[web_server] Include assumed_state in cover detail=all JSON

cover_json_() did not serialize the assumed_state flag in the DETAIL_ALL
JSON, unlike switch_json_() which already emits it. Consumers of the web
server JSON/SSE API could not tell whether a cover's state is assumed,
causing a web vs native-API inconsistency (the native API exposes the
flag, so Home Assistant behaves correctly, but the web UI does not).

Emit assumed_state from the cover's traits, matching the switch.

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-ARG BUILD_BASE_VERSION=2026.06.1
+ARG BUILD_BASE_VERSION=2025.04.0
 
 
 FROM ghcr.io/esphome/docker-base:debian-${BUILD_BASE_VERSION} AS base

.devcontainer/devcontainer.json

@@ -15,6 +15,7 @@
     // uncomment and edit the path in order to pass through local USB serial to the container
     // , "--device=/dev/ttyACM0"
   ],
+  "appPort": 6052,
   // if you are using avahi in the host device, uncomment these to allow the
   // devcontainer to find devices via mdns
   //"mounts": [
@@ -40,11 +41,7 @@
       ],
       "settings": {
         "python.languageServer": "Pylance",
-        // Use the container's pre-provisioned venv (built by the Dockerfile, outside the
-        // bind-mounted workspace) rather than a ./venv that may leak in from the host and
-        // mismatch the container's Python. See .devcontainer/Dockerfile (esphome-venv).
-        "python.defaultInterpreterPath": "/home/esphome/.local/esphome-venv/bin/python",
-        "python.terminal.activateEnvironment": true,
+        "python.pythonPath": "/usr/bin/python3",
         "pylint.args": [
           "--rcfile=${workspaceFolder}/pyproject.toml"
         ],

.gitattributes

@@ -1,5 +1,3 @@
 # Normalize line endings to LF in the repository
 * text eol=lf
 *.png binary
-*.gif binary
-*.apng binary

.github/ISSUE_TEMPLATE/config.yml

@@ -8,7 +8,7 @@ contact_links:
     url: https://github.com/esphome/esphome-webserver/issues/new/choose
     about: Report an issue with the ESPHome web server.
   - name: Report an issue with the ESPHome Builder / Dashboard
-    url: https://github.com/esphome/device-builder/issues/new/choose
+    url: https://github.com/esphome/dashboard/issues/new/choose
     about: Report an issue with the ESPHome Builder / Dashboard.
   - name: Report an issue with the ESPHome API client
     url: https://github.com/esphome/aioesphomeapi/issues/new/choose

.github/PULL_REQUEST_TEMPLATE.md

@@ -6,7 +6,6 @@
 
 - [ ] Bugfix (non-breaking change which fixes an issue)
 - [ ] New feature (non-breaking change which adds functionality)
-- [ ] New developer-facing feature (adds functionality for component developers; no end-user configuration change)
 - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) — [policy](https://developers.esphome.io/contributing/code/#what-constitutes-a-c-breaking-change)
 - [ ] Developer breaking change (an API change that could break external components) — [policy](https://developers.esphome.io/contributing/code/#what-is-considered-public-c-api)
 - [ ] Undocumented C++ API change (removal or change of undocumented public methods that lambda users may depend on) — [policy](https://developers.esphome.io/contributing/code/#c-user-expectations)
@@ -21,10 +20,6 @@
 
 - esphome/esphome.io#<esphome.io PR number goes here>
 
-**Pull request in [developers.esphome.io](https://github.com/esphome/developers.esphome.io) with developer documentation (if applicable):**
-
-- esphome/developers.esphome.io#<developers.esphome.io PR number goes here>
-
 ## Test Environment
 
 - [ ] ESP32

.github/actions/build-image/action.yaml

@@ -42,7 +42,7 @@ runs:
 
     - name: Build and push to ghcr by digest
       id: build-ghcr
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
@@ -67,7 +67,7 @@ runs:
 
     - name: Build and push to dockerhub by digest
       id: build-dockerhub
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false

.github/actions/cache-esp-idf/action.yml

@@ -3,10 +3,8 @@ description: >
   Resolve the pinned ESP-IDF version and cache the native ESP-IDF install
   (toolchains + source) at ~/.esphome-idf. Every job that installs ESP-IDF
   natively (clang-tidy for IDF/Arduino and the component test batches) shares
-  one cache, since the install is identical: ESPHOME_IDF_DEFAULT_TARGETS
-  defaults to "all", and _get_configured_targets() in espidf/toolchain.py
-  skips per-variant narrowing whenever CI is set, so all toolchains are
-  present regardless of the chip a job builds.
+  one cache, since the install is identical (ESPHOME_IDF_DEFAULT_TARGETS
+  defaults to "all", so all toolchains are present regardless of the chip).
   Callers must set env ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf and have the
   Python venv already restored.
 inputs:

.github/actions/cache-sdk-nrf/action.yml

@@ -1,49 +0,0 @@
-name: Cache nRF Connect SDK
-description: >
-  Resolve the pinned sdk-nrf version and cache the native sdk-nrf install
-  (west workspace, Zephyr SDK toolchain, python env) at ~/.esphome-sdk-nrf.
-  Every job that installs sdk-nrf natively (the nrf52 clang-tidy job and,
-  once the component tests build natively, their batches) shares one cache.
-  Callers must set env ESPHOME_SDK_NRF_PREFIX: ~/.esphome-sdk-nrf and have
-  the Python venv already restored.
-inputs:
-  restore-only:
-    description: >
-      When "true", only restore -- never save the cache, even on dev. Use from
-      jobs that may not produce a complete install (e.g. a component batch
-      that fails mid-install), so a partial install is never written.
-    default: "false"
-runs:
-  using: composite
-  steps:
-    - name: Resolve sdk-nrf and toolchain versions for cache key
-      # Both versions are pinned in code, not in any file that feeds the
-      # other cache keys, so resolve them explicitly. Keying on them means
-      # the cache invalidates when either is bumped (actions/cache never
-      # overwrites a key).
-      id: version
-      shell: bash
-      run: |
-        . venv/bin/activate
-        version=$(python -c '
-        from esphome.components.nrf52 import RECOMMENDED_SDK_NRF_VERSION
-        from esphome.components.nrf52.framework import TOOLCHAIN_VERSION
-        print(f"{RECOMMENDED_SDK_NRF_VERSION}-{TOOLCHAIN_VERSION}")')
-        echo "version=$version" >> "$GITHUB_OUTPUT"
-    # Mirror cache-esp-idf: only dev-branch runs write the shared cache (so it
-    # lives in the default-branch scope readable by all PRs); PRs are
-    # restore-only and never push multi-GB artifacts into their own scope.
-    - name: Cache nRF Connect SDK install (write on dev)
-      if: github.ref == 'refs/heads/dev' && inputs.restore-only != 'true'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ~/.esphome-sdk-nrf
-        # yamllint disable-line rule:line-length
-        key: ${{ runner.os }}-esphome-sdk-nrf-${{ steps.version.outputs.version }}-${{ hashFiles('esphome/components/nrf52/requirements.txt') }}
-    - name: Cache nRF Connect SDK install (restore-only off dev)
-      if: github.ref != 'refs/heads/dev' || inputs.restore-only == 'true'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ~/.esphome-sdk-nrf
-        # yamllint disable-line rule:line-length
-        key: ${{ runner.os }}-esphome-sdk-nrf-${{ steps.version.outputs.version }}-${{ hashFiles('esphome/components/nrf52/requirements.txt') }}

.github/actions/restore-python/action.yml

@@ -17,12 +17,12 @@ runs:
   steps:
     - name: Set up Python ${{ inputs.python-version }}
       id: python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: ${{ inputs.python-version }}
     - name: Restore Python virtual environment
       id: cache-venv
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
       with:
         path: venv
         # yamllint disable-line rule:line-length
@@ -32,12 +32,9 @@ runs:
       # detects the activated venv via ``VIRTUAL_ENV`` so the venv layout
       # downstream jobs rely on is preserved.
       if: steps.cache-venv.outputs.cache-hit != 'true'
-      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
-        # Pull request saves land in per-PR scopes nothing else can
-        # reuse; dev pushes seed the shared copy instead.
-        save-cache: ${{ github.event_name != 'pull_request' }}
         # Pin uv version so the action does not have to fetch the
         # manifest from raw.githubusercontent.com on every cache
         # miss; that fetch flakes on Windows runners.
@@ -49,7 +46,7 @@ runs:
         python -m venv venv
         source venv/bin/activate
         python --version
-        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
+        uv pip install -r requirements.txt -r requirements_test.txt
         uv pip install -e .
     - name: Create Python virtual environment
       if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os == 'Windows'
@@ -58,5 +55,5 @@ runs:
         python -m venv venv
         source ./venv/Scripts/activate
         python --version
-        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
+        uv pip install -r requirements.txt -r requirements_test.txt
         uv pip install -e .

.github/scripts/auto-label-pr/constants.js

@@ -13,7 +13,6 @@ module.exports = {
     'merging-to-release',
     'merging-to-beta',
     'chained-pr',
-    'stacked-pr',
     'core',
     'small-pr',
     'medium-pr',
@@ -23,13 +22,11 @@ module.exports = {
     'has-tests',
     'needs-tests',
     'needs-docs',
-    'needs-developer-docs',
     'needs-codeowners',
     'too-big',
     'labeller-recheck',
     'bugfix',
     'new-feature',
-    'new-feature-developer',
     'breaking-change',
     'developer-breaking-change',
     'undocumented-api-change',
@@ -43,17 +40,5 @@ module.exports = {
     // Keep matching the old esphome-docs name during the transition period
     /https:\/\/github\.com\/esphome\/esphome-docs\/pull\/\d+/,
     /esphome\/esphome-docs#\d+/
-  ],
-
-  DEVELOPER_DOCS_PR_PATTERNS: [
-    /https:\/\/github\.com\/esphome\/developers\.esphome\.io\/pull\/\d+/,
-    /esphome\/developers\.esphome\.io#\d+/
-  ],
-
-  // Files whose developer-facing changes are documented via Python docstrings
-  // only - developers.esphome.io has no reference page for them yet, so PRs
-  // touching nothing but these files (and tests/) skip needs-developer-docs.
-  DEV_DOCS_EXEMPT_FILES: [
-    'esphome/config_validation.py'
   ]
 };

.github/scripts/auto-label-pr/detectors.js

@@ -1,4 +1,4 @@
-const { DOCS_PR_PATTERNS, DEVELOPER_DOCS_PR_PATTERNS, DEV_DOCS_EXEMPT_FILES } = require('./constants');
+const { DOCS_PR_PATTERNS } = require('./constants');
 const {
   COMPONENT_REGEX,
   detectComponents,
@@ -33,54 +33,16 @@ async function fetchPrFileContent(github, context, path) {
   }
 }
 
-// Check whether a pull request is part of a GitHub stack.
-//
-// GitHub's stacked pull request feature adds a `stack` object to the pull
-// request resource. It is present on every pull request in the stack -
-// including the bottom one, whose base is already `dev` - and is absent
-// entirely on standalone pull requests.
-//
-// The `pull_request_target` webhook payload is not guaranteed to carry this
-// field, so fall back to asking the API when it is missing. Guessing wrong
-// here is costly: a stacked pull request mistaken for a manually chained one
-// gets a label that blocks merging.
-async function isStackedPr(github, context) {
-  const pr = context.payload.pull_request;
-  if (pr.stack != null) {
-    return true;
-  }
-
-  try {
-    const { owner, repo } = context.repo;
-    const { data } = await github.rest.pulls.get({
-      owner,
-      repo,
-      pull_number: pr.number,
-    });
-    return data.stack != null;
-  } catch (error) {
-    // Treat an API failure as "not stacked" so a chained pull request still
-    // gets its blocking label rather than silently slipping through.
-    console.log('Failed to check stack membership:', error.message);
-    return false;
-  }
-}
-
 // Strategy: Merge branch detection
-async function detectMergeBranch(github, context) {
+async function detectMergeBranch(context) {
   const labels = new Set();
   const baseRef = context.payload.pull_request.base.ref;
-  const defaultBranch = context.payload.repository.default_branch;
 
   if (baseRef === 'release') {
     labels.add('merging-to-release');
   } else if (baseRef === 'beta') {
     labels.add('merging-to-beta');
-  } else if (await isStackedPr(github, context)) {
-    // GitHub manages the merge order for a stack, so these are not blocked.
-    labels.add('stacked-pr');
-  } else if (baseRef !== defaultBranch) {
-    // A chain built by hand: it must not merge until its base branch does.
+  } else if (baseRef !== 'dev') {
     labels.add('chained-pr');
   }
 
