...}` evaluation reaching Python internals). This grants no
+  capability a config author lacks.
+- `!include` / `packages:` / `dashboard_import:` reading or fetching content
+  from surprising or remote locations.
+- The validator or compiler crashing or behaving unexpectedly on adversarial
+  YAML.
+- ESPHome running as root in the official container — that is the documented
+  deployment posture, reachable by the same caller through the features above.
+
+These do not warrant a CVE or coordinated disclosure. Hardening in these areas
+(for example, sandboxing template evaluation as least-surprise defense-in-depth)
+is welcome as a normal enhancement PR, framed as cleanliness rather than a
+security fix — not as a vulnerability remediation.
+
+## What we do defend
+
+These *are* security bugs in this repo, and we want to hear about them privately:
+
+- Memory-safety or protocol bugs in the generated **device firmware** that are
+  remotely triggerable over the network (native API, web server, OTA, BLE,
+  captive portal, etc.) **without** valid credentials.
+- Authentication or encryption bypass on the device — reaching API calls, OTA
+  updates, or the web server without the configured key/password.
+- Flaws that weaken the device's API encryption (Noise), OTA, or web server auth
+  below their documented guarantees.
+
+## Explicitly out of scope
+
+- Local attackers who already have shell access on the host that runs `esphome`.
+- Supply-chain attacks against ESPHome or its dependencies.
+- Operator-supplied hostile YAML (covered above — config authoring is trusted).
+- Attacks that require an already-authenticated device peer (someone who already
+  holds the API key / OTA / web credentials).
+- Anything in the dashboard / device-builder — report that in its own repository
+  (linked at the top).
+- The legacy bundled dashboard in this repo (`esphome/dashboard/`) — it is
+  deprecated and being replaced by Device Builder; report dashboard issues there.
+- Deployments where the operator removed protections or exposed credentials. See
+  the security best practices guide:
+  https://esphome.io/guides/security_best_practices/
+
+## Reporting a vulnerability
+
+If you believe you've found an issue that crosses the unauthenticated boundary
+above, please report it privately via GitHub Security Advisories rather than a
+public issue. For issues that require config-write access, please review this
+document first — they are very likely out of scope by design. For dashboard /
+device-builder issues, report against that repository and consult its threat
+model (linked at the top).

docker/test_configs/bk72xx-arduino.yaml

@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-bk72xx-arduino
+
+bk72xx:
+  board: generic-bk7231n-qfn32-tuya
+
+logger:

docker/test_configs/esp32-arduino-esp-idf.yaml

@@ -0,0 +1,10 @@
+esphome:
+  name: docker-test-esp32-ard-idf
+
+esp32:
+  variant: esp32
+  framework:
+    type: arduino
+  toolchain: esp-idf
+
+logger:

docker/test_configs/esp32-arduino-platformio.yaml

@@ -0,0 +1,10 @@
+esphome:
+  name: docker-test-esp32-ard-pio
+
+esp32:
+  variant: esp32
+  framework:
+    type: arduino
+  toolchain: platformio
+
+logger:

docker/test_configs/esp32-idf-esp-idf.yaml

@@ -0,0 +1,10 @@
+esphome:
+  name: docker-test-esp32-idf-idf
+
+esp32:
+  variant: esp32
+  framework:
+    type: esp-idf
+  toolchain: esp-idf
+
+logger:

docker/test_configs/esp32-idf-platformio.yaml

@@ -0,0 +1,10 @@
+esphome:
+  name: docker-test-esp32-idf-pio
+
+esp32:
+  variant: esp32
+  framework:
+    type: esp-idf
+  toolchain: platformio
+
+logger:

docker/test_configs/esp8266-arduino.yaml

@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-esp8266-arduino
+
+esp8266:
+  board: d1_mini
+
+logger:

docker/test_configs/host.yaml

@@ -0,0 +1,6 @@
+esphome:
+  name: docker-test-host
+
+host:
+
+logger:

docker/test_configs/ln882x-arduino.yaml

@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-ln882x-arduino
+
+ln882x:
+  board: generic-ln882hki
+
+logger:

docker/test_configs/nrf52.yaml

@@ -0,0 +1,8 @@
+esphome:
+  name: docker-test-nrf52
+
+nrf52:
+  board: adafruit_itsybitsy_nrf52840
+  bootloader: adafruit_nrf52_sd140_v6
+
+logger:

docker/test_configs/rp2040-arduino.yaml

@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-rp2040-arduino
+
+rp2040:
+  variant: rp2040
+
+logger:

docker/test_configs/rtl87xx-arduino.yaml

@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-rtl87xx-arduino
+
+rtl87xx:
+  board: generic-rtl8710bn-2mb-788k
+
+logger:

esphome/__main__.py

@@ -28,13 +28,13 @@ from esphome.const import (
     ALLOWED_NAME_CHARS,
     ARGUMENT_HELP_DEVICE,
     CONF_API,
-    CONF_AUTH,
     CONF_BAUD_RATE,
     CONF_BROKER,
     CONF_DEASSERT_RTS_DTR,
     CONF_DISABLED,
     CONF_ESPHOME,
     CONF_LEVEL,
+    CONF_LOG,
     CONF_LOG_TOPIC,
     CONF_LOGGER,
     CONF_MDNS,
@@ -48,7 +48,7 @@ from esphome.const import (
     CONF_PORT,
     CONF_SUBSTITUTIONS,
     CONF_TOPIC,
-    CONF_USERNAME,
+    CONF_VERSION,
     CONF_WEB_SERVER,
     CONF_WIFI,
     ENV_NOGITIGNORE,
@@ -268,6 +268,36 @@ def _ota_hostnames_for_default(purpose: Purpose) -> list[str]:
     return _resolve_with_cache(CORE.address, purpose)
 
 
+def _unresolved_default_error(purpose: Purpose, defaults: list[str]) -> str:
+    """Build the error when a default device target produced no usable host.
+
+    When the OTA default was requested and the address resolves but the config
+    lacks the transport the purpose needs (``api:`` for logs, an ``ota:``
+    platform for uploads), name that gap instead of the misleading
+    "could not be resolved" / set-use_address hint.
+    """
+    if "OTA" in defaults and has_resolvable_address():
+        if purpose == Purpose.LOGGING and not has_api():
+            return (
+                "Cannot view logs over the network: no 'api:' component is "
+                "configured. Add an 'api:' component, enable MQTT logging, add a "
+                "'web_server:' component, or view logs over USB."
+            )
+        if purpose == Purpose.UPLOADING and not has_ota():
+            return (
+                "Cannot upload over the network: no 'ota:' platform is "
+                "configured. Add an 'ota:' platform, or upload over USB."
+            )
+    if CORE.dashboard:
+        hint = "If you know the IP, set 'use_address' in your network config."
+    else:
+        hint = "If you know the IP, try --device <IP>"
+    return (
+        f"All specified devices {defaults} could not be resolved. "
+        f"Is the device connected to the network? {hint}"
+    )
+
+
 def choose_upload_log_host(
     default: list[str] | str | None,
     check_default: str | None,
@@ -291,9 +321,12 @@ def choose_upload_log_host(
                 ]
                 resolved.append(choose_prompt(options, purpose=purpose))
             elif device == "OTA":
+                # Logs can stream over a network transport via the native API
+                # or the web_server HTTP SSE feed.
+                network_logging = has_api() or has_web_server_logging()
                 # ensure IP adresses are used first
                 if is_ip_address(CORE.address) and (
-                    (purpose == Purpose.LOGGING and has_api())
+                    (purpose == Purpose.LOGGING and network_logging)
                     or (purpose == Purpose.UPLOADING and has_ota())
                 ):
                     resolved.extend(_resolve_with_cache(CORE.address, purpose))
@@ -305,7 +338,11 @@ def choose_upload_log_host(
                     if has_mqtt_logging():
                         resolved.append("MQTT")
 
-                    if has_api() and has_non_ip_address() and has_resolvable_address():
+                    if (
+                        network_logging
+                        and has_non_ip_address()
+                        and has_resolvable_address()
+                    ):
                         resolved.extend(_ota_hostnames_for_default(purpose))
 
                 elif purpose == Purpose.UPLOADING:
@@ -317,14 +354,7 @@ def choose_upload_log_host(
             else:
                 resolved.append(device)
         if not resolved:
-            if CORE.dashboard:
-                hint = "If you know the IP, set 'use_address' in your network config."
-            else:
-                hint = "If you know the IP, try --device <IP>"
-            raise EsphomeError(
-                f"All specified devices {defaults} could not be resolved. "
-                f"Is the device connected to the network? {hint}"
-            )
+            raise EsphomeError(_unresolved_default_error(purpose, defaults))
         return resolved
 
     # No devices specified, show interactive chooser
@@ -374,7 +404,7 @@ def choose_upload_log_host(
             mqtt_config = CORE.config[CONF_MQTT]
             options.append((f"MQTT ({mqtt_config[CONF_BROKER]})", "MQTT"))
 
-        if has_api():
+        if has_api() or has_web_server_logging():
             add_ota_options()
 
     elif purpose == Purpose.UPLOADING and has_ota():
@@ -467,6 +497,21 @@ def has_web_server_ota() -> bool:
     )
 
 
+def has_web_server_logging() -> bool:
+    """Check if logs can be streamed over the web_server HTTP SSE endpoint.
+
+    The ``web_server`` component exposes a ``/events`` Server-Sent Events
+    stream that carries ``event: log`` frames. This requires version 2+ (the
+    v1 UI has no ``/events`` endpoint) and the ``log`` option enabled (default).
+    """
+    web_conf = CORE.config.get(CONF_WEB_SERVER)
+    if web_conf is None:
+        return False
+    if web_conf.get(CONF_VERSION, 2) == 1:
+        return False
+    return web_conf.get(CONF_LOG, True)
+
+
 def has_mqtt_ip_lookup() -> bool:
     """Check if MQTT is available and IP lookup is supported."""
     from esphome.components.mqtt import CONF_DISCOVER_IP
@@ -1267,25 +1312,23 @@ def _upload_via_native_api(
 def _upload_via_web_server(
     config: ConfigType, network_devices: list[str], binary: Path
 ) -> tuple[int, str | None]:
-    web_conf = config.get(CONF_WEB_SERVER)
-    if not web_conf:
-        raise EsphomeError(
-            f"Cannot upload via web_server OTA: the {CONF_WEB_SERVER} component "
-            f"is not configured."
-        )
-
-    remote_port = int(web_conf[CONF_PORT])
-    auth = web_conf.get(CONF_AUTH) or {}
-    username = auth.get(CONF_USERNAME)
-    password = auth.get(CONF_PASSWORD)
-
     from esphome import web_server_ota
+    from esphome.web_server_helpers import get_web_server_connection
 
+    remote_port, username, password = get_web_server_connection(config)
     return web_server_ota.run_ota(
         network_devices, remote_port, username, password, binary
     )
 
 
+def _show_logs_via_web_server(config: ConfigType, network_devices: list[str]) -> int:
+    from esphome import web_server_logs
+    from esphome.web_server_helpers import get_web_server_connection
+
+    port, username, password = get_web_server_connection(config)
+    return web_server_logs.run_logs(network_devices, port, username, password)
+
+
 # Layout of esp_partition_info_t on flash. Each entry is 32 bytes, leading with a
 # 16-bit little-endian magic. ESP-IDF defines ESP_PARTITION_MAGIC = 0x50AA (stored as
 # bytes 0xAA, 0x50) for partition entries and ESP_PARTITION_MAGIC_MD5 = 0xEBEB for the
@@ -1414,6 +1457,13 @@ def show_logs(config: ConfigType, args: ArgsProtocol, devices: list[str]) -> int
             config, args.topic, args.username, args.password, args.client_id
         )
 
+    # Fall back to the web_server HTTP SSE log stream for devices that have
+    # web_server: but no api: (the logging counterpart to web_server OTA).
+    if has_web_server_logging() and (
+        network_devices := _resolve_network_devices(devices, config, args)
+    ):
+        return _show_logs_via_web_server(config, network_devices)
+
     raise EsphomeError("No remote or local logging method configured (api/mqtt/logger)")
 
 

esphome/build_gen/espidf.py

@@ -6,6 +6,7 @@ from pathlib import Path
 from esphome.components.esp32 import get_esp32_variant, idf_version
 import esphome.config_validation as cv
 from esphome.core import CORE
+from esphome.framework_helpers import get_project_compile_flags, get_project_link_flags
 from esphome.helpers import mkdir_p, write_file_if_changed
 
 # Replaces the IDF default C++ standard (-std=gnu++2b appended to
@@ -84,12 +85,7 @@ def get_project_cmakelists(minimal: bool = False) -> str:
     # esphome__micro-mp3) rather than just src/. Required so suppressions
     # like ``-Wno-error=maybe-uninitialized`` actually silence warnings in
     # third-party components we don't author.
-    project_compile_opts = [
-        flag
-        for flag in sorted(CORE.build_flags)
-        if flag.startswith("-D")
-        or (flag.startswith("-W") and not flag.startswith("-Wl,"))
-    ]
+    project_compile_opts = get_project_compile_flags()
     extra_compile_options = "\n".join(
         f'idf_build_set_property(COMPILE_OPTIONS "{flag}" APPEND)'
         for flag in project_compile_opts
@@ -188,8 +184,8 @@ def get_component_cmakelists() -> str:
     # Extract linker options (-Wl, flags). Compile flags (-D, -W) are
     # emitted project-wide via idf_build_set_property in
     # get_project_cmakelists so they reach every component, not just src/.
-    link_opts = [flag for flag in CORE.build_flags if flag.startswith("-Wl,")]
-    link_opts_str = "\n    ".join(sorted(link_opts)) if link_opts else ""
+    link_opts = get_project_link_flags()
+    link_opts_str = "\n    ".join(link_opts) if link_opts else ""
 
     return f"""\
 # Auto-generated by ESPHome

esphome/components/a01nyub/a01nyub.h

@@ -8,7 +8,7 @@
 
 namespace esphome::a01nyub {
 
-class A01nyubComponent : public sensor::Sensor, public Component, public uart::UARTDevice {
+class A01nyubComponent final : public sensor::Sensor, public Component, public uart::UARTDevice {
  public:
   // Nothing really public.
 

esphome/components/a02yyuw/a02yyuw.h

@@ -8,7 +8,7 @@
 
 namespace esphome::a02yyuw {
 
-class A02yyuwComponent : public sensor::Sensor, public Component, public uart::UARTDevice {
+class A02yyuwComponent final : public sensor::Sensor, public Component, public uart::UARTDevice {
  public:
   // Nothing really public.
 

esphome/components/a4988/a4988.h

@@ -6,7 +6,7 @@
 
 namespace esphome::a4988 {
 
-class A4988 : public stepper::Stepper, public Component {
+class A4988 final : public stepper::Stepper, public Component {
  public:
   void set_step_pin(GPIOPin *step_pin) { step_pin_ = step_pin; }
   void set_dir_pin(GPIOPin *dir_pin) { dir_pin_ = dir_pin; }

esphome/components/absolute_humidity/absolute_humidity.h

@@ -13,7 +13,7 @@ enum SaturationVaporPressureEquation {
 };
 