@@ -283,7 +245,6 @@ async function detectPRTemplateCheckboxes(context) {
   const checkboxPatterns = [
     { pattern: /- \[x\] Bugfix \(non-breaking change which fixes an issue\)/i, label: 'bugfix' },
     { pattern: /- \[x\] New feature \(non-breaking change which adds functionality\)/i, label: 'new-feature' },
-    { pattern: /- \[x\] New developer-facing feature \(adds functionality for component developers; no end-user configuration change\)/i, label: 'new-feature-developer' },
     { pattern: /- \[x\] Breaking change \(fix or feature that would cause existing functionality to not work as expected\)/i, label: 'breaking-change' },
     { pattern: /- \[x\] Developer breaking change \(an API change that could break external components\)/i, label: 'developer-breaking-change' },
     { pattern: /- \[x\] Undocumented C\+\+ API change \(removal or change of undocumented public methods that lambda users may depend on\)/i, label: 'undocumented-api-change' },
@@ -394,14 +355,12 @@ async function detectRequirements(allLabels, prFiles, context, hasYamlLoadable)
   const labels = new Set();
 
   // Check for missing tests
-  if ((allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature') || allLabels.has('new-feature-developer')) && !allLabels.has('has-tests')) {
+  if ((allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature')) && !allLabels.has('has-tests')) {
     labels.add('needs-tests');
   }
 
   // Check for missing docs.
-  // `new-feature` (PR-body checkbox) always counts. `new-feature-developer` is
-  // deliberately excluded here: its docs live on developers.esphome.io and are
-  // checked separately below. `new-component` / `new-platform`
+  // `new-feature` (PR-body checkbox) always counts. `new-component` / `new-platform`
   // only count when at least one newly added file defines a top-level CONFIG_SCHEMA,
   // i.e. the new component/platform is actually loadable from YAML.
   const docsEligible =
@@ -417,22 +376,6 @@ async function detectRequirements(allLabels, prFiles, context, hasYamlLoadable)
     }
   }
 
-  // Check for missing developer docs. `new-feature-developer` requires a
-  // developers.esphome.io PR link, unless every changed file outside tests/ is
-  // in DEV_DOCS_EXEMPT_FILES (core validators documented via docstrings only).
-  if (allLabels.has('new-feature-developer')) {
-    const prBody = context.payload.pull_request.body || '';
-    const nonTestFiles = prFiles
-      .map(file => file.filename)
-      .filter(file => !file.startsWith('tests/'));
-    const onlyExemptFiles = nonTestFiles.every(file => DEV_DOCS_EXEMPT_FILES.includes(file));
-    const hasDevDocsLink = DEVELOPER_DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
-
-    if (!onlyExemptFiles && !hasDevDocsLink) {
-      labels.add('needs-developer-docs');
-    }
-  }
-
   // Check for missing CODEOWNERS
   if (allLabels.has('new-component')) {
     const codeownersModified = prFiles.some(file =>

.github/scripts/auto-label-pr/index.js

@@ -88,7 +88,7 @@ module.exports = async ({ github, context }) => {
 
   // Early exit for release and beta branches only
   if (baseRef === 'release' || baseRef === 'beta') {
-    const branchLabels = await detectMergeBranch(github, context);
+    const branchLabels = await detectMergeBranch(context);
     const finalLabels = Array.from(branchLabels);
 
     console.log('Computed labels (merge branch only):', finalLabels.join(', '));
@@ -118,7 +118,7 @@ module.exports = async ({ github, context }) => {
     deprecatedResult,
     maintainerAccess
   ] = await Promise.all([
-    detectMergeBranch(github, context),
+    detectMergeBranch(context),
     detectComponentPlatforms(changedFiles, apiData),
     detectNewComponents(github, context, prFiles),
     detectNewPlatforms(github, context, prFiles, apiData),

.github/scripts/auto-label-pr/tests/detectors.test.js

@@ -1,14 +1,6 @@
 const { describe, it } = require('node:test');
 const assert = require('node:assert/strict');
-const {
-  detectMergeBranch,
-  detectNewPlatforms,
-  detectNewComponents,
-  detectPRSize,
-  detectPRTemplateCheckboxes,
-  detectRequirements,
-} = require('../detectors');
-const { MANAGED_LABELS } = require('../constants');
+const { detectNewPlatforms, detectNewComponents, detectPRSize } = require('../detectors');
 
 // Minimal GitHub API mock — only repos.getContent is called by detectNewPlatforms/detectNewComponents
 // to check for CONFIG_SCHEMA in newly added files.
@@ -37,122 +29,6 @@ const API_DATA = {
 const WITH_SCHEMA = 'CONFIG_SCHEMA = cv.Schema({})';
 const WITHOUT_SCHEMA = 'CODEOWNERS = ["@esphome/core"]';
 
-// ---------------------------------------------------------------------------
-// detectMergeBranch
-// ---------------------------------------------------------------------------
-
-// Builds a fresh context for detectMergeBranch tests instead of mutating the
-// shared CONTEXT fixture above (which other describe blocks rely on).
-function makeMergeContext(baseRef, { stack, defaultBranch = 'dev' } = {}) {
-  const pull_request = { number: 1, base: { ref: baseRef } };
-  if (stack !== undefined) {
-    pull_request.stack = stack;
-  }
-  return {
-    repo: { owner: 'esphome', repo: 'esphome' },
-    payload: { pull_request, repository: { default_branch: defaultBranch } }
-  };
-}
-
-// A GitHub API mock exposing only rest.pulls.get, with a call counter so
-// tests can assert whether the API fallback was actually invoked.
-function makeStackGithub({ stack = null, error = null } = {}) {
-  const state = { calls: 0 };
-  const github = {
-    rest: {
-      pulls: {
-        get: async () => {
-          state.calls++;
-          if (error) throw error;
-          return { data: { stack } };
-        }
-      }
-    }
-  };
-  return { github, state };
-}
-
-const STACK_INFO = { base: { ref: 'dev' }, id: 71540, number: 17978, position: 3, size: 3 };
-
-describe('detectMergeBranch', () => {
-  it('base ref release adds merging-to-release only and never checks the stack', async () => {
-    const { github, state } = makeStackGithub({ stack: STACK_INFO });
-    const context = makeMergeContext('release', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['merging-to-release']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('base ref beta adds merging-to-beta only and never checks the stack', async () => {
-    const { github, state } = makeStackGithub({ stack: STACK_INFO });
-    const context = makeMergeContext('beta', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['merging-to-beta']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('stack present on the webhook payload adds stacked-pr without calling the API', async () => {
-    const { github, state } = makeStackGithub();
-    const context = makeMergeContext('feature-branch', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('stack absent from payload falls back to the API and adds stacked-pr', async () => {
-    const { github, state } = makeStackGithub({ stack: STACK_INFO });
-    const context = makeMergeContext('feature-branch');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
-    assert.equal(state.calls, 1);
-  });
-
-  it('bottom of a stack (base ref dev, stack present) still adds stacked-pr', async () => {
-    const { github, state } = makeStackGithub();
-    const context = makeMergeContext('dev', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('not stacked, base ref not dev adds chained-pr', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('feature-branch');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
-  });
-
-  it('not stacked, base ref dev adds no labels', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('dev');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), []);
-  });
-
-  it('a failed stack lookup falls back to not-stacked, so a feature-branch base adds chained-pr', async () => {
-    const { github, state } = makeStackGithub({ error: new Error('API unavailable') });
-    const context = makeMergeContext('feature-branch');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
-    assert.equal(state.calls, 1);
-  });
-
-  it('base ref matches default branch adds no labels', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('other', { defaultBranch: 'other' });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), []);
-  });
-
-  it('base ref dev when the default branch is main adds chained-pr', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('dev', { defaultBranch: 'main' });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
-  });
-
-});
-
 // ---------------------------------------------------------------------------
 // detectNewPlatforms
 // ---------------------------------------------------------------------------
@@ -270,125 +146,6 @@ describe('detectNewComponents', () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// detectPRTemplateCheckboxes
-// ---------------------------------------------------------------------------
-
-const NEW_FEATURE_LINE = '- [x] New feature (non-breaking change which adds functionality)';
-const DEV_FEATURE_LINE = '- [x] New developer-facing feature (adds functionality for component developers; no end-user configuration change)';
-const DEV_FEATURE_LINE_UNTICKED = '- [ ] New developer-facing feature (adds functionality for component developers; no end-user configuration change)';
-
-function makeBodyContext(body) {
-  return { payload: { pull_request: { body } } };
-}
-
-describe('detectPRTemplateCheckboxes', () => {
-  it('ticked developer-facing feature checkbox adds new-feature-developer only', async () => {
-    const labels = await detectPRTemplateCheckboxes(makeBodyContext(DEV_FEATURE_LINE));
-    assert.ok(labels.has('new-feature-developer'));
-    assert.ok(!labels.has('new-feature'));
-  });
-
-  it('unticked developer-facing feature checkbox adds no label', async () => {
-    const labels = await detectPRTemplateCheckboxes(makeBodyContext(DEV_FEATURE_LINE_UNTICKED));
-    assert.ok(!labels.has('new-feature-developer'));
-  });
-
-  it('ticked new feature checkbox does not add new-feature-developer', async () => {
-    const labels = await detectPRTemplateCheckboxes(makeBodyContext(NEW_FEATURE_LINE));
-    assert.ok(labels.has('new-feature'));
-    assert.ok(!labels.has('new-feature-developer'));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// detectRequirements
-// ---------------------------------------------------------------------------
-
-describe('detectRequirements', () => {
-  // PR body without any docs-PR link.
-  const NO_DOCS_CONTEXT = makeBodyContext('Just a description, no docs link.');
-  const USER_DOCS_CONTEXT = makeBodyContext('Docs: esphome/esphome.io#1234');
-  const DEV_DOCS_CONTEXT = makeBodyContext('Docs: esphome/developers.esphome.io#1234');
-  const DEV_DOCS_URL_CONTEXT = makeBodyContext('Docs: https://github.com/esphome/developers.esphome.io/pull/1234');
-
-  // File sets: a normal source change vs. one confined to the exempt core validators.
-  const SOURCE_FILES = [
-    { filename: 'esphome/components/foo/foo.py' },
-    { filename: 'tests/components/foo/common.yaml' },
-  ];
-  const VALIDATOR_FILES = [
-    { filename: 'esphome/config_validation.py' },
-    { filename: 'tests/unit_tests/test_config_validation.py' },
-  ];
-
-  it('new-feature-developer without has-tests adds needs-tests but not needs-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer']), SOURCE_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-tests'));
-    assert.ok(!labels.has('needs-docs'));
-  });
-
-  it('new-feature-developer with has-tests does not add needs-tests', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(!labels.has('needs-tests'));
-  });
-
-  it('new-feature without a docs link still adds needs-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature', 'has-tests']), [], NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-docs'));
-  });
-
-  it('new-feature-developer without a developer docs link adds needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-developer-docs'));
-  });
-
-  it('a developers.esphome.io shorthand link satisfies needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, DEV_DOCS_CONTEXT, false);
-    assert.ok(!labels.has('needs-developer-docs'));
-  });
-
-  it('a developers.esphome.io URL link satisfies needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, DEV_DOCS_URL_CONTEXT, false);
-    assert.ok(!labels.has('needs-developer-docs'));
-  });
-
-  it('a user docs (esphome.io) link does not satisfy needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, USER_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-developer-docs'));
-  });
-
-  it('a developer docs link does not satisfy needs-docs for new-feature', async () => {
-    const labels = await detectRequirements(new Set(['new-feature', 'has-tests']), [], DEV_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-docs'));
-  });
-
-  it('changes confined to core validator files are exempt from needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), VALIDATOR_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(!labels.has('needs-developer-docs'));
-  });
-
-  it('validator changes mixed with other source files are not exempt', async () => {
-    const prFiles = [...VALIDATOR_FILES, { filename: 'esphome/components/foo/foo.py' }];
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), prFiles, NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-developer-docs'));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// MANAGED_LABELS
-// ---------------------------------------------------------------------------
-
-describe('MANAGED_LABELS', () => {
-  it('includes new-feature-developer so the workflow syncs it', () => {
-    assert.ok(MANAGED_LABELS.includes('new-feature-developer'));
-  });
-
-  it('includes needs-developer-docs so the workflow syncs it', () => {
-    assert.ok(MANAGED_LABELS.includes('needs-developer-docs'));
-  });
-});
-
 // ---------------------------------------------------------------------------
 // detectPRSize
 // ---------------------------------------------------------------------------