 /// This class implements calculation of absolute humidity from temperature and relative humidity.
-class AbsoluteHumidityComponent : public sensor::Sensor, public Component {
+class AbsoluteHumidityComponent final : public sensor::Sensor, public Component {
  public:
   void set_temperature_sensor(sensor::Sensor *temperature_sensor) { this->temperature_sensor_ = temperature_sensor; }
   void set_humidity_sensor(sensor::Sensor *humidity_sensor) { this->humidity_sensor_ = humidity_sensor; }

esphome/components/ac_dimmer/ac_dimmer.h

@@ -41,7 +41,7 @@ struct AcDimmerDataStore {
 #endif
 };
 
-class AcDimmer : public output::FloatOutput, public Component {
+class AcDimmer final : public output::FloatOutput, public Component {
  public:
   void setup() override;
 

esphome/components/adc/adc_sensor.h

@@ -54,7 +54,7 @@ template<typename T> class Aggregator {
   SamplingMode mode_{SamplingMode::AVG};
 };
 
-class ADCSensor : public sensor::Sensor, public PollingComponent, public voltage_sampler::VoltageSampler {
+class ADCSensor final : public sensor::Sensor, public PollingComponent, public voltage_sampler::VoltageSampler {
  public:
   /// Update the sensor's state by reading the current ADC value.
   /// This method is called periodically based on the update interval.

esphome/components/adc128s102/adc128s102.h

@@ -6,9 +6,9 @@
 
 namespace esphome::adc128s102 {
 
-class ADC128S102 : public Component,
-                   public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_LOW, spi::CLOCK_PHASE_LEADING,
-                                         spi::DATA_RATE_10MHZ> {
+class ADC128S102 final : public Component,
+                         public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_LOW,
+                                               spi::CLOCK_PHASE_LEADING, spi::DATA_RATE_10MHZ> {
  public:
   ADC128S102() = default;
 

esphome/components/adc128s102/sensor/adc128s102_sensor.h

@@ -9,10 +9,10 @@
 
 namespace esphome::adc128s102 {
 
-class ADC128S102Sensor : public PollingComponent,
-                         public Parented<ADC128S102>,
-                         public sensor::Sensor,
-                         public voltage_sampler::VoltageSampler {
+class ADC128S102Sensor final : public PollingComponent,
+                               public Parented<ADC128S102>,
+                               public sensor::Sensor,
+                               public voltage_sampler::VoltageSampler {
  public:
   ADC128S102Sensor(uint8_t channel);
 

esphome/components/addressable_light/addressable_light_display.h

@@ -9,7 +9,7 @@
 
 namespace esphome::addressable_light {
 
-class AddressableLightDisplay : public display::DisplayBuffer {
+class AddressableLightDisplay final : public display::DisplayBuffer {
  public:
   light::AddressableLight *get_light() const { return this->light_; }
 

esphome/components/ade7880/ade7880.h

@@ -65,7 +65,7 @@ struct ADE7880Store {
   static void gpio_intr(ADE7880Store *arg);
 };
 
-class ADE7880 : public i2c::I2CDevice, public PollingComponent {
+class ADE7880 final : public i2c::I2CDevice, public PollingComponent {
  public:
   void set_irq0_pin(InternalGPIOPin *pin) { this->irq0_pin_ = pin; }
   void set_irq1_pin(InternalGPIOPin *pin) { this->irq1_pin_ = pin; }

esphome/components/ade7953_i2c/ade7953_i2c.h

@@ -10,7 +10,7 @@
 
 namespace esphome::ade7953_i2c {
 
-class AdE7953I2c : public ade7953_base::ADE7953, public i2c::I2CDevice {
+class AdE7953I2c final : public ade7953_base::ADE7953, public i2c::I2CDevice {
  public:
   void dump_config() override;
 

esphome/components/ads1115/ads1115.h

@@ -43,7 +43,7 @@ enum ADS1115Samplerate {
   ADS1115_860SPS = 0b111
 };
 
-class ADS1115Component : public Component, public i2c::I2CDevice {
+class ADS1115Component final : public Component, public i2c::I2CDevice {
  public:
   void setup() override;
   void dump_config() override;

esphome/components/ads1115/sensor/ads1115_sensor.h

@@ -11,10 +11,10 @@
 namespace esphome::ads1115 {
 
 /// Internal holder class that is in instance of Sensor so that the hub can create individual sensors.
-class ADS1115Sensor : public sensor::Sensor,
-                      public PollingComponent,
-                      public voltage_sampler::VoltageSampler,
-                      public Parented<ADS1115Component> {
+class ADS1115Sensor final : public sensor::Sensor,
+                            public PollingComponent,
+                            public voltage_sampler::VoltageSampler,
+                            public Parented<ADS1115Component> {
  public:
   void update() override;
   void set_multiplexer(ADS1115Multiplexer multiplexer) { this->multiplexer_ = multiplexer; }

esphome/components/ads1118/ads1118.h

@@ -26,9 +26,9 @@ enum ADS1118Gain {
   ADS1118_GAIN_0P256 = 0b101,
 };
 
-class ADS1118 : public Component,
-                public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_LOW, spi::CLOCK_PHASE_TRAILING,
-                                      spi::DATA_RATE_1MHZ> {
+class ADS1118 final : public Component,
+                      public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_LOW,
+                                            spi::CLOCK_PHASE_TRAILING, spi::DATA_RATE_1MHZ> {
  public:
   ADS1118() = default;
   void setup() override;

esphome/components/ads1118/sensor/ads1118_sensor.h

@@ -10,10 +10,10 @@
 
 namespace esphome::ads1118 {
 
-class ADS1118Sensor : public PollingComponent,
-                      public sensor::Sensor,
-                      public voltage_sampler::VoltageSampler,
-                      public Parented<ADS1118> {
+class ADS1118Sensor final : public PollingComponent,
+                            public sensor::Sensor,
+                            public voltage_sampler::VoltageSampler,
+                            public Parented<ADS1118> {
  public:
   void update() override;
 

esphome/components/ags10/ags10.h

@@ -7,7 +7,7 @@
 
 namespace esphome::ags10 {
 
-class AGS10Component : public PollingComponent, public i2c::I2CDevice {
+class AGS10Component final : public PollingComponent, public i2c::I2CDevice {
  public:
   /**
    * Sets TVOC sensor.
@@ -100,7 +100,7 @@ class AGS10Component : public PollingComponent, public i2c::I2CDevice {
   template<size_t N> optional<std::array<uint8_t, N>> read_and_check_(uint8_t a_register);
 };
 
-template<typename... Ts> class AGS10NewI2cAddressAction : public Action<Ts...>, public Parented<AGS10Component> {
+template<typename... Ts> class AGS10NewI2cAddressAction final : public Action<Ts...>, public Parented<AGS10Component> {
  public:
   TEMPLATABLE_VALUE(uint8_t, new_address)
 
@@ -116,7 +116,7 @@ enum AGS10SetZeroPointActionMode {
   CUSTOM_VALUE,
 };
 
-template<typename... Ts> class AGS10SetZeroPointAction : public Action<Ts...>, public Parented<AGS10Component> {
+template<typename... Ts> class AGS10SetZeroPointAction final : public Action<Ts...>, public Parented<AGS10Component> {
  public:
   TEMPLATABLE_VALUE(uint16_t, value)
   TEMPLATABLE_VALUE(AGS10SetZeroPointActionMode, mode)

esphome/components/aht10/aht10.h

@@ -10,7 +10,7 @@ namespace esphome::aht10 {
 
 enum AHT10Variant { AHT10, AHT20 };
 