.github/workflows/auto-label-pr.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.event.pull_request.state == 'open' && (github.event.action != 'labeled' || github.event.sender.type != 'Bot')
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Generate a token
         id: generate-token
@@ -35,7 +35,7 @@ jobs:
           # Scope the minted App token to the minimum needed by auto-label-pr/*.js.
           permission-contents: read       # repos.getContent for CODEOWNERS and file lookups in detectors.js
           permission-issues: write        # listLabelsOnIssue, addLabels, removeLabel, list/createComment
-          permission-pull-requests: write  # pulls.get, pulls.listFiles, list/create/update/dismissReview
+          permission-pull-requests: write  # pulls.listFiles, list/create/update/dismissReview
 
       - name: Auto Label PR
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/ci-api-proto.yml

@@ -21,52 +21,27 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: "3.12"
+          python-version: "3.11"
       - name: Set up uv
         # ``--system`` (below) installs into the setup-python interpreter;
         # no venv is created or restored by this workflow.
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
-          # Pull-request-only workflow: a save could never be shared and
-          # would only consume quota.
-          save-cache: "false"
           # Pin uv version so the action does not have to fetch the
           # manifest from raw.githubusercontent.com on every cache
           # miss; that fetch flakes on Windows runners.
           version: "0.11.15"
 
       - name: Install apt dependencies
-        # PR-only workflow, so nothing on dev could seed a shared apt cache
-        # entry; the cached apt action would save one copy per PR. Plain apt
-        # with every call bounded: the apt.conf.d timeouts make a dead
-        # mirror fail over in seconds, and timeout runs under sudo so it can
-        # kill apt-get itself. Install without update first: image lists are
-        # fresh, and the index refresh is what a congested mirror makes slow.
-        timeout-minutes: 15
         run: |
-          sudo tee /etc/apt/apt.conf.d/99ci-acquire-timeouts >/dev/null <<'EOF'
-          Acquire::Retries "1";
-          Acquire::http::Timeout "15";
-          Acquire::https::Timeout "15";
-          EOF
-          # Common path: the image's package lists are fresh enough.
-          if sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 90 \
-              apt-get install -y protobuf-compiler; then
-            protoc --version
-            exit 0
-          fi
-          # Rescue path: refresh the lists once with a generous bound; the
-          # apt config already fails a stalled mirror over quickly.
-          sudo DEBIAN_FRONTEND=noninteractive timeout -k 10 30 \
-            dpkg --configure -a || true
-          sudo timeout -k 15 300 apt-get update
-          sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 300 \
-            apt-get install -y protobuf-compiler
+          sudo apt update
+          sudo apt-cache show protobuf-compiler
+          sudo apt install -y protobuf-compiler
           protoc --version
       - name: Install python dependencies
         run: uv pip install --system aioesphomeapi -c requirements.txt -r requirements_dev.txt

.github/workflows/ci-docker.yml

@@ -61,23 +61,21 @@ jobs:
       tag: ${{ steps.tag.outputs.tag }}
       push: ${{ steps.tag.outputs.push }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: "3.12"
+          python-version: "3.11"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Determine tag and whether to push
         id: tag
-        env:
-          HEAD_REF: ${{ github.head_ref || github.ref_name }}
         run: |
           # Sanitize the branch name into a valid docker tag: replace invalid
           # characters, ensure the first character is valid (tags must start
           # with [A-Za-z0-9_]), and cap the length at 128 characters.
-          branch="$HEAD_REF"
+          branch="${{ github.head_ref || github.ref_name }}"
           tag="${branch//[^a-zA-Z0-9_.-]/-}"
           case "$tag" in
             [a-zA-Z0-9_]*) ;;
@@ -98,7 +96,7 @@ jobs:
 
       - name: Log in to the GitHub container registry
         if: steps.tag.outputs.push == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -147,16 +145,16 @@ jobs:
           - "ha-addon"
           - "docker"
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: "3.12"
+          python-version: "3.11"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to the GitHub container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -182,8 +180,8 @@ jobs:
       contents: read  # actions/checkout to load the test configs
     strategy:
       fail-fast: false
-      # Modest cap so this smoke test leaves room on the shared runner pool.
-      max-parallel: 8
+      # Cap concurrency so this smoke test doesn't hog all the shared runners.
+      max-parallel: 2
       matrix:
         # One entry per distinct toolchain. ESP32 variants (c3/c6/s2/s3/p4)
         # share a toolchain bundle, so esp32 is exercised on the base variant
@@ -204,7 +202,7 @@ jobs:
           - nrf52
           - host
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Download image artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

.github/workflows/ci-github-scripts.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Run tests
         working-directory: .github/scripts/auto-label-pr

.github/workflows/ci-memory-impact-comment.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Check out code from base repository
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Always check out from the base repository (esphome/esphome), never from forks
           # Use the PR's target branch to ensure we run trusted code from the main repo
@@ -60,7 +60,7 @@ jobs:
         if: steps.pr.outputs.skip != 'true'
         uses: ./.github/actions/restore-python
         with:
-          python-version: "3.12"
+          python-version: "3.11"
           cache-key: ${{ hashFiles('.cache-key') }}
 
       - name: Download memory analysis artifacts

.github/workflows/codeowner-approved-label-update.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout base branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           sparse-checkout: |

.github/workflows/codeowner-review-request.yml

@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout base branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.base.sha }}
 

.github/workflows/codeql.yml

@@ -52,11 +52,11 @@ jobs:
             # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -84,6 +84,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/lock.yml

@@ -14,4 +14,4 @@ jobs:
     permissions:
       issues: write         # issues.lock on closed issues
       pull-requests: write  # issues.lock on closed pull requests
-    uses: esphome/workflows/.github/workflows/lock.yml@0fdd5e311b7e744069166696072a1a9cbc5fbeb6  # 2026.8.1
+    uses: esphome/workflows/.github/workflows/lock.yml@025a1e6255610c498ed590403b7e510b69e474df  # 2026.4.1

.github/workflows/pr-title-check.yml

@@ -16,7 +16,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

.github/workflows/release-nightly.yml

@@ -1,38 +0,0 @@
----
-name: Nightly Dev Release
-
-# Works out the dated dev tag and starts the release workflow with it, so that
-# the release run is named after the tag it builds. A workflow run name is
-# fixed when the run starts and cannot read a file or the current date.
-
-on:
-  schedule:
-    - cron: "0 2 * * *"
-
-permissions:
-  contents: read  # actions/checkout to read the version from esphome/const.py
-
-jobs:
-  trigger:
-    name: Start release build
-    if: github.repository == 'esphome/esphome'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read  # actions/checkout to read the version from esphome/const.py
-      actions: write  # gh workflow run starts release.yml
-    steps:
-      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Start the release workflow
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          VERSION=$(sed -n -E "s/^__version__\s+=\s+\"(.+)\"$/\1/p" esphome/const.py)
-          if [[ -z "$VERSION" ]]; then
-            echo "::error::Could not read __version__ from esphome/const.py"
-            exit 1
-          fi
-          TAG="${VERSION}$(date --utc '+%Y%m%d')"
-          echo "Starting release build for ${TAG}"
-          gh workflow run release.yml --ref "${GITHUB_REF_NAME}" --field tag="${TAG}"

.github/workflows/release.yml

@@ -1,23 +1,12 @@
 ---
 name: Publish Release
 
-# Releases (production and beta) are named after the version they publish.
-# Dev builds are named after the dated dev tag, which is passed in by the
-# nightly workflow because a run name cannot compute it itself.
-run-name: ${{ github.event.inputs.tag || github.event.release.tag_name || format('Manual build ({0})', github.ref_name) }}
-
 on:
   workflow_dispatch:
-    inputs:
-      tag:
-        description: >-
-          Tag to build. Only supported on dev, where the nightly workflow
-          uses it. Leave empty to build the version from esphome/const.py
-          with today's date appended.
-        required: false
-        default: ""
   release:
     types: [published]
+  schedule:
+    - cron: "0 2 * * *"
 
 permissions:
   contents: read  # actions/checkout for all jobs; deploy jobs add their own scopes when they need to write
@@ -31,11 +20,9 @@ jobs:
       branch_build: ${{ steps.tag.outputs.branch_build }}
       deploy_env: ${{ steps.tag.outputs.deploy_env }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Get tag
         id: tag
-        env:
-          INPUT_TAG: ${{ github.event.inputs.tag }}
         # yamllint disable rule:line-length
         run: |
           if [[ "${{ github.event_name }}" = "release" ]]; then
@@ -47,23 +34,12 @@ jobs:
               ENVIRONMENT="production"
             fi
           else
+            TAG=$(cat esphome/const.py | sed -n -E "s/^__version__\s+=\s+\"(.+)\"$/\1/p")
+            today="$(date --utc '+%Y%m%d')"
+            TAG="${TAG}${today}"
             BRANCH=${GITHUB_REF#refs/heads/}
-            # The nightly workflow passes the finished tag so that the run name
-            # matches what is built. Without it, work it out here.
-            TAG="${INPUT_TAG}"
-            if [[ -n "$TAG" && "$BRANCH" != "dev" ]]; then
-              echo "::error::The tag input is only supported on dev. A build from ${BRANCH} has to use the tag worked out here, which carries the branch name, so that it cannot publish over the dev, beta, latest or stable images."
-              exit 1
-            fi
-            if [[ -z "$TAG" ]]; then
-              TAG=$(cat esphome/const.py | sed -n -E "s/^__version__\s+=\s+\"(.+)\"$/\1/p")
-              today="$(date --utc '+%Y%m%d')"
-              TAG="${TAG}${today}"
-              if [[ "$BRANCH" != "dev" ]]; then
-                TAG="${TAG}-${BRANCH}"
-              fi
-            fi
             if [[ "$BRANCH" != "dev" ]]; then
+              TAG="${TAG}-${BRANCH}"
               BRANCH_BUILD="true"
               ENVIRONMENT=""
             else
@@ -84,9 +60,9 @@ jobs:
       contents: read   # actions/checkout to build the sdist/wheel
       id-token: write  # OIDC token for PyPI Trusted Publishing (pypa/gh-action-pypi-publish)
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.x"
       - name: Build
@@ -94,7 +70,7 @@ jobs:
           pip3 install build
           python3 -m build
       - name: Publish
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           skip-existing: true
 
@@ -116,22 +92,22 @@ jobs:
             os: "ubuntu-24.04-arm"
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: "3.12"
+          python-version: "3.11"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to docker hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -192,7 +168,7 @@ jobs:
           - ghcr
           - dockerhub
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Download digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -202,17 +178,17 @@ jobs:
           merge-multiple: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to docker hub
         if: matrix.registry == 'dockerhub'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
         if: matrix.registry == 'ghcr'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/stale.yml

@@ -6,46 +6,61 @@ on:
     - cron: "30 0 * * *"
   workflow_dispatch:
 
-# The reusable workflow authenticates as the ESPHome GitHub App, so GITHUB_TOKEN
-# needs no permissions at all.
-permissions: {}
+permissions:
+  issues: write         # actions/stale labels, comments on, and closes stale issues
+  pull-requests: write  # actions/stale labels, comments on, and closes stale pull requests
+
+concurrency:
+  group: lock
 
 jobs:
   stale:
     if: github.repository_owner == 'esphome'
-    # No GITHUB_TOKEN permissions: the reusable workflow mints an ESPHome
-    # GitHub App token so the labels, comments and closures come from
-    # esphome[bot] instead of github-actions[bot].
-    uses: esphome/workflows/.github/workflows/stale.yml@a1c1485ab46ef41a84a6a9d8abd7fa4b7628fd70  # main
-    secrets:
-      ESPHOME_GITHUB_APP_PRIVATE_KEY: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-    with:
-      # Live only on dev: a workflow_dispatch from any other branch is a dry run
-      dry-run: ${{ github.ref != 'refs/heads/dev' }}
-      days-before-stale: 90
-      days-before-close: 7
-      stale-label: stale
-      exempt-label: not-stale
-      ignored-users: esphbot,codecov-commenter
-      stale-pr-message: >
-        There hasn't been any activity on this pull request recently. This
-        pull request has been automatically marked as stale because of that
-        and will be closed if no further activity occurs within 7 days.
+    runs-on: ubuntu-latest
+    steps:
+      - name: Stale
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        with:
+          debug-only: ${{ github.ref != 'refs/heads/dev' }} # Dry-run when not run on dev branch
+          remove-stale-when-updated: true
+          operations-per-run: 400
 
-        If you are the author of this PR, please leave a comment if you want
-        to keep it open. Also, please rebase your PR onto the latest dev
-        branch to ensure that it's up to date with the latest changes.
+          # The 90 day stale policy for PRs
+          # - PRs
+          # - No PRs marked as "not-stale"
+          # - No Issues (see below)
+          days-before-pr-stale: 90
+          days-before-pr-close: 7
+          stale-pr-label: "stale"
+          exempt-pr-labels: "not-stale"
+          stale-pr-message: >
+            There hasn't been any activity on this pull request recently. This
+            pull request has been automatically marked as stale because of that
+            and will be closed if no further activity occurs within 7 days.
 
-        Thank you for your contribution!
-      stale-issue-message: >
-        There hasn't been any activity on this issue recently. Due to the
-        high number of incoming GitHub notifications, we have to clean some
-        of the old issues, as many of them have already been resolved with
-        the latest updates.
+            If you are the author of this PR, please leave a comment if you want
+            to keep it open. Also, please rebase your PR onto the latest dev
+            branch to ensure that it's up to date with the latest changes.
 
-        Please make sure to update to the latest ESPHome version and
-        check if that solves the issue. Let us know if that works for you by
-        adding a comment 👍
+            Thank you for your contribution!
 
-        This issue has now been marked as stale and will be closed if no
-        further activity occurs. Thank you for your contributions.
+          # The 90 day stale policy for Issues
+          # - Issues
+          # - No Issues marked as "not-stale"
+          # - No PRs (see above)
+          days-before-issue-stale: 90
+          days-before-issue-close: 7
+          stale-issue-label: "stale"
+          exempt-issue-labels: "not-stale"
+          stale-issue-message: >
+            There hasn't been any activity on this issue recently. Due to the
+            high number of incoming GitHub notifications, we have to clean some
+            of the old issues, as many of them have already been resolved with
+            the latest updates.
+
+            Please make sure to update to the latest ESPHome version and
+            check if that solves the issue. Let us know if that works for you by
+            adding a comment 👍
+
+            This issue has now been marked as stale and will be closed if no
+            further activity occurs. Thank you for your contributions.

.github/workflows/status-check-labels.yml

@@ -5,7 +5,7 @@ on:
     types: [opened, reopened, labeled, unlabeled, synchronize]
 
 permissions:
-  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, needs-developer-docs, merge-after-release, chained-pr)
+  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, merge-after-release, chained-pr)
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
@@ -20,7 +20,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const blockingLabels = ['needs-docs', 'needs-developer-docs', 'merge-after-release', 'chained-pr'];
+            const blockingLabels = ['needs-docs', 'merge-after-release', 'chained-pr'];
             const { data: labels } = await github.rest.issues.listLabelsOnIssue({
               owner: context.repo.owner,
               repo: context.repo.repo,

.github/workflows/sync-device-classes.yml

@@ -28,26 +28,26 @@ jobs:
           permission-pull-requests: write  # pulls.create / pulls.update to open or refresh the sync PR
 
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Checkout Home Assistant
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: home-assistant/core
           path: lib/home-assistant
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.14"
 
       - name: Set up uv
         # An order of magnitude faster than pip on cold boots, with its
         # own wheel cache. ``--system`` (below) installs into the
-        # setup-python interpreter so subsequent ``prek`` /
+        # setup-python interpreter so subsequent ``pre-commit`` /
         # ``script/run-in-env.py`` steps find the deps without a
         # ``uv run`` prefix.
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           # Pin uv version so the action does not have to fetch the
@@ -58,19 +58,19 @@ jobs:
       - name: Install Home Assistant
         run: |
           uv pip install --system -e lib/home-assistant
-          uv pip install --system -r requirements.txt -r requirements_test.txt
+          uv pip install --system -r requirements.txt -r requirements_test.txt pre-commit
 
       - name: Sync
         run: |
           python ./script/sync-device_class.py
 
-      - name: Apply prek auto-fixes
+      - name: Apply pre-commit auto-fixes
         # First pass: let formatters (ruff, end-of-file-fixer, etc.) modify
-        # files. prek exits non-zero whenever a hook touches anything,
+        # files. pre-commit exits non-zero whenever a hook touches anything,
         # which would otherwise abort the workflow before the auto-fixes
         # can flow into the sync PR.
         #
-        # PREK_SKIP:
+        # SKIP:
         #   - no-commit-to-branch is a local guard against committing on
         #     dev/release/beta; CI runs on dev by definition, and
         #     peter-evans/create-pull-request creates the branch itself.
@@ -79,25 +79,25 @@ jobs:
         #     the runtime deps (HA + requirements*.txt); main CI already
         #     gates pylint on real PRs.
         env:
-          PREK_SKIP: pylint,no-commit-to-branch
-        run: python script/run-in-env.py prek run --all-files || true
+          SKIP: pylint,no-commit-to-branch
+        run: python script/run-in-env.py pre-commit run --all-files || true
 
-      - name: Verify prek clean
+      - name: Verify pre-commit clean
         # Second pass: re-run all hooks against the now-fixed tree.
         # Auto-fixers exit 0 (nothing to change); any remaining failure
         # from a check-only hook (flake8 / yamllint / ci-custom) is a
-        # real issue and fails the workflow loudly. Same PREK_SKIP list as
+        # real issue and fails the workflow loudly. Same SKIP list as
         # above for the same reasons.
         env:
-          PREK_SKIP: pylint,no-commit-to-branch
-        run: python script/run-in-env.py prek run --all-files
+          SKIP: pylint,no-commit-to-branch
+        run: python script/run-in-env.py pre-commit run --all-files
 
       - name: Commit changes
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           commit-message: "Synchronise Device Classes from Home Assistant"
-          committer: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
-          author: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
+          committer: esphomebot <esphome@openhomefoundation.org>
+          author: esphomebot <esphome@openhomefoundation.org>
           branch: sync/device-classes
           delete-branch: true
           title: "Synchronise Device Classes from Home Assistant"

.gitignore

@@ -133,8 +133,6 @@ CTestTestfile.cmake
 .gcc-flags.json
 
 config/
-# Test fixture config/ directories are tracked (the rule above is the dashboard dir)
-!tests/component_tests/**/config/
 tests/build/
 tests/.esphome/
 /.temp-clang-tidy.cpp

.pre-commit-config.yaml

@@ -11,7 +11,7 @@ ci:
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.16.3
+    rev: v0.15.15
     hooks:
       # Run the linter.
       - id: ruff
@@ -40,7 +40,7 @@ repos:
     rev: v3.21.2
     hooks:
       - id: pyupgrade
-        args: [--py312-plus]
+        args: [--py311-plus]
   - repo: https://github.com/adrienverge/yamllint.git
     rev: v1.37.1
     hooks:

AGENTS.md

@@ -9,7 +9,7 @@ This document provides essential context for AI models interacting with this pro
 
 ## 2. Core Technologies & Stack
 
-*   **Languages:** Python (>=3.12), C++ (gnu++20)
+*   **Languages:** Python (>=3.11), C++ (gnu++20)
 *   **Frameworks & Runtimes:** PlatformIO, Arduino, ESP-IDF.
 *   **Build Systems:** PlatformIO is the primary build system. CMake is used as an alternative.
 *   **Configuration:** YAML.
@@ -57,12 +57,6 @@ This document provides essential context for AI models interacting with this pro
         - Function-local constants: `lower_snake_case`
         - Protected/private fields: `lower_snake_case_with_trailing_underscore_`
         - Favor descriptive names over abbreviations
-        - Enumerator names: prefix every value of an `enum class` with the enum name converted to
-          `UPPER_SNAKE_CASE` (e.g. `UARTFlushResult::UART_FLUSH_RESULT_SUCCESS`). Never use bare
-          names like `SUCCESS`, `FAILURE`, `OK`, or `FAIL`: platform SDK headers define macros with
-          these common names (for example the Realtek SDKs used by LibreTiny define
-          `#define SUCCESS 0` in `basic_types.h`), and the preprocessor replaces the enumerator
-          before the compiler sees it, breaking the build and clang-tidy on those platforms.
 
 *   **Python Idioms:**
     *   **Assignment expressions (PEP 572):** Prefer the walrus operator (`:=`) wherever it removes a redundant lookup or a throwaway temporary. The most common case in component code is presence-checking a config key and then indexing it separately — fetch once with `.get()` and bind in the condition instead:
@@ -197,14 +191,11 @@ This document provides essential context for AI models interacting with this pro
         my_component_ns = cg.esphome_ns.namespace("my_component")
         MyComponent = my_component_ns.class_("MyComponent", cg.Component)
 
-        CONFIG_SCHEMA = cv.Schema(
-            {
-                cv.GenerateID(): cv.declare_id(MyComponent),
-                cv.Required(CONF_KEY): cv.string,
-                cv.Optional(CONF_PARAM, default=42): cv.int_,
-            }
-        ).extend(cv.COMPONENT_SCHEMA)
-
+        CONFIG_SCHEMA = cv.Schema({
+            cv.GenerateID(): cv.declare_id(MyComponent),
+            cv.Required(CONF_KEY): cv.string,
+            cv.Optional(CONF_PARAM, default=42): cv.int_,
+        }).extend(cv.COMPONENT_SCHEMA)
 
         async def to_code(config):
             var = cg.new_Pvariable(config[CONF_ID])
@@ -238,12 +229,7 @@ This document provides essential context for AI models interacting with this pro
         - **Sensor:**
           ```python
           from esphome.components import sensor
-
-          CONFIG_SCHEMA = sensor.sensor_schema(MySensor).extend(
-              cv.polling_component_schema("60s")
-          )
-
-
+          CONFIG_SCHEMA = sensor.sensor_schema(MySensor).extend(cv.polling_component_schema("60s"))
           async def to_code(config):
               var = await sensor.new_sensor(config)
               await cg.register_component(var, config)
@@ -252,10 +238,7 @@ This document provides essential context for AI models interacting with this pro
         - **Binary Sensor:**
           ```python
           from esphome.components import binary_sensor
-
-          CONFIG_SCHEMA = binary_sensor.binary_sensor_schema().extend({...})
-
-
+          CONFIG_SCHEMA = binary_sensor.binary_sensor_schema().extend({ ... })
           async def to_code(config):
               var = await binary_sensor.new_binary_sensor(config)
           ```
@@ -263,10 +246,7 @@ This document provides essential context for AI models interacting with this pro
         - **Switch:**
           ```python
           from esphome.components import switch
-
-          CONFIG_SCHEMA = switch.switch_schema().extend({...})
-
-
+          CONFIG_SCHEMA = switch.switch_schema().extend({ ... })
           async def to_code(config):
               var = await switch.new_switch(config)
           ```
@@ -283,13 +263,10 @@ This document provides essential context for AI models interacting with this pro
         ```python
         from esphome import automation
 
-        CONFIG_SCHEMA = cv.Schema(
-            {
-                cv.GenerateID(): cv.declare_id(MyComponent),
-                cv.Optional(CONF_ON_STATE): automation.validate_automation({}),
-            }
-        ).extend(cv.COMPONENT_SCHEMA)
-
+        CONFIG_SCHEMA = cv.Schema({
+            cv.GenerateID(): cv.declare_id(MyComponent),
+            cv.Optional(CONF_ON_STATE): automation.validate_automation({}),
+        }).extend(cv.COMPONENT_SCHEMA)
 
         async def to_code(config):
             var = cg.new_Pvariable(config[CONF_ID])
@@ -339,14 +316,11 @@ This document provides essential context for AI models interacting with this pro
         ```python
         TurnOnTrigger = my_ns.class_("TurnOnTrigger", automation.Trigger.template())
 
-        CONFIG_SCHEMA = cv.Schema(
-            {
-                cv.Optional(CONF_ON_TURN_ON): automation.validate_automation(
-                    {cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(TurnOnTrigger)}
-                ),
-            }
-        )
-
+        CONFIG_SCHEMA = cv.Schema({
+            cv.Optional(CONF_ON_TURN_ON): automation.validate_automation(
+                {cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(TurnOnTrigger)}
+            ),
+        })
 
         async def to_code(config):
             for conf in config.get(CONF_ON_TURN_ON, []):
@@ -394,10 +368,7 @@ This document provides essential context for AI models interacting with this pro
         ```
         Register with `@automation.register_condition("my_component.is_active", MyCondition, schema)`.
 