-class AHT10Component : public PollingComponent, public i2c::I2CDevice {
+class AHT10Component final : public PollingComponent, public i2c::I2CDevice {
  public:
   void setup() override;
   void update() override;

esphome/components/aic3204/aic3204.h

@@ -61,7 +61,7 @@ static const uint8_t AIC3204_ADC_PTM = 0x3D;       // Register 61 - ADC Power Tu
 static const uint8_t AIC3204_AN_IN_CHRG = 0x47;    // Register 71 - Analog Input Quick Charging Config
 static const uint8_t AIC3204_REF_STARTUP = 0x7B;   // Register 123 - Reference Power Up Config
 
-class AIC3204 : public audio_dac::AudioDac, public Component, public i2c::I2CDevice {
+class AIC3204 final : public audio_dac::AudioDac, public Component, public i2c::I2CDevice {
  public:
   void setup() override;
   void dump_config() override;

esphome/components/aic3204/automation.h

@@ -6,7 +6,7 @@
 
 namespace esphome::aic3204 {
 
-template<typename... Ts> class SetAutoMuteAction : public Action<Ts...> {
+template<typename... Ts> class SetAutoMuteAction final : public Action<Ts...> {
  public:
   explicit SetAutoMuteAction(AIC3204 *aic3204) : aic3204_(aic3204) {}
 

esphome/components/airthings_ble/airthings_listener.h

@@ -7,7 +7,7 @@
 
 namespace esphome::airthings_ble {
 
-class AirthingsListener : public esp32_ble_tracker::ESPBTDeviceListener {
+class AirthingsListener final : public esp32_ble_tracker::ESPBTDeviceListener {
  public:
   bool parse_device(const esp32_ble_tracker::ESPBTDevice &device) override;
 };

esphome/components/airthings_wave_mini/airthings_wave_mini.h

@@ -12,7 +12,7 @@ static const char *const SERVICE_UUID = "b42e3882-ade7-11e4-89d3-123b93f75cba";
 static const char *const CHARACTERISTIC_UUID = "b42e3b98-ade7-11e4-89d3-123b93f75cba";
 static const char *const ACCESS_CONTROL_POINT_CHARACTERISTIC_UUID = "b42e3ef4-ade7-11e4-89d3-123b93f75cba";
 
-class AirthingsWaveMini : public airthings_wave_base::AirthingsWaveBase {
+class AirthingsWaveMini final : public airthings_wave_base::AirthingsWaveBase {
  public:
   AirthingsWaveMini();
 

esphome/components/airthings_wave_plus/airthings_wave_plus.h

@@ -19,7 +19,7 @@ static const char *const CHARACTERISTIC_UUID_WAVE_RADON_GEN2 = "b42e4dcc-ade7-11
 static const char *const ACCESS_CONTROL_POINT_CHARACTERISTIC_UUID_WAVE_RADON_GEN2 =
     "b42e50d8-ade7-11e4-89d3-123b93f75cba";
 
-class AirthingsWavePlus : public airthings_wave_base::AirthingsWaveBase {
+class AirthingsWavePlus final : public airthings_wave_base::AirthingsWaveBase {
  public:
   void setup() override;
 

esphome/components/alarm_control_panel/automation.h

@@ -27,7 +27,7 @@ static_assert(std::is_trivially_copyable_v<StateAnyForwarder>);
 static_assert(sizeof(StateEnterForwarder<ACP_STATE_TRIGGERED>) <= sizeof(void *));
 static_assert(std::is_trivially_copyable_v<StateEnterForwarder<ACP_STATE_TRIGGERED>>);
 
-template<typename... Ts> class ArmAwayAction : public Action<Ts...> {
+template<typename... Ts> class ArmAwayAction final : public Action<Ts...> {
  public:
   explicit ArmAwayAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
 
@@ -39,7 +39,7 @@ template<typename... Ts> class ArmAwayAction : public Action<Ts...> {
   AlarmControlPanel *alarm_control_panel_;
 };
 
-template<typename... Ts> class ArmHomeAction : public Action<Ts...> {
+template<typename... Ts> class ArmHomeAction final : public Action<Ts...> {
  public:
   explicit ArmHomeAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
 
@@ -51,7 +51,7 @@ template<typename... Ts> class ArmHomeAction : public Action<Ts...> {
   AlarmControlPanel *alarm_control_panel_;
 };
 
-template<typename... Ts> class ArmNightAction : public Action<Ts...> {
+template<typename... Ts> class ArmNightAction final : public Action<Ts...> {
  public:
   explicit ArmNightAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
 
@@ -63,7 +63,7 @@ template<typename... Ts> class ArmNightAction : public Action<Ts...> {
   AlarmControlPanel *alarm_control_panel_;
 };
 
-template<typename... Ts> class DisarmAction : public Action<Ts...> {
+template<typename... Ts> class DisarmAction final : public Action<Ts...> {
  public:
   explicit DisarmAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
 
@@ -75,7 +75,7 @@ template<typename... Ts> class DisarmAction : public Action<Ts...> {
   AlarmControlPanel *alarm_control_panel_;
 };
 
-template<typename... Ts> class PendingAction : public Action<Ts...> {
+template<typename... Ts> class PendingAction final : public Action<Ts...> {
  public:
   explicit PendingAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
 
@@ -85,7 +85,7 @@ template<typename... Ts> class PendingAction : public Action<Ts...> {
   AlarmControlPanel *alarm_control_panel_;
 };
 
-template<typename... Ts> class TriggeredAction : public Action<Ts...> {
+template<typename... Ts> class TriggeredAction final : public Action<Ts...> {
  public:
   explicit TriggeredAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
 
@@ -95,7 +95,7 @@ template<typename... Ts> class TriggeredAction : public Action<Ts...> {
   AlarmControlPanel *alarm_control_panel_;
 };
 
-template<typename... Ts> class AlarmControlPanelCondition : public Condition<Ts...> {
+template<typename... Ts> class AlarmControlPanelCondition final : public Condition<Ts...> {
  public:
   AlarmControlPanelCondition(AlarmControlPanel *parent) : parent_(parent) {}
   bool check(const Ts &...x) override {

esphome/components/alpha3/alpha3.h

@@ -31,7 +31,7 @@ static const int16_t GENI_RESPONSE_POWER_OFFSET = 12;
 static const int16_t GENI_RESPONSE_MOTOR_POWER_OFFSET = 16;  // not sure
 static const int16_t GENI_RESPONSE_MOTOR_SPEED_OFFSET = 20;
 
-class Alpha3 : public esphome::ble_client::BLEClientNode, public PollingComponent {
+class Alpha3 final : public esphome::ble_client::BLEClientNode, public PollingComponent {
  public:
   void setup() override;
   void update() override;

esphome/components/am2315c/am2315c.h

@@ -27,7 +27,7 @@
 
 namespace esphome::am2315c {
 
-class AM2315C : public PollingComponent, public i2c::I2CDevice {
+class AM2315C final : public PollingComponent, public i2c::I2CDevice {
  public:
   void dump_config() override;
   void update() override;

esphome/components/am2320/am2320.h

@@ -6,7 +6,7 @@
 
 namespace esphome::am2320 {
 
-class AM2320Component : public PollingComponent, public i2c::I2CDevice {
+class AM2320Component final : public PollingComponent, public i2c::I2CDevice {
  public:
   void setup() override;
   void dump_config() override;

esphome/components/am43/cover/am43_cover.h

@@ -14,7 +14,7 @@ namespace esphome::am43 {
 
 namespace espbt = esphome::esp32_ble_tracker;
 
-class Am43Component : public cover::Cover, public esphome::ble_client::BLEClientNode, public Component {
+class Am43Component final : public cover::Cover, public esphome::ble_client::BLEClientNode, public Component {
  public:
   void setup() override;
   void loop() override;

esphome/components/am43/sensor/am43_sensor.h

@@ -14,7 +14,7 @@ namespace esphome::am43 {
 
 namespace espbt = esphome::esp32_ble_tracker;
 
-class Am43 : public esphome::ble_client::BLEClientNode, public PollingComponent {
+class Am43 final : public esphome::ble_client::BLEClientNode, public PollingComponent {
  public:
   void setup() override;
   void update() override;

esphome/components/analog_threshold/analog_threshold_binary_sensor.h

@@ -7,7 +7,7 @@
 
 namespace esphome::analog_threshold {
 
-class AnalogThresholdBinarySensor : public Component, public binary_sensor::BinarySensor {
+class AnalogThresholdBinarySensor final : public Component, public binary_sensor::BinarySensor {
  public:
   void dump_config() override;
   void setup() override;

esphome/components/animation/animation.h

@@ -5,7 +5,7 @@
 
 namespace esphome::animation {
 
-class Animation : public image::Image {
+class Animation final : public image::Image {
  public:
   Animation(const uint8_t *data_start, int width, int height, uint32_t animation_frame_count, image::ImageType type,
             image::Transparency transparent);
@@ -35,7 +35,7 @@ class Animation : public image::Image {
   int loop_current_iteration_;
 };
 
-template<typename... Ts> class AnimationNextFrameAction : public Action<Ts...> {
+template<typename... Ts> class AnimationNextFrameAction final : public Action<Ts...> {
  public:
   AnimationNextFrameAction(Animation *parent) : parent_(parent) {}
   void play(const Ts &...x) override { this->parent_->next_frame(); }
@@ -44,7 +44,7 @@ template<typename... Ts> class AnimationNextFrameAction : public Action<Ts...> {
   Animation *parent_;
 };
 
-template<typename... Ts> class AnimationPrevFrameAction : public Action<Ts...> {
+template<typename... Ts> class AnimationPrevFrameAction final : public Action<Ts...> {
  public:
   AnimationPrevFrameAction(Animation *parent) : parent_(parent) {}
   void play(const Ts &...x) override { this->parent_->prev_frame(); }
@@ -53,7 +53,7 @@ template<typename... Ts> class AnimationPrevFrameAction : public Action<Ts...> {
   Animation *parent_;
 };
 
-template<typename... Ts> class AnimationSetFrameAction : public Action<Ts...> {
+template<typename... Ts> class AnimationSetFrameAction final : public Action<Ts...> {
  public:
   AnimationSetFrameAction(Animation *parent) : parent_(parent) {}
   TEMPLATABLE_VALUE(uint16_t, frame)

esphome/components/anova/anova.h

@@ -17,7 +17,7 @@ namespace espbt = esphome::esp32_ble_tracker;
 static const uint16_t ANOVA_SERVICE_UUID = 0xFFE0;
 static const uint16_t ANOVA_CHARACTERISTIC_UUID = 0xFFE1;
 
-class Anova : public climate::Climate, public esphome::ble_client::BLEClientNode, public PollingComponent {
+class Anova final : public climate::Climate, public esphome::ble_client::BLEClientNode, public PollingComponent {
  public:
   void setup() override;
   void loop() override;

esphome/components/apds9306/apds9306.h

@@ -39,7 +39,7 @@ enum AmbientLightGain : uint8_t {
 };
 static const uint8_t AMBIENT_LIGHT_GAIN_VALUES[] = {1, 3, 6, 9, 18};
 
-class APDS9306 : public sensor::Sensor, public PollingComponent, public i2c::I2CDevice {
+class APDS9306 final : public sensor::Sensor, public PollingComponent, public i2c::I2CDevice {
  public:
   void setup() override;
   float get_setup_priority() const override { return setup_priority::BUS; }

esphome/components/apds9960/apds9960.h

@@ -12,7 +12,7 @@
 
 namespace esphome::apds9960 {
 
-class APDS9960 : public PollingComponent, public i2c::I2CDevice {
+class APDS9960 final : public PollingComponent, public i2c::I2CDevice {
 #ifdef USE_SENSOR
   SUB_SENSOR(red)
   SUB_SENSOR(green)

esphome/components/api/api_connection.cpp

@@ -375,7 +375,7 @@ void APIConnection::finalize_iterator_sync_() {
 
 void APIConnection::process_iterator_batch_(ComponentIterator &iterator) {
   size_t initial_size = this->deferred_batch_.size();
-  size_t max_batch = this->get_max_batch_size_();
+  size_t max_batch = MAX_INITIAL_PER_BATCH;
   while (!iterator.completed() && (this->deferred_batch_.size() - initial_size) < max_batch) {
     iterator.advance();
   }
@@ -418,16 +418,6 @@ uint16_t APIConnection::fill_and_encode_entity_info(EntityBase *entity, InfoResp
   // Set common fields that are shared by all entity types
   msg.key = entity->get_object_id_hash();
 
-  // API 1.14+ clients compute object_id client-side from the entity name
-  // For older clients, we must send object_id for backward compatibility
-  // See: https://github.com/esphome/backlog/issues/76
-  // TODO: Remove this backward compat code before 2026.7.0 - all clients should support API 1.14 by then
-  // Buffer must remain in scope until encode_to_buffer is called
-  char object_id_buf[OBJECT_ID_MAX_LEN];
-  if (!conn->client_supports_api_version(1, 14)) {
-    msg.object_id = entity->get_object_id_to(object_id_buf);
-  }
-
   if (entity->has_own_name()) {
     msg.name = entity->get_name();
   }

esphome/components/api/api_connection.h

@@ -43,10 +43,7 @@ class APIServer;
 // Keepalive timeout in milliseconds
 static constexpr uint32_t KEEPALIVE_TIMEOUT_MS = 60000;
 // Maximum number of entities to process in a single batch during initial state/info sending
-// API 1.14+ clients compute object_id client-side, so messages are smaller and we can fit more per batch
-// TODO: Remove MAX_INITIAL_PER_BATCH_LEGACY before 2026.7.0 - all clients should support API 1.14 by then
-static constexpr size_t MAX_INITIAL_PER_BATCH_LEGACY = 24;  // For clients < API 1.14 (includes object_id)
-static constexpr size_t MAX_INITIAL_PER_BATCH = 34;         // For clients >= API 1.14 (no object_id)
+static constexpr size_t MAX_INITIAL_PER_BATCH = 34;
 // Verify MAX_MESSAGES_PER_BATCH (defined in api_frame_helper.h) can hold the initial batch
 static_assert(MAX_MESSAGES_PER_BATCH >= MAX_INITIAL_PER_BATCH,
               "MAX_MESSAGES_PER_BATCH must be >= MAX_INITIAL_PER_BATCH");
@@ -481,13 +478,6 @@ class APIConnection final : public APIServerConnectionBase {
   inline bool check_voice_assistant_api_connection_() const;
 #endif
 