-*   **Type Hints:** Type-hint all function signatures, including test functions and config validators (e.g. `def validate_x(config: ConfigType) -> ConfigType:`, `def test_x() -> None:`). Import `ConfigType` from `esphome.types`.
-
 *   **Configuration Validation:**
-    *   **Reuse existing validators:** Before writing a custom validator, check for an existing one in `config_validation.py` and compose it in `cv.All(...)` rather than duplicating logic across components. For example, rename a config key with `cv.rename_key(CONF_OLD, CONF_NEW, removed_in="2026.6.0")`, and reject mutually-exclusive keys with `cv.has_at_most_one_key(...)` / `cv.has_exactly_one_key(...)`. See how `api` composes `cv.has_exactly_one_key` + `cv.rename_key`.
     *   **Common Validators:** `cv.int_`, `cv.float_`, `cv.string`, `cv.boolean`, `cv.int_range(min=0, max=100)`, `cv.positive_int`, `cv.percentage`.
     *   **Complex Validation:** `cv.All(cv.string, cv.Length(min=1, max=50))`, `cv.Any(cv.int_, cv.string)`.
     *   **Platform-Specific:** `cv.only_on(["esp32", "esp8266"])`, `esp32.only_on_variant(...)`, `cv.only_on_esp32`, `cv.only_on_esp8266`, `cv.only_on_rp2040`.
@@ -410,7 +381,6 @@ This document provides essential context for AI models interacting with this pro
          .extend(i2c.i2c_device_schema(0x48))
          .extend(spi.spi_device_schema(cs_pin_required=True))
         ```
-    *   **Constants:** `esphome/const.py` is frozen — do not add new `CONF_` constants there. Define a component-local constant in the component's own `.py` (as with `CONF_PARAM` above); for a constant shared by multiple components, add it to `esphome/components/const/__init__.py`. CI (`lint_constants_usage`) fails if the same constant is defined in three or more component files. Constants used in core files (i.e. those not under `esphome/components`) may be added to `esphome/const.py` but will require adjustment to the CI validation check.
 
 ## 5. Key Files & Entrypoints
 
@@ -418,7 +388,7 @@ This document provides essential context for AI models interacting with this pro
 *   **Configuration:**
     *   `pyproject.toml`: Defines the Python project metadata and dependencies.
     *   `platformio.ini`: Configures the PlatformIO build environments for different microcontrollers.
-    *   `.pre-commit-config.yaml`: Configures the lint and format hooks, run by `prek`.
+    *   `.pre-commit-config.yaml`: Configures the pre-commit hooks for linting and formatting.
 *   **CI/CD Pipeline:** Defined in `.github/workflows`.
 *   **Static Analysis & Development:**
     *   `esphome/core/defines.h`: A comprehensive header file containing all `#define` directives that can be added by components using `cg.add_define()` in Python. This file is used exclusively for development, static analysis tools, and CI testing - it is not used during runtime compilation. When developing components that add new defines, they must be added to this file to ensure proper IDE support and static analysis coverage. The file includes feature flags, build configurations, and platform-specific defines that help static analyzers understand the complete codebase without needing to compile for specific platforms.
@@ -426,7 +396,7 @@ This document provides essential context for AI models interacting with this pro
 ## 6. Development & Testing Workflow
 
 *   **Local Development Environment:** Use the provided Docker container or create a Python virtual environment and install dependencies from `requirements_dev.txt`.
-*   **Running Commands:** Use the `script/run-in-env.py` script to execute commands within the project's virtual environment. For example, to run the linter: `python3 script/run-in-env.py prek run`.
+*   **Running Commands:** Use the `script/run-in-env.py` script to execute commands within the project's virtual environment. For example, to run the linter: `python3 script/run-in-env.py pre-commit run`.
 *   **Testing:**
     *   **Python:** Run unit tests with `pytest`.
     *   **C++:** Use `clang-tidy` for static analysis.
@@ -457,14 +427,13 @@ This document provides essential context for AI models interacting with this pro
 
         When a PR's only edits to a component are `validate.*.yaml` files (no source changes, no `test.*.yaml` changes, and the component isn't pulled in as a dependency of another changed component), CI skips the compile stage for that component entirely and only runs config validation. This is decided in `script/determine-jobs.py` via `_component_change_is_validate_only` and surfaced as the `validate_only_components` output that the `test-build-components-split` job consumes.
 
-    *   **Test Grouping with Packages:** Components that use shared bus packages can be grouped together in CI to reduce build count. **Never define buses (uart, i2c, spi, modbus) directly in test YAML files** — always use packages from `test_build_components/common/`.
-
-        All includes in test files must go through dict-style `packages:` so that batch grouping works correctly — the grouping scripts only understand dict-style packages. Never use list-style packages (`packages: [- !include ...]`) or top-level merge keys (`<<: !include common.yaml`). Bus packages are keyed by the bus name; the component's `common.yaml` is keyed by the component name (e.g. `cst328: !include common.yaml`):
+    *   **Test Grouping with Packages:** Components that use shared bus packages can be grouped together in CI to reduce build count. **Never define buses (uart, i2c, spi, modbus) directly in test YAML files** — always use packages from `test_build_components/common/`:
         ```yaml
-        # test.esp32-idf.yaml — everything included via named packages
+        # test.esp32-idf.yaml — use packages for buses
         packages:
           uart: !include ../../test_build_components/common/uart_115200/esp32-idf.yaml
-          my_component: !include common.yaml
+
+        <<: !include common.yaml
         ```
         ```yaml
         # common.yaml — component config only, NO bus definitions
@@ -499,9 +468,9 @@ This document provides essential context for AI models interacting with this pro
     1.  **Fork & Branch:** Create a new branch based on the `dev` branch (always use `git checkout -b <branch-name> dev` to ensure you're branching from `dev`, not the currently checked out branch).
     2.  **Make Changes:** Adhere to all coding conventions and patterns.
     3.  **Test:** Create component tests for all supported platforms and run the full test suite locally.
-    4.  **Lint:** Run `prek` to ensure code is compliant.
+    4.  **Lint:** Run `pre-commit` to ensure code is compliant.
     5.  **Commit:** Commit your changes. There is no strict format for commit messages.
-    6.  **Pull Request:** Submit a PR against the `dev` branch. The Pull Request title must start with a `[tag]` prefix. For component work, use the component name (e.g., `[display] Fix bug`, `[abc123] Add new component`); for changes to shared/core code that isn't tied to a single component, use `[core]` (e.g., `[core] Add validator`). Update documentation, examples, and add `CODEOWNERS` entries as needed. Pull requests should always be made using the `.github/PULL_REQUEST_TEMPLATE.md` template - fill out all sections completely without removing any parts of the template.
+    6.  **Pull Request:** Submit a PR against the `dev` branch. The Pull Request title should have a prefix of the component being worked on (e.g., `[display] Fix bug`, `[abc123] Add new component`). Update documentation, examples, and add `CODEOWNERS` entries as needed. Pull requests should always be made using the `.github/PULL_REQUEST_TEMPLATE.md` template - fill out all sections completely without removing any parts of the template.
 
 *   **Documentation Contributions:**
     *   Documentation is hosted in the separate `esphome/esphome.io` repository.
@@ -647,7 +616,6 @@ This document provides essential context for AI models interacting with this pro
         _component_state = []
         _use_feature = None
 
-
         def enable_feature():
             global _use_feature
             _use_feature = True
@@ -667,24 +635,20 @@ This document provides essential context for AI models interacting with this pro
 
         DOMAIN = "my_component"
 
-
         @dataclass
         class MyComponentData:
             feature_enabled: bool = False
             item_count: int = 0
             items: list[str] = field(default_factory=list)
 
-
         def _get_data() -> MyComponentData:
             if DOMAIN not in CORE.data:
                 CORE.data[DOMAIN] = MyComponentData()
             return CORE.data[DOMAIN]
 
-
         def request_feature() -> None:
             _get_data().feature_enabled = True
 
-
         def add_item(item: str) -> None:
             _get_data().items.append(item)
         ```
@@ -739,37 +703,9 @@ This document provides essential context for AI models interacting with this pro
     ```
 
 *   **Deprecation Pattern (Python):**
-    For a renamed config key, use the shared `cv.rename_key` validator with `removed_in` (and `component` for context) — it warns and auto-migrates:
-    ```python
-    CONFIG_SCHEMA = cv.All(
-        cv.rename_key(
-            CONF_OLD_KEY, CONF_NEW_KEY, removed_in="2026.6.0", component="my_component"
-        ),
-        cv.Schema({ ... }),
-    )
-    ```
-    For other deprecations, warn manually during validation:
     ```python
     # Remove before 2026.6.0
     if CONF_OLD_KEY in config:
-        _LOGGER.warning(
-            f"'{CONF_OLD_KEY}' deprecated, use '{CONF_NEW_KEY}'. Removed in 2026.6.0"
-        )
+        _LOGGER.warning(f"'{CONF_OLD_KEY}' deprecated, use '{CONF_NEW_KEY}'. Removed in 2026.6.0")
         config[CONF_NEW_KEY] = config.pop(CONF_OLD_KEY)  # Auto-migrate
     ```
-## 9. English Language
-
-The project uses English for non-code content. When drafting documentation, code comments, commit messages,
-PR descriptions, and similar text, avoid technical jargon. Instead, express concepts in plain English,
-using standard technical terms only when required. Ensure the text is readily comprehensible to a wide
-audience, including non-native English speakers.
-
-## 10. Code Comments
-
-Code comments on individual lines should be used only where necessary to flag issues that may not be obvious
-on a simple reading of the code. Keep them short (e.g. 1 or 2 lines).
-
-Function and method comment blocks may include more detail as required to make
-calling contracts clear and document parameter usage, but should still be kept concise.
-
-Avoid redundancy and repetition; comments should never simply restate what the code already says.