-  // Get the max batch size based on client API version
-  // API 1.14+ clients don't receive object_id, so messages are smaller and more fit per batch
-  // TODO: Remove this method before 2026.7.0 and use MAX_INITIAL_PER_BATCH directly
-  size_t get_max_batch_size_() const {
-    return this->client_supports_api_version(1, 14) ? MAX_INITIAL_PER_BATCH : MAX_INITIAL_PER_BATCH_LEGACY;
-  }
-
   // Send keepalive ping or disconnect unresponsive client.
   // Cold path — extracted from loop() to reduce instruction cache pressure.
   void __attribute__((noinline)) check_keepalive_(uint32_t now);

esphome/components/api/api_server.h

@@ -342,7 +342,7 @@ class APIServer final : public Component,
 
 extern APIServer *global_api_server;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
 
-template<typename... Ts> class APIConnectedCondition : public Condition<Ts...> {
+template<typename... Ts> class APIConnectedCondition final : public Condition<Ts...> {
   TEMPLATABLE_VALUE(bool, state_subscription_only)
  public:
   bool check(const Ts &...x) override {

esphome/components/api/homeassistant_service.h

@@ -104,7 +104,7 @@ class ActionResponse {
 template<typename... Ts> using ActionResponseCallback = std::function<void(const ActionResponse &, Ts...)>;
 #endif
 
-template<typename... Ts> class HomeAssistantServiceCallAction : public Action<Ts...> {
+template<typename... Ts> class HomeAssistantServiceCallAction final : public Action<Ts...> {
  public:
   explicit HomeAssistantServiceCallAction(APIServer *parent, bool is_event) : parent_(parent) {
     this->flags_.is_event = is_event;

esphome/components/api/user_services.h

@@ -164,7 +164,8 @@ template<enums::SupportsResponseType Mode, typename... Ts> class UserServiceTrig
 
 // Specialization for NONE - no extra trigger arguments
 template<typename... Ts>
-class UserServiceTrigger<enums::SUPPORTS_RESPONSE_NONE, Ts...> : public UserServiceBase<Ts...>, public Trigger<Ts...> {
+class UserServiceTrigger<enums::SUPPORTS_RESPONSE_NONE, Ts...> final : public UserServiceBase<Ts...>,
+                                                                       public Trigger<Ts...> {
  public:
   UserServiceTrigger(const char *name, const std::array<const char *, sizeof...(Ts)> &arg_names)
       : UserServiceBase<Ts...>(name, arg_names, enums::SUPPORTS_RESPONSE_NONE) {}
@@ -175,8 +176,8 @@ class UserServiceTrigger<enums::SUPPORTS_RESPONSE_NONE, Ts...> : public UserServ
 
 // Specialization for OPTIONAL - call_id and return_response trigger arguments
 template<typename... Ts>
-class UserServiceTrigger<enums::SUPPORTS_RESPONSE_OPTIONAL, Ts...> : public UserServiceBase<Ts...>,
-                                                                     public Trigger<uint32_t, bool, Ts...> {
+class UserServiceTrigger<enums::SUPPORTS_RESPONSE_OPTIONAL, Ts...> final : public UserServiceBase<Ts...>,
+                                                                           public Trigger<uint32_t, bool, Ts...> {
  public:
   UserServiceTrigger(const char *name, const std::array<const char *, sizeof...(Ts)> &arg_names)
       : UserServiceBase<Ts...>(name, arg_names, enums::SUPPORTS_RESPONSE_OPTIONAL) {}
@@ -189,8 +190,8 @@ class UserServiceTrigger<enums::SUPPORTS_RESPONSE_OPTIONAL, Ts...> : public User
 
 // Specialization for ONLY - just call_id trigger argument
 template<typename... Ts>
-class UserServiceTrigger<enums::SUPPORTS_RESPONSE_ONLY, Ts...> : public UserServiceBase<Ts...>,
-                                                                 public Trigger<uint32_t, Ts...> {
+class UserServiceTrigger<enums::SUPPORTS_RESPONSE_ONLY, Ts...> final : public UserServiceBase<Ts...>,
+                                                                       public Trigger<uint32_t, Ts...> {
  public:
   UserServiceTrigger(const char *name, const std::array<const char *, sizeof...(Ts)> &arg_names)
       : UserServiceBase<Ts...>(name, arg_names, enums::SUPPORTS_RESPONSE_ONLY) {}
@@ -201,8 +202,8 @@ class UserServiceTrigger<enums::SUPPORTS_RESPONSE_ONLY, Ts...> : public UserServ
 
 // Specialization for STATUS - just call_id trigger argument (reports success/error without data)
 template<typename... Ts>
-class UserServiceTrigger<enums::SUPPORTS_RESPONSE_STATUS, Ts...> : public UserServiceBase<Ts...>,
-                                                                   public Trigger<uint32_t, Ts...> {
+class UserServiceTrigger<enums::SUPPORTS_RESPONSE_STATUS, Ts...> final : public UserServiceBase<Ts...>,
+                                                                         public Trigger<uint32_t, Ts...> {
  public:
   UserServiceTrigger(const char *name, const std::array<const char *, sizeof...(Ts)> &arg_names)
       : UserServiceBase<Ts...>(name, arg_names, enums::SUPPORTS_RESPONSE_STATUS) {}
@@ -221,7 +222,7 @@ class UserServiceTrigger<enums::SUPPORTS_RESPONSE_STATUS, Ts...> : public UserSe
 
 namespace esphome::api {
 
-template<typename... Ts> class APIRespondAction : public Action<Ts...> {
+template<typename... Ts> class APIRespondAction final : public Action<Ts...> {
  public:
   explicit APIRespondAction(APIServer *parent) : parent_(parent) {}
 
@@ -286,7 +287,7 @@ template<typename... Ts> class APIRespondAction : public Action<Ts...> {
 
 // Action to unregister a service call after execution completes
 // Automatically appended to the end of action lists for non-none response modes
-template<typename... Ts> class APIUnregisterServiceCallAction : public Action<Ts...> {
+template<typename... Ts> class APIUnregisterServiceCallAction final : public Action<Ts...> {
  public:
   explicit APIUnregisterServiceCallAction(APIServer *parent) : parent_(parent) {}
 

esphome/components/aqi/aqi_sensor.h

@@ -6,7 +6,7 @@
 
 namespace esphome::aqi {
 
-class AQISensor : public sensor::Sensor, public Component {
+class AQISensor final : public sensor::Sensor, public Component {
  public:
   void setup() override;
   void dump_config() override;

esphome/components/as3935_i2c/as3935_i2c.h

@@ -5,7 +5,7 @@
 
 namespace esphome::as3935_i2c {
 
-class I2CAS3935Component : public as3935::AS3935Component, public i2c::I2CDevice {
+class I2CAS3935Component final : public as3935::AS3935Component, public i2c::I2CDevice {
  public:
   void dump_config() override;
 

esphome/components/as3935_spi/as3935_spi.h

@@ -8,9 +8,9 @@ namespace esphome::as3935_spi {
 
 enum AS3935RegisterMasks { SPI_READ_M = 0x40 };
 
-class SPIAS3935Component : public as3935::AS3935Component,
-                           public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_LOW,
-                                                 spi::CLOCK_PHASE_LEADING, spi::DATA_RATE_2MHZ> {
+class SPIAS3935Component final : public as3935::AS3935Component,
+                                 public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_LOW,
+                                                       spi::CLOCK_PHASE_LEADING, spi::DATA_RATE_2MHZ> {
  public:
   void setup() override;
   void dump_config() override;

esphome/components/as5600/as5600.h

@@ -43,7 +43,7 @@ enum AS5600MagnetStatus : uint8_t {
   MAGNET_WEAK = 6,    // 0b110 / magnet too weak
 };
 
-class AS5600Component : public Component, public i2c::I2CDevice {
+class AS5600Component final : public Component, public i2c::I2CDevice {
  public:
   /// Set up the internal sensor array.
   void setup() override;

esphome/components/as5600/sensor/as5600_sensor.h

@@ -9,7 +9,7 @@
 
 namespace esphome::as5600 {
 
-class AS5600Sensor : public PollingComponent, public Parented<AS5600Component>, public sensor::Sensor {
+class AS5600Sensor final : public PollingComponent, public Parented<AS5600Component>, public sensor::Sensor {
  public:
   void update() override;
   void dump_config() override;

esphome/components/as7341/as7341.h

@@ -73,7 +73,7 @@ enum AS7341Gain {
   AS7341_GAIN_512X,
 };
 
-class AS7341Component : public PollingComponent, public i2c::I2CDevice {
+class AS7341Component final : public PollingComponent, public i2c::I2CDevice {
  public:
   void setup() override;
   void dump_config() override;

esphome/components/at581x/at581x.h

@@ -12,7 +12,7 @@
 
 namespace esphome::at581x {
 
-class AT581XComponent : public Component, public i2c::I2CDevice {
+class AT581XComponent final : public Component, public i2c::I2CDevice {
  public:
 #ifdef USE_SWITCH
   void set_rf_power_switch(switch_::Switch *s) {

esphome/components/at581x/automation.h

@@ -7,12 +7,12 @@
 
 namespace esphome::at581x {
 
-template<typename... Ts> class AT581XResetAction : public Action<Ts...>, public Parented<AT581XComponent> {
+template<typename... Ts> class AT581XResetAction final : public Action<Ts...>, public Parented<AT581XComponent> {
  public:
   void play(const Ts &...x) { this->parent_->reset_hardware_frontend(); }
 };
 
-template<typename... Ts> class AT581XSettingsAction : public Action<Ts...>, public Parented<AT581XComponent> {
+template<typename... Ts> class AT581XSettingsAction final : public Action<Ts...>, public Parented<AT581XComponent> {
  public:
   TEMPLATABLE_VALUE(int8_t, hw_frontend_reset)
   TEMPLATABLE_VALUE(int, frequency)

esphome/components/at581x/switch/rf_switch.h

@@ -5,7 +5,7 @@
 
 namespace esphome::at581x {
 
-class RFSwitch : public switch_::Switch, public Parented<AT581XComponent> {
+class RFSwitch final : public switch_::Switch, public Parented<AT581XComponent> {
  protected:
   void write_state(bool state) override;
 };

esphome/components/atc_mithermometer/atc_mithermometer.h

@@ -18,7 +18,7 @@ struct ParseResult {
   int raw_offset;
 };
 
-class ATCMiThermometer : public Component, public esp32_ble_tracker::ESPBTDeviceListener {
+class ATCMiThermometer final : public Component, public esp32_ble_tracker::ESPBTDeviceListener {
  public:
   void set_address(uint64_t address) { address_ = address; };
 

esphome/components/atm90e26/atm90e26.h

@@ -6,9 +6,9 @@
 
 namespace esphome::atm90e26 {
 
-class ATM90E26Component : public PollingComponent,
-                          public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH,
-                                                spi::CLOCK_PHASE_TRAILING, spi::DATA_RATE_200KHZ> {
+class ATM90E26Component final : public PollingComponent,
+                                public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH,
+                                                      spi::CLOCK_PHASE_TRAILING, spi::DATA_RATE_200KHZ> {
  public:
   void setup() override;
   void dump_config() override;

esphome/components/atm90e32/atm90e32.h

@@ -13,9 +13,9 @@
 
 namespace esphome::atm90e32 {
 
-class ATM90E32Component : public PollingComponent,
-                          public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH,
-                                                spi::CLOCK_PHASE_TRAILING, spi::DATA_RATE_1MHZ> {
+class ATM90E32Component final : public PollingComponent,
+                                public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH,
+                                                      spi::CLOCK_PHASE_TRAILING, spi::DATA_RATE_1MHZ> {
  public:
   static const uint8_t PHASEA = 0;
   static const uint8_t PHASEB = 1;

esphome/components/atm90e32/button/atm90e32_button.h

@@ -6,7 +6,7 @@
 
 namespace esphome::atm90e32 {
 
-class ATM90E32GainCalibrationButton : public button::Button, public Parented<ATM90E32Component> {
+class ATM90E32GainCalibrationButton final : public button::Button, public Parented<ATM90E32Component> {
  public:
   ATM90E32GainCalibrationButton() = default;
 
@@ -14,7 +14,7 @@ class ATM90E32GainCalibrationButton : public button::Button, public Parented<ATM
   void press_action() override;
 };
 
-class ATM90E32ClearGainCalibrationButton : public button::Button, public Parented<ATM90E32Component> {
+class ATM90E32ClearGainCalibrationButton final : public button::Button, public Parented<ATM90E32Component> {
  public:
   ATM90E32ClearGainCalibrationButton() = default;
 
@@ -22,7 +22,7 @@ class ATM90E32ClearGainCalibrationButton : public button::Button, public Parente
   void press_action() override;
 };
 
-class ATM90E32OffsetCalibrationButton : public button::Button, public Parented<ATM90E32Component> {
+class ATM90E32OffsetCalibrationButton final : public button::Button, public Parented<ATM90E32Component> {
  public:
   ATM90E32OffsetCalibrationButton() = default;
 
@@ -30,7 +30,7 @@ class ATM90E32OffsetCalibrationButton : public button::Button, public Parented<A
   void press_action() override;
 };
 
-class ATM90E32ClearOffsetCalibrationButton : public button::Button, public Parented<ATM90E32Component> {
+class ATM90E32ClearOffsetCalibrationButton final : public button::Button, public Parented<ATM90E32Component> {
  public:
   ATM90E32ClearOffsetCalibrationButton() = default;
 
@@ -38,7 +38,7 @@ class ATM90E32ClearOffsetCalibrationButton : public button::Button, public Paren
   void press_action() override;
 };
 
-class ATM90E32PowerOffsetCalibrationButton : public button::Button, public Parented<ATM90E32Component> {
+class ATM90E32PowerOffsetCalibrationButton final : public button::Button, public Parented<ATM90E32Component> {
  public:
   ATM90E32PowerOffsetCalibrationButton() = default;
 
@@ -46,7 +46,7 @@ class ATM90E32PowerOffsetCalibrationButton : public button::Button, public Paren
   void press_action() override;
 };
 
-class ATM90E32ClearPowerOffsetCalibrationButton : public button::Button, public Parented<ATM90E32Component> {
+class ATM90E32ClearPowerOffsetCalibrationButton final : public button::Button, public Parented<ATM90E32Component> {
  public:
   ATM90E32ClearPowerOffsetCalibrationButton() = default;
 

esphome/components/audio/__init__.py

@@ -395,11 +395,11 @@ async def to_code(config):
         )
     if data.mp3_support:
         cg.add_define("USE_AUDIO_MP3_SUPPORT")
-        add_idf_component(name="esphome/micro-mp3", ref="0.2.3")
+        add_idf_component(name="esphome/micro-mp3", ref="0.3.0")
         _emit_memory_pair(
             data.mp3.buffer_memory,
-            "CONFIG_MP3_DECODER_PREFER_PSRAM",
-            "CONFIG_MP3_DECODER_PREFER_INTERNAL",
+            "CONFIG_MICRO_MP3_PREFER_PSRAM",
+            "CONFIG_MICRO_MP3_PREFER_INTERNAL",
         )
     if data.opus_support:
         cg.add_define("USE_AUDIO_OPUS_SUPPORT")

esphome/components/audio_adc/automation.h

@@ -6,7 +6,7 @@
 
 namespace esphome::audio_adc {
 
-template<typename... Ts> class SetMicGainAction : public Action<Ts...> {
+template<typename... Ts> class SetMicGainAction final : public Action<Ts...> {
  public:
   explicit SetMicGainAction(AudioAdc *audio_adc) : audio_adc_(audio_adc) {}
 

esphome/components/audio_dac/automation.h

@@ -6,7 +6,7 @@
 
 namespace esphome::audio_dac {
 
-template<typename... Ts> class MuteOffAction : public Action<Ts...> {
+template<typename... Ts> class MuteOffAction final : public Action<Ts...> {
  public:
   explicit MuteOffAction(AudioDac *audio_dac) : audio_dac_(audio_dac) {}
 