CODEOWNERS

@@ -69,16 +69,12 @@ esphome/components/bh1750/* @OttoWinter
 esphome/components/bh1900nux/* @B48D81EFCC
 esphome/components/binary_sensor/* @esphome/core
 esphome/components/bk72xx/* @kuba2k2
-esphome/components/bk72xx_ble/* @Bl00d-B0b
-esphome/components/bk72xx_ble_tracker/* @Bl00d-B0b
 esphome/components/bl0906/* @athom-tech @jesserockz @tarontop
 esphome/components/bl0939/* @ziceva
 esphome/components/bl0940/* @dan-s-github @tobias-
 esphome/components/bl0942/* @dbuezas @dwmw2
 esphome/components/ble_client/* @buxtronix @clydebarrow
-esphome/components/ble_device_base/* @Bl00d-B0b
 esphome/components/ble_nus/* @tomaszduda23
-esphome/components/bluetooth_connection/* @bdraco @jesserockz
 esphome/components/bluetooth_proxy/* @bdraco @jesserockz
 esphome/components/bm8563/* @abmantis
 esphome/components/bme280_base/* @esphome/core
@@ -126,9 +122,7 @@ esphome/components/cover/* @esphome/core
 esphome/components/cs5460a/* @balrog-kun
 esphome/components/cse7761/* @berfenger
 esphome/components/cst226/* @clydebarrow
-esphome/components/cst328/* @latonita
 esphome/components/cst816/* @clydebarrow
-esphome/components/cst9220/* @clydebarrow
 esphome/components/ct_clamp/* @jesserockz
 esphome/components/current_based/* @djwmarcx
 esphome/components/dac7678/* @NickB1
@@ -149,7 +143,6 @@ esphome/components/dlms_meter/* @latonita @PolarGoose @SimonFischer04 @Tomer27cz
 esphome/components/dps310/* @kbx81
 esphome/components/ds1307/* @badbadc0ffee
 esphome/components/ds2484/* @mrk-its
-esphome/components/ds248x/* @tomwellnitz
 esphome/components/dsmr/* @glmnet @PolarGoose
 esphome/components/duty_time/* @dudanov
 esphome/components/ee895/* @Stock-M
@@ -192,7 +185,6 @@ esphome/components/ezo_pmp/* @carlos-sarmiento
 esphome/components/factory_reset/* @anatoly-savchenkov
 esphome/components/fastled_base/* @OttoWinter
 esphome/components/feedback/* @ianchi
-esphome/components/file/* @esphome/core
 esphome/components/fingerprint_grow/* @alexborro @loongyh @OnFreund
 esphome/components/font/* @clydebarrow @esphome/core
 esphome/components/fs3000/* @kahrendt
@@ -214,7 +206,6 @@ esphome/components/gree/switch/* @nagyrobi
 esphome/components/grove_gas_mc_v2/* @YorkshireIoT
 esphome/components/grove_tb6612fng/* @max246
 esphome/components/growatt_solar/* @leeuwte
-esphome/components/gsl3670/* @clydebarrow
 esphome/components/gt911/* @clydebarrow @jesserockz
 esphome/components/haier/* @paveldn
 esphome/components/haier/binary_sensor/* @paveldn
@@ -238,7 +229,6 @@ esphome/components/hlw8032/* @rici4kubicek
 esphome/components/hm3301/* @freekode
 esphome/components/hmac_md5/* @dwmw2
 esphome/components/hmac_sha256/* @dwmw2
-esphome/components/hoermann_hcp/* @zweckj
 esphome/components/homeassistant/* @esphome/core @OttoWinter
 esphome/components/homeassistant/number/* @landonr
 esphome/components/homeassistant/switch/* @Links2004
@@ -276,7 +266,6 @@ esphome/components/integration/* @OttoWinter
 esphome/components/internal_temperature/* @Mat931
 esphome/components/interval/* @esphome/core
 esphome/components/ir_rf_proxy/* @kbx81
-esphome/components/it8951/* @koosoli @limengdu @Passific
 esphome/components/jsn_sr04t/* @Mafus1
 esphome/components/json/* @esphome/core
 esphome/components/kamstrup_kmp/* @cfeenstra1024
@@ -290,7 +279,6 @@ esphome/components/ld2412/* @Rihan9
 esphome/components/ld2420/* @descipher
 esphome/components/ld2450/* @hareeshmu
 esphome/components/ld24xx/* @kbx81
-esphome/components/ld6002b/* @hepter
 esphome/components/ledc/* @OttoWinter
 esphome/components/libretiny/* @kuba2k2
 esphome/components/libretiny_pwm/* @kuba2k2
@@ -298,8 +286,6 @@ esphome/components/light/* @esphome/core
 esphome/components/lightwaverf/* @max246
 esphome/components/lilygo_t5_47/touchscreen/* @jesserockz
 esphome/components/lm75b/* @beormund
-esphome/components/ln882h_ble/* @Bl00d-B0b
-esphome/components/ln882h_ble_tracker/* @Bl00d-B0b
 esphome/components/ln882x/* @lamauny
 esphome/components/lock/* @esphome/core
 esphome/components/logger/* @esphome/core
@@ -354,7 +340,6 @@ esphome/components/mlx90393/* @functionpointer
 esphome/components/mlx90614/* @jesserockz
 esphome/components/mmc5603/* @benhoff
 esphome/components/mmc5983/* @agoode
-esphome/components/modbus_client/* @exciton
 esphome/components/modbus_controller/* @martgras
 esphome/components/modbus_controller/binary_sensor/* @martgras
 esphome/components/modbus_controller/number/* @martgras
@@ -400,7 +385,6 @@ esphome/components/pcm5122/* @remcom
 esphome/components/pi4ioe5v6408/* @jesserockz
 esphome/components/pid/* @OttoWinter
 esphome/components/pipsolar/* @andreashergert1984
-esphome/components/pixoo/* @jesserockz
 esphome/components/pm1006/* @habbie
 esphome/components/pm2005/* @andrewjswan
 esphome/components/pmsa003i/* @sjtrny
@@ -416,12 +400,10 @@ esphome/components/pn7160_i2c/* @jesserockz @kbx81
 esphome/components/pn7160_spi/* @jesserockz @kbx81
 esphome/components/power_supply/* @esphome/core
 esphome/components/preferences/* @esphome/core
-esphome/components/provisioning/* @esphome/core
 esphome/components/psram/* @esphome/core
 esphome/components/pulse_meter/* @cstaahl @stevebaxter @TrentHouliston
 esphome/components/pvvx_mithermometer/* @pasiz
 esphome/components/pylontech/* @functionpointer
-esphome/components/qmi8658/* @clydebarrow
 esphome/components/qmp6988/* @andrewpc
 esphome/components/qr_code/* @wjtje
 esphome/components/qspi_dbi/* @clydebarrow
@@ -439,11 +421,10 @@ esphome/components/rf_bridge/* @jesserockz
 esphome/components/rgbct/* @jesserockz
 esphome/components/ring_buffer/* @kahrendt
 esphome/components/router/speaker/* @kahrendt
-esphome/components/rp2/* @jesserockz
+esphome/components/rp2040/* @jesserockz
 esphome/components/rp2040_ble/* @bdraco
 esphome/components/rp2040_pio_led_strip/* @Papa-DMan
 esphome/components/rp2040_pwm/* @jesserockz
-esphome/components/rp2_ble_tracker/* @bdraco
 esphome/components/rpi_dpi_rgb/* @clydebarrow
 esphome/components/rtl87xx/* @kuba2k2
 esphome/components/rtttl/* @glmnet @ximex
@@ -466,7 +447,6 @@ esphome/components/sen21231/* @shreyaskarnik
 esphome/components/sen5x/* @martgras
 esphome/components/sen6x/* @martgras @mebner86 @tuct
 esphome/components/sendspin/* @kahrendt
-esphome/components/sendspin/image/* @kahrendt
 esphome/components/sendspin/media_player/* @kahrendt
 esphome/components/sendspin/media_source/* @kahrendt
 esphome/components/sendspin/sensor/* @kahrendt
@@ -517,7 +497,6 @@ esphome/components/ssd1331_base/* @kbx81
 esphome/components/ssd1331_spi/* @kbx81
 esphome/components/ssd1351_base/* @kbx81
 esphome/components/ssd1351_spi/* @kbx81
-esphome/components/st7123/* @miniskipper
 esphome/components/st7567_base/* @latonita
 esphome/components/st7567_i2c/* @latonita
 esphome/components/st7567_spi/* @latonita
@@ -635,7 +614,6 @@ esphome/components/xpt2046/touchscreen/* @nielsnl68 @numo68
 esphome/components/xxtea/* @clydebarrow
 esphome/components/zephyr/* @tomaszduda23
 esphome/components/zephyr_mcumgr/ota/* @tomaszduda23
-esphome/components/zephyr_pwm/* @wiomoc
 esphome/components/zhlt01/* @cfeenstra1024
 esphome/components/zigbee/* @luar123 @tomaszduda23
 esphome/components/zio_ultrasonic/* @kahrendt

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.9.0-dev
+PROJECT_NUMBER         = 2026.7.0-dev
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

MANIFEST.in

@@ -6,4 +6,3 @@ recursive-include esphome *.cpp *.h *.tcc *.c
 recursive-include esphome *.py.script
 recursive-include esphome *.jinja
 recursive-include esphome LICENSE.txt
-recursive-include esphome requirements.txt

THREAT_MODEL.md

@@ -79,48 +79,6 @@ These *are* security bugs in this repo, and we want to hear about them privately
 - Flaws that weaken the device's API encryption (Noise), OTA, or web server auth
   below their documented guarantees.
 
-## The web server is an open HTTP API by design
-
-The `web_server` component exposes a plain HTTP interface for viewing and
-controlling entities, and, when the `web_server` OTA platform is enabled, for
-uploading firmware at `/update`. Its only access controls are the optional
-`web_server` `auth:` credentials and the network the device sits on.
-
-When `auth:` is not configured, every endpoint is reachable by any client that
-can reach the device. This is intentional; enabling `web_server` without `auth:`
-is choosing an open control surface, in the same way that running native OTA
-without a password leaves OTA open. The API is documented and is meant to be
-called by other devices, scripts, and pages.
-
-As defense-in-depth, the web server checks the `Origin` header on browser requests
-to its entity control and state endpoints: a request whose `Origin` does not match
-the address the device is served on is rejected, and the `allowed_origins` option
-widens that list. This blocks the common "confused deputy" (CSRF) case where a page
-the operator visits drives the device through their browser. It is **not** an
-authentication boundary: it only constrains browsers. Any client that omits the
-`Origin` header — `curl`, scripts, or other non-browser callers on the same
-network — reaches every endpoint exactly as before. The check also does not cover
-the web OTA `/update` endpoint. The device performs no CSRF-token or `Referer`
-validation. The following are therefore **not** vulnerabilities in this repository:
-
-- Requests without an `Origin` header (for example `curl`) reaching the control
-  endpoints, whether or not `web_server` `auth:` is set.
-- Requests from an origin the operator added to `allowed_origins`.
-- Cross-origin or CSRF firmware upload through the web OTA endpoint (`/update`) when
-  web OTA is enabled without `web_server` `auth:`. The `/update` endpoint is not
-  covered by the `Origin` check; this is the same exposure as running OTA without a
-  password.
-
-The supported defenses are `web_server` `auth:`, protecting OTA (a web password or
-a native OTA password), and keeping devices on a trusted, segmented network. See
-the security best practices guide linked above.
-
-What remains in scope is bypassing `web_server` `auth:` when it *is* configured,
-and any memory-safety or protocol bug in the server reachable without credentials.
-
-This section documents the current design and scope; it is not a judgment that the
-design is optimal or that it will not change.
-
 ## Explicitly out of scope
 
 - Local attackers who already have shell access on the host that runs `esphome`.
@@ -128,10 +86,6 @@ design is optimal or that it will not change.
 - Operator-supplied hostile YAML (covered above — config authoring is trusted).
 - Attacks that require an already-authenticated device peer (someone who already
   holds the API key / OTA / web credentials).
-- Access to the device web server or its web OTA endpoint by non-browser clients
-  (those that send no `Origin` header). The web server is an open HTTP API by
-  design (see above); browser cross-origin requests are blocked by default, but the
-  real controls are `web_server` `auth:` and network isolation.
 - Anything in the dashboard / device-builder — report that in its own repository
   (linked at the top).
 - Deployments where the operator removed protections or exposed credentials. See

docker/Dockerfile

@@ -22,7 +22,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.12.0
+RUN uv pip install --no-cache-dir esphome-device-builder==1.0.19
 
 RUN \
     platformio settings set enable_telemetry No \

docker/docker_entrypoint.sh

@@ -21,11 +21,6 @@ export PLATFORMIO_PLATFORMS_DIR="${pio_cache_base}/platforms"
 export PLATFORMIO_PACKAGES_DIR="${pio_cache_base}/packages"
 export PLATFORMIO_CACHE_DIR="${pio_cache_base}/cache"
 
-# Keep the native toolchain installs on the persistent cache root, not the
-# container's ephemeral user cache dir (re-downloaded on every restart).
-export ESPHOME_ESP_IDF_PREFIX="$(dirname "${pio_cache_base}")/idf"
-export ESPHOME_SDK_NRF_PREFIX="$(dirname "${pio_cache_base}")/sdk-nrf"
-
 # If /build is mounted, use that as the build path
 # otherwise use path in /config (so that builds aren't lost on container restart)
 if [[ -d /build ]]; then

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run

@@ -15,11 +15,6 @@ export PLATFORMIO_PLATFORMS_DIR="${pio_cache_base}/platforms"
 export PLATFORMIO_PACKAGES_DIR="${pio_cache_base}/packages"
 export PLATFORMIO_CACHE_DIR="${pio_cache_base}/cache"
 
-# Keep the native toolchain installs on the persistent /data volume, not the
-# container's ephemeral user cache dir (wiped on every add-on update/restart).
-export ESPHOME_ESP_IDF_PREFIX=/data/cache/idf
-export ESPHOME_SDK_NRF_PREFIX=/data/cache/sdk-nrf
-
 if bashio::config.true 'leave_front_door_open'; then
     export DISABLE_HA_AUTHENTICATION=true
 fi

docker/test_configs/ln882x-arduino.yaml

@@ -2,6 +2,6 @@ esphome:
   name: docker-test-ln882x-arduino
 
 ln882x:
-  board: generic-ln882h
+  board: generic-ln882hki
 
 logger:

esphome/__main__.py

@@ -2,33 +2,39 @@
 import argparse
 from collections.abc import Callable
 from contextlib import suppress
+from datetime import datetime
 import functools
+import getpass
 import importlib
 import logging
 import os
 from pathlib import Path
 import re
+import shutil
+import subprocess
 import sys
 import time
-from typing import TYPE_CHECKING, Protocol
+from typing import Protocol
+
+import argcomplete
 
 # Note: Do not import modules from esphome.components here, as this would
 # cause them to be loaded before external components are processed, resulting
 # in the built-in version being used instead of the external component one.
-from esphome import const, platform_hooks
+from esphome import const
+import esphome.codegen as cg
+from esphome.config import iter_component_configs, read_config, strip_default_ids
 from esphome.const import (
     ALLOWED_NAME_CHARS,
     ARGUMENT_HELP_DEVICE,
-    BUNDLE_EXTENSION,
     CONF_API,
+    CONF_AUTH,
     CONF_BAUD_RATE,
     CONF_BROKER,
     CONF_DEASSERT_RTS_DTR,
     CONF_DISABLED,
-    CONF_DISCOVER_IP,
     CONF_ESPHOME,
     CONF_LEVEL,
-    CONF_LOG,
     CONF_LOG_TOPIC,
     CONF_LOGGER,
     CONF_MDNS,
@@ -42,12 +48,10 @@ from esphome.const import (
     CONF_PORT,
     CONF_SUBSTITUTIONS,
     CONF_TOPIC,
-    CONF_VERSION,
+    CONF_USERNAME,
     CONF_WEB_SERVER,
     CONF_WIFI,
     ENV_NOGITIGNORE,
-    KEY_ESP32,
-    KEY_VARIANT,
     SECRETS_FILES,
     Toolchain,
 )
@@ -55,7 +59,6 @@ from esphome.core import CORE, EsphomeError, coroutine
 from esphome.enum import StrEnum
 from esphome.helpers import get_bool_env, indent, is_ip_address
 from esphome.log import AnsiFore, color, setup_log
-from esphome.stacktrace import LogLineProcessor
 from esphome.types import ConfigType
 from esphome.upload_targets import PortType, get_port_type
 from esphome.util import (
@@ -71,9 +74,6 @@ from esphome.util import (
     safe_print,
 )
 