@@ -16,7 +16,7 @@ template<typename... Ts> class MuteOffAction : public Action<Ts...> {
   AudioDac *audio_dac_;
 };
 
-template<typename... Ts> class MuteOnAction : public Action<Ts...> {
+template<typename... Ts> class MuteOnAction final : public Action<Ts...> {
  public:
   explicit MuteOnAction(AudioDac *audio_dac) : audio_dac_(audio_dac) {}
 
@@ -26,7 +26,7 @@ template<typename... Ts> class MuteOnAction : public Action<Ts...> {
   AudioDac *audio_dac_;
 };
 
-template<typename... Ts> class SetVolumeAction : public Action<Ts...> {
+template<typename... Ts> class SetVolumeAction final : public Action<Ts...> {
  public:
   explicit SetVolumeAction(AudioDac *audio_dac) : audio_dac_(audio_dac) {}
 

esphome/components/audio_file/media_source/audio_file_media_source.h

@@ -23,7 +23,9 @@ namespace esphome::audio_file {
 //     (the orchestrator calls set_listener() on us with a MediaSourceListener*).
 //   - micro_decoder::DecoderListener: the underlying decoder calls back *into* us with decoded
 //     audio and state changes (we call decoder_->set_listener(this) in setup()).
-class AudioFileMediaSource : public Component, public media_source::MediaSource, public micro_decoder::DecoderListener {
+class AudioFileMediaSource final : public Component,
+                                   public media_source::MediaSource,
+                                   public micro_decoder::DecoderListener {
  public:
   void setup() override;
   void loop() override;

esphome/components/audio_http/audio_http_media_source.h

@@ -23,7 +23,9 @@ namespace esphome::audio_http {
 //   - micro_decoder::DecoderListener: the underlying decoder calls back *into* us with decoded
 //     audio and state changes (we call decoder_->set_listener(this) in setup()).
 // The two set_listener() methods live on different base classes and serve opposite directions.
-class AudioHTTPMediaSource : public Component, public media_source::MediaSource, public micro_decoder::DecoderListener {
+class AudioHTTPMediaSource final : public Component,
+                                   public media_source::MediaSource,
+                                   public micro_decoder::DecoderListener {
  public:
   void setup() override;
   void loop() override;

esphome/components/axs15231/touchscreen/axs15231_touchscreen.h

@@ -7,7 +7,7 @@
 
 namespace esphome::axs15231 {
 
-class AXS15231Touchscreen : public touchscreen::Touchscreen, public i2c::I2CDevice {
+class AXS15231Touchscreen final : public touchscreen::Touchscreen, public i2c::I2CDevice {
  public:
   void setup() override;
   void dump_config() override;

esphome/components/ballu/ballu.h

@@ -10,7 +10,7 @@ namespace esphome::ballu {
 const float YKR_K_002E_TEMP_MIN = 16.0;
 const float YKR_K_002E_TEMP_MAX = 32.0;
 
-class BalluClimate : public climate_ir::ClimateIR {
+class BalluClimate final : public climate_ir::ClimateIR {
  public:
   BalluClimate()
       : climate_ir::ClimateIR(YKR_K_002E_TEMP_MIN, YKR_K_002E_TEMP_MAX, 1.0f, true, true,

esphome/components/bang_bang/bang_bang_climate.h

@@ -16,7 +16,7 @@ struct BangBangClimateTargetTempConfig {
   float default_temperature_high{NAN};
 };
 
-class BangBangClimate : public climate::Climate, public Component {
+class BangBangClimate final : public climate::Climate, public Component {
  public:
   BangBangClimate();
   void setup() override;

esphome/components/bedjet/bedjet_hub.h

@@ -33,7 +33,7 @@ static const espbt::ESPBTUUID BEDJET_NAME_UUID = espbt::ESPBTUUID::from_raw("000
 /**
  * Hub component connecting to the BedJet device over Bluetooth.
  */
-class BedJetHub : public esphome::ble_client::BLEClientNode, public PollingComponent {
+class BedJetHub final : public esphome::ble_client::BLEClientNode, public PollingComponent {
  public:
   /* BedJet functionality exposed to `BedJetClient` children and/or accessible from action lambdas. */
 

esphome/components/bedjet/climate/bedjet_climate.h

@@ -12,7 +12,7 @@
 
 namespace esphome::bedjet {
 
-class BedJetClimate : public climate::Climate, public BedJetClient, public PollingComponent {
+class BedJetClimate final : public climate::Climate, public BedJetClient, public PollingComponent {
  public:
   void setup() override;
   void loop() override;

esphome/components/bedjet/fan/bedjet_fan.h

@@ -12,7 +12,7 @@
 
 namespace esphome::bedjet {
 
-class BedJetFan : public fan::Fan, public BedJetClient, public PollingComponent {
+class BedJetFan final : public fan::Fan, public BedJetClient, public PollingComponent {
  public:
   void update() override;
   void dump_config() override;

esphome/components/bedjet/sensor/bedjet_sensor.h

@@ -7,7 +7,7 @@
 
 namespace esphome::bedjet {
 
-class BedjetSensor : public BedJetClient, public Component {
+class BedjetSensor final : public BedJetClient, public Component {
  public:
   void dump_config() override;
 

esphome/components/beken_spi_led_strip/led_strip.h

@@ -19,7 +19,7 @@ enum RGBOrder : uint8_t {
   ORDER_BRG,
 };
 
-class BekenSPILEDStripLightOutput : public light::AddressableLight {
+class BekenSPILEDStripLightOutput final : public light::AddressableLight {
  public:
   void setup() override;
   void write_state(light::LightState *state) override;

esphome/components/bh1750/bh1750.h

@@ -13,7 +13,7 @@ enum BH1750Mode : uint8_t {
 };
 
 /// This class implements support for the i2c-based BH1750 ambient light sensor.
-class BH1750Sensor : public sensor::Sensor, public PollingComponent, public i2c::I2CDevice {
+class BH1750Sensor final : public sensor::Sensor, public PollingComponent, public i2c::I2CDevice {
  public:
   // ========== INTERNAL METHODS ==========
   // (In most use cases you won't need these)

esphome/components/bh1900nux/bh1900nux.h

@@ -6,7 +6,7 @@
 
 namespace esphome::bh1900nux {
 
-class BH1900NUXSensor : public sensor::Sensor, public PollingComponent, public i2c::I2CDevice {
+class BH1900NUXSensor final : public sensor::Sensor, public PollingComponent, public i2c::I2CDevice {
  public:
   void setup() override;
   void update() override;

esphome/components/binary/fan/binary_fan.h

@@ -6,7 +6,7 @@
 
 namespace esphome::binary {
 
-class BinaryFan : public Component, public fan::Fan {
+class BinaryFan final : public Component, public fan::Fan {
  public:
   void setup() override;
   void dump_config() override;