-if TYPE_CHECKING:
-    import threading
-
 # Keep expensive imports (zeroconf, writer, yaml_util, etc.) out of this
 # module's top level. Every `esphome` invocation — including fast paths
 # like `esphome version` — pays the cost of what's imported here before
@@ -225,9 +225,8 @@ def _discover_mac_suffix_devices() -> list[str] | None:
 
     Returns:
         - ``None`` when discovery isn't applicable (``name_add_mac_suffix`` off,
-          mDNS disabled, or ``CORE.address`` isn't a ``.local`` mDNS address).
-          Callers should then fall back to whatever default OTA address they
-          normally use.
+          mDNS disabled, or ``CORE.address`` is already an IP). Callers should
+          then fall back to whatever default OTA address they normally use.
         - ``[]`` when discovery ran but found nothing. Callers should NOT fall
           back to the base name: with ``name_add_mac_suffix`` enabled, the base
           name by definition doesn't exist on the network.
@@ -237,7 +236,7 @@ def _discover_mac_suffix_devices() -> list[str] | None:
     ``aioesphomeapi`` via :func:`_resolve_network_devices`) reuses the IPs we
     already have without opening a second Zeroconf client.
     """
-    if not (has_name_add_mac_suffix() and has_mdns() and has_mdns_address()):
+    if not (has_name_add_mac_suffix() and has_mdns() and has_non_ip_address()):
         return None
     from esphome.zeroconf import discover_mdns_devices
 
@@ -276,8 +275,8 @@ def _unresolved_default_error(purpose: Purpose, defaults: list[str]) -> str:
         if purpose == Purpose.LOGGING and not has_api():
             return (
                 "Cannot view logs over the network: no 'api:' component is "
-                "configured. Add an 'api:' component, enable MQTT logging, add a "
-                "'web_server:' component, or view logs over USB."
+                "configured. Network log streaming requires the native API; add "
+                "an 'api:' component, enable MQTT logging, or view logs over USB."
             )
         if purpose == Purpose.UPLOADING and not has_ota():
             return (
@@ -317,12 +316,9 @@ def choose_upload_log_host(
                 ]
                 resolved.append(choose_prompt(options, purpose=purpose))
             elif device == "OTA":
-                # Logs can stream over a network transport via the native API
-                # or the web_server HTTP SSE feed.
-                network_logging = has_api() or has_web_server_logging()
                 # ensure IP adresses are used first
                 if is_ip_address(CORE.address) and (
-                    (purpose == Purpose.LOGGING and network_logging)
+                    (purpose == Purpose.LOGGING and has_api())
                     or (purpose == Purpose.UPLOADING and has_ota())
                 ):
                     resolved.extend(_resolve_with_cache(CORE.address, purpose))
@@ -334,11 +330,7 @@ def choose_upload_log_host(
                     if has_mqtt_logging():
                         resolved.append("MQTT")
 
-                    if (
-                        network_logging
-                        and has_non_ip_address()
-                        and has_resolvable_address()
-                    ):
+                    if has_api() and has_non_ip_address() and has_resolvable_address():
                         resolved.extend(_ota_hostnames_for_default(purpose))
 
                 elif purpose == Purpose.UPLOADING:
@@ -362,7 +354,7 @@ def choose_upload_log_host(
     bootsel_permission_error = False
     if (
         purpose == Purpose.UPLOADING
-        and CORE.is_rp2
+        and CORE.is_rp2040
         and (picotool := _find_picotool()) is not None
     ):
         bootsel = detect_rp2040_bootsel(picotool)
@@ -400,7 +392,7 @@ def choose_upload_log_host(
             mqtt_config = CORE.config[CONF_MQTT]
             options.append((f"MQTT ({mqtt_config[CONF_BROKER]})", "MQTT"))
 
-        if has_api() or has_web_server_logging():
+        if has_api():
             add_ota_options()
 
     elif purpose == Purpose.UPLOADING and has_ota():
@@ -409,7 +401,7 @@ def choose_upload_log_host(
     # Show helpful BOOTSEL instructions for RP2040 when no BOOTSEL device is found
     if (
         purpose == Purpose.UPLOADING
-        and CORE.is_rp2
+        and CORE.is_rp2040
         and not any(get_port_type(opt[1]) == PortType.BOOTSEL for opt in options)
     ):
         if bootsel_permission_error:
@@ -493,23 +485,10 @@ def has_web_server_ota() -> bool:
     )
 
 
-def has_web_server_logging() -> bool:
-    """Check if logs can be streamed over the web_server HTTP SSE endpoint.
-
-    The ``web_server`` component exposes a ``/events`` Server-Sent Events
-    stream that carries ``event: log`` frames. This requires version 2+ (the
-    v1 UI has no ``/events`` endpoint) and the ``log`` option enabled (default).
-    """
-    web_conf = CORE.config.get(CONF_WEB_SERVER)
-    if web_conf is None:
-        return False
-    if web_conf.get(CONF_VERSION, 2) == 1:
-        return False
-    return web_conf.get(CONF_LOG, True)
-
-
 def has_mqtt_ip_lookup() -> bool:
     """Check if MQTT is available and IP lookup is supported."""
+    from esphome.components.mqtt import CONF_DISCOVER_IP
+
     if CONF_MQTT not in CORE.config:
         return False
     # Default Enabled
@@ -524,22 +503,17 @@ def has_mdns() -> bool:
 
 
 def has_non_ip_address() -> bool:
-    """Check if ``CORE.address`` is set and is not an IP address."""
+    """Check if CORE.address is set and is not an IP address."""
     return CORE.address is not None and not is_ip_address(CORE.address)
 
 
-def has_mdns_address() -> bool:
-    """Check if ``CORE.address`` is a ``.local`` mDNS hostname."""
-    return CORE.address is not None and CORE.address.endswith(".local")
-
-
 def has_ip_address() -> bool:
-    """Check if ``CORE.address`` is a valid IP address."""
+    """Check if CORE.address is a valid IP address."""
     return CORE.address is not None and is_ip_address(CORE.address)
 
 
 def has_resolvable_address() -> bool:
-    """Check if ``CORE.address`` is resolvable (via mDNS, DNS, or is an IP address)."""
+    """Check if CORE.address is resolvable (via mDNS, DNS, or is an IP address)."""
     # Any address (IP, mDNS hostname, or regular DNS hostname) is resolvable
     # The resolve_ip_address() function in helpers.py handles all types via AsyncResolver
     if CORE.address is None:
@@ -558,7 +532,7 @@ def has_resolvable_address() -> bool:
         return True
 
     # .local mDNS hostnames are only resolvable if mDNS is enabled
-    return not has_mdns_address()
+    return not CORE.address.endswith(".local")
 
 
 def has_name_add_mac_suffix() -> bool:
@@ -570,48 +544,11 @@ def has_name_add_mac_suffix() -> bool:
 
 
 def mqtt_get_ip(
-    config: ConfigType,
-    username: str,
-    password: str,
-    client_id: str,
-    stop_event: "threading.Event | None" = None,
+    config: ConfigType, username: str, password: str, client_id: str
 ) -> list[str]:
     from esphome import mqtt
 
-    return mqtt.get_esphome_device_ip(
-        config, username, password, client_id, stop_event=stop_event
-    )
-
-
-def _add_network_device(device: str, network_devices: list[str]) -> None:
-    """Append a device to the list, expanding it through ``CORE.address_cache``.
-
-    If the hostname is already in the address cache (e.g. populated by mDNS
-    discovery), substitute the cached IPs so aioesphomeapi doesn't open its
-    own Zeroconf to re-resolve it. Duplicates are dropped.
-    """
-    if CORE.address_cache and (cached := CORE.address_cache.get_addresses(device)):
-        network_devices.extend(addr for addr in cached if addr not in network_devices)
-    elif device not in network_devices:
-        network_devices.append(device)
-
-
-def _split_network_devices(devices: list[str]) -> tuple[list[str], bool]:
-    """Split the device list into direct addresses and an MQTT-lookup flag.
-
-    Direct addresses are expanded through ``CORE.address_cache`` and deduped
-    the same way ``_resolve_network_devices`` does; MQTT/MQTTIP magic strings
-    are not resolved, only reported via the returned bool so the caller can
-    defer the broker lookup.
-    """
-    network_devices: list[str] = []
-    has_mqtt_lookup = False
-    for device in devices:
-        if get_port_type(device) in _MQTT_PORT_TYPES:
-            has_mqtt_lookup = True
-        else:
-            _add_network_device(device, network_devices)
-    return network_devices, has_mqtt_lookup
+    return mqtt.get_esphome_device_ip(config, username, password, client_id)
 
 
 def _resolve_network_devices(
@@ -644,47 +581,41 @@ def _resolve_network_devices(
         if port_type in _MQTT_PORT_TYPES:
             # Only resolve MQTT once, even if multiple MQTT entries
             if not mqtt_resolved:
-                mqtt_ips = _mqtt_get_ip_or_warn(
-                    config, args.username, args.password, args.client_id
-                )
-                network_devices.extend(
-                    addr for addr in mqtt_ips if addr not in network_devices
-                )
+                try:
+                    mqtt_ips = mqtt_get_ip(
+                        config, args.username, args.password, args.client_id
+                    )
+                    # pylint can't infer mqtt_get_ip's return through its
+                    # lazy ``from esphome import mqtt`` import, so it flags
+                    # the genexpr below.
+                    network_devices.extend(
+                        addr
+                        for addr in mqtt_ips  # pylint: disable=not-an-iterable
+                        if addr not in network_devices
+                    )
+                except EsphomeError as err:
+                    _LOGGER.warning(
+                        "MQTT IP discovery failed (%s), will try other devices if available",
+                        err,
+                    )
                 mqtt_resolved = True
             continue
 
-        _add_network_device(device, network_devices)
+        # If the hostname is already in the address cache (e.g. populated by
+        # mDNS discovery), substitute the cached IPs so aioesphomeapi doesn't
+        # open its own Zeroconf to re-resolve it.
+        if CORE.address_cache and (cached := CORE.address_cache.get_addresses(device)):
+            network_devices.extend(
+                addr for addr in cached if addr not in network_devices
+            )
+        elif device not in network_devices:
+            # Regular network address or IP - add if not already present
+            network_devices.append(device)
 
     return network_devices
 
 
-def _mqtt_get_ip_or_warn(
-    config: ConfigType,
-    username: str,
-    password: str,
-    client_id: str,
-    stop_event: "threading.Event | None" = None,
-) -> list[str]:
-    """Look up the device IP via MQTT, returning [] with a warning on failure.
-
-    This owns the failure policy for MQTT IP discovery on paths that have
-    other addresses to fall back on: a broker problem must not abort the
-    operation. Also used as the deferred resolver handed to ``run_logs``,
-    where it runs in a worker thread.
-    """
-    try:
-        return mqtt_get_ip(config, username, password, client_id, stop_event=stop_event)
-    except EsphomeError as err:
-        _LOGGER.warning(
-            "MQTT IP discovery failed (%s), will try other devices if available",
-            err,
-        )
-        return []
-
-
 def run_miniterm(config: ConfigType, port: str, args) -> int:
-    from datetime import datetime
-
     from aioesphomeapi import LogParser
     import serial
 
@@ -697,9 +628,18 @@ def run_miniterm(config: ConfigType, port: str, args) -> int:
         return 1
     _LOGGER.info("Starting log output from %s with baud rate %s", port, baud_rate)
 
-    # Decoder resolution, crash isolation, and disable-after-failure
-    # all live in LogLineProcessor, shared with the API log path.
-    processor = LogLineProcessor(config, CORE.target_platform)
+    process_stacktrace = None
+
+    try:
+        module = importlib.import_module("esphome.components." + CORE.target_platform)
+        process_stacktrace = module.process_stacktrace
+    except (AttributeError, ImportError):
+        _LOGGER.info(
+            'Stacktrace analysis is unavailable: no compatible analyzer found for target platform "%s".',
+            CORE.target_platform,
+        )
+
+    backtrace_state = False
     ser = serial.Serial()
     ser.baudrate = baud_rate
     ser.port = port
@@ -739,7 +679,11 @@ def run_miniterm(config: ConfigType, port: str, args) -> int:
                                 "utf8", "backslashreplace"
                             )
                             safe_print(parser.parse_line(line, time_str))
-                            processor.process_line(line)
+
+                            if process_stacktrace is not None:
+                                backtrace_state = process_stacktrace(
+                                    config, line, backtrace_state
+                                )
                     except serial.SerialException:
                         _LOGGER.error("Serial port closed!")
                         return 0
@@ -754,8 +698,6 @@ def run_miniterm(config: ConfigType, port: str, args) -> int:
 
 
 def _wrap_to_code(name, comp, yaml_util):
-    import esphome.codegen as cg
-
     coro = coroutine(comp.to_code)
 
     @functools.wraps(comp.to_code)
@@ -791,7 +733,6 @@ def write_cpp(config: ConfigType) -> int:
 
 def generate_cpp_contents(config: ConfigType) -> None:
     from esphome import yaml_util
-    from esphome.config import iter_component_configs
 
     _LOGGER.info("Generating C++ source...")
 
@@ -829,13 +770,6 @@ def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
 
         check_placeholder_credentials(config)
 
-    # Keep this here, NOT in codegen: config-hash and --only-generate must keep
-    # working on machines that cannot run the toolchain.
-    if CORE.is_esp8266:
-        from esphome.components.esp8266 import check_rosetta
-
-        check_rosetta()
-
     # NOTE: "Build path:" format is parsed by script/ci_memory_impact_extract.py
     # If you change this format, update the regex in that script as well
     _LOGGER.info("Compiling app... Build path: %s", CORE.build_path)
@@ -984,10 +918,9 @@ def upload_using_esptool(
 
     mcu = "esp8266"
     if CORE.is_esp32:
-        # Same lookup as esp32.get_esp32_variant(), read directly so the
-        # serial upload path does not import the esp32 package; both the
-        # validator and the warm-cache apply_to_core populate this key.
-        mcu = CORE.data[KEY_ESP32][KEY_VARIANT].lower()
+        from esphome.components.esp32 import get_esp32_variant
+
+        mcu = get_esp32_variant().lower()
 
     line_callbacks: list[Callable[[str], str | None]] = []
     if (
@@ -1041,14 +974,12 @@ def upload_using_esptool(
 
 
 def upload_using_platformio(config: ConfigType, port: str) -> int:
-    import shutil
-
     from esphome.platformio import toolchain
 
     # RP2040 platform-raspberrypi build recipe expects firmware.bin.signed for
     # the upload target, but 'nobuild' skips the build phase that creates it.
     # Create it here so the upload doesn't fail.
-    if CORE.is_rp2:
+    if CORE.is_rp2040:
         idedata = toolchain.get_idedata(config)
         build_dir = Path(idedata.firmware_elf_path).parent
         firmware_bin = build_dir / "firmware.bin"
@@ -1080,8 +1011,6 @@ def upload_using_picotool(config: ConfigType) -> int:
     the mass storage copy approach that causes "disk not ejected properly"
     warnings on macOS.
     """
-    import subprocess
-
     from esphome.platformio import toolchain
 
     idedata = toolchain.get_idedata(config)
@@ -1188,8 +1117,6 @@ def check_permissions(port: str):
                 "the USB cable can be used for data and is not a power-only cable."
             )
         if not (os.access(port, os.R_OK | os.W_OK)):
-            import getpass
-
             raise EsphomeError(
                 "You do not have read or write permission on the selected serial port. "
                 "To resolve this issue, you can add your user to the dialout group "
@@ -1202,11 +1129,12 @@ def upload_program(
     config: ConfigType, args: ArgsProtocol, devices: list[str]
 ) -> tuple[int, str | None]:
     host = devices[0]
-    platform_upload = platform_hooks.get_platform_hook(
-        CORE.target_platform, "upload_program"
-    )
-    if platform_upload is not None and platform_upload(config, args, host):
-        return 0, host
+    try:
+        module = importlib.import_module("esphome.components." + CORE.target_platform)
+        if module.upload_program(config, args, host):
+            return 0, host
+    except AttributeError:
+        pass
 
     port_type = get_port_type(host)
 
@@ -1239,7 +1167,7 @@ def upload_program(
         if CORE.is_esp32 or CORE.is_esp8266:
             file = getattr(args, "file", None)
             exit_code = upload_using_esptool(config, host, file, args.upload_speed)
-        elif CORE.is_rp2 or CORE.is_libretiny:
+        elif CORE.is_rp2040 or CORE.is_libretiny:
             exit_code = upload_using_platformio(config, host)
         # else: Unknown target platform, exit_code remains 1
 
@@ -1357,23 +1285,25 @@ def _upload_via_native_api(
 def _upload_via_web_server(
     config: ConfigType, network_devices: list[str], binary: Path
 ) -> tuple[int, str | None]:
+    web_conf = config.get(CONF_WEB_SERVER)
+    if not web_conf:
+        raise EsphomeError(
+            f"Cannot upload via web_server OTA: the {CONF_WEB_SERVER} component "
+            f"is not configured."
+        )
+
+    remote_port = int(web_conf[CONF_PORT])
+    auth = web_conf.get(CONF_AUTH) or {}
+    username = auth.get(CONF_USERNAME)
+    password = auth.get(CONF_PASSWORD)
+
     from esphome import web_server_ota
-    from esphome.web_server_helpers import get_web_server_connection
 
-    remote_port, username, password = get_web_server_connection(config)
     return web_server_ota.run_ota(
         network_devices, remote_port, username, password, binary
     )
 
 
-def _show_logs_via_web_server(config: ConfigType, network_devices: list[str]) -> int:
-    from esphome import web_server_logs
-    from esphome.web_server_helpers import get_web_server_connection
-
-    port, username, password = get_web_server_connection(config)
-    return web_server_logs.run_logs(network_devices, port, username, password)
-
-
 # Layout of esp_partition_info_t on flash. Each entry is 32 bytes, leading with a
 # 16-bit little-endian magic. ESP-IDF defines ESP_PARTITION_MAGIC = 0x50AA (stored as
 # bytes 0xAA, 0x50) for partition entries and ESP_PARTITION_MAGIC_MD5 = 0xEBEB for the
@@ -1464,11 +1394,12 @@ def _should_subscribe_states(args: ArgsProtocol) -> bool:
 
 
 def show_logs(config: ConfigType, args: ArgsProtocol, devices: list[str]) -> int | None:
-    platform_show_logs = platform_hooks.get_platform_hook(
-        CORE.target_platform, "show_logs"
-    )
-    if platform_show_logs is not None and platform_show_logs(config, args, devices):
-        return 0
+    try:
+        module = importlib.import_module("esphome.components." + CORE.target_platform)
+        if module.show_logs(config, args, devices):
+            return 0
+    except AttributeError:
+        pass
 
     if "logger" not in config:
         raise EsphomeError("Logger is not configured!")
@@ -1482,37 +1413,17 @@ def show_logs(config: ConfigType, args: ArgsProtocol, devices: list[str]) -> int
         return run_miniterm(config, port, args)
 
     # Check if we should use API for logging
-    if has_api():
-        network_devices, has_mqtt_lookup = _split_network_devices(devices)
-        mqtt_resolver = None
-        if has_mqtt_lookup:
-            if network_devices:
-                # Addresses are already known, so don't block startup on the
-                # MQTT broker lookup; hand it to run_logs as a deferred
-                # resolver that runs in the background and feeds discovered
-                # addresses into the running log client, keeping MQTT as a
-                # fallback for when the known addresses are stale (e.g. DHCP
-                # reassigned the IP).
-                mqtt_resolver = functools.partial(
-                    _mqtt_get_ip_or_warn,
-                    config,
-                    args.username,
-                    args.password,
-                    args.client_id,
-                )
-            else:
-                # The MQTT lookup is the only way to find the device; resolve
-                # it up front since the client needs an address to start with.
-                network_devices = _resolve_network_devices(devices, config, args)
-        if network_devices:
-            from esphome.api_client import run_logs
+    # Resolve MQTT magic strings to actual IP addresses
+    if has_api() and (
+        network_devices := _resolve_network_devices(devices, config, args)
+    ):
+        from esphome.components.api.client import run_logs
 
-            return run_logs(
-                config,
-                network_devices,
-                subscribe_states=_should_subscribe_states(args),
-                mqtt_resolver=mqtt_resolver,
-            )
+        return run_logs(
+            config,
+            network_devices,
+            subscribe_states=_should_subscribe_states(args),
+        )
 
     if port_type in (PortType.NETWORK, PortType.MQTT) and has_mqtt_logging():
         from esphome import mqtt
@@ -1521,13 +1432,6 @@ def show_logs(config: ConfigType, args: ArgsProtocol, devices: list[str]) -> int
             config, args.topic, args.username, args.password, args.client_id
         )
 
-    # Fall back to the web_server HTTP SSE log stream for devices that have
-    # web_server: but no api: (the logging counterpart to web_server OTA).
-    if has_web_server_logging() and (
-        network_devices := _resolve_network_devices(devices, config, args)
-    ):
-        return _show_logs_via_web_server(config, network_devices)
-
     raise EsphomeError("No remote or local logging method configured (api/mqtt/logger)")
 
 
@@ -1547,7 +1451,6 @@ def command_wizard(args: ArgsProtocol) -> int | None:
 
 def command_config(args: ArgsProtocol, config: ConfigType) -> int | None:
     from esphome import yaml_util
-    from esphome.config import strip_default_ids
 
     if getattr(args, "no_defaults", False):
         user_config = getattr(config, "user_config", None)
@@ -1585,37 +1488,12 @@ _LEGACY_REDACTION_REMOVAL = "2026.12.0"
 
 def _redact_with_legacy_fallback(output: str) -> str:
     unmarked: set[str] = set()
-    # Track the top-level ``substitutions:`` block. Its keys are arbitrary
-    # user-chosen names with no schema validator, so the ``cv.sensitive(...)``
-    # migration named in the warning can't be applied to them. Their values are
-    # still redacted, but emitting the (unactionable) deprecation warning would
-    # only confuse users.
-    in_substitutions = False
 
-    lines = output.split("\n")
-    for i, line in enumerate(lines):
-        # A non-indented, non-blank line is a top-level key that opens or
-        # closes the substitutions block.
-        if line and not line[0].isspace():
-            in_substitutions = line.startswith(f"{CONF_SUBSTITUTIONS}:")
-        m = _LEGACY_REDACTION_RE.search(line)
-        if m is None:
-            continue
-        key = m.group("key")
-        if not in_substitutions:
-            # Public keys (e.g. wireguard's peer_public_key) are not secret;
-            # redacting them and telling maintainers to mark them cv.sensitive
-            # would be wrong on both counts. Substitution keys are user-named
-            # with no schema behind them, so anything secret-shaped there
-            # (public or not) stays conservatively redacted.
-            if "public" in key.split("_"):
-                continue
-            unmarked.add(key)
-        lines[i] = (
-            f"{line[: m.start()]}{key}: "
-            f"\\033[8m{m.group('val')}\\033[28m{line[m.end() :]}"
-        )
-    output = "\n".join(lines)
+    def _replace(m: re.Match[str]) -> str:
+        unmarked.add(m.group("key"))
+        return f"{m.group('key')}: \\033[8m{m.group('val')}\\033[28m"
+
+    output = _LEGACY_REDACTION_RE.sub(_replace, output)
     for key in sorted(unmarked):
         _LOGGER.warning(
             "Field '%s' is being redacted by a legacy substring heuristic. "
@@ -1746,7 +1624,7 @@ def command_run(args: ArgsProtocol, config: ConfigType) -> int | None:
 
     # After BOOTSEL upload, wait for a new serial port to appear
     # so it shows up in the log chooser
-    if successful_device is None and CORE.is_rp2:
+    if successful_device is None and CORE.is_rp2040:
         _wait_for_serial_port(known_ports=pre_upload_ports)
         # If exactly one new serial port appeared, use it directly
         serial_ports = get_serial_ports()
@@ -1797,7 +1675,7 @@ def command_clean(args: ArgsProtocol, config: ConfigType) -> int | None:
 
 
 def command_bundle(args: ArgsProtocol, config: ConfigType) -> int | None:
-    from esphome.bundle import ConfigBundleCreator
+    from esphome.bundle import BUNDLE_EXTENSION, ConfigBundleCreator
 
     creator = ConfigBundleCreator(config)
 
@@ -2032,7 +1910,7 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
     new_name = args.name
     for c in new_name:
         if c not in ALLOWED_NAME_CHARS:
-            safe_print(
+            print(
                 color(
                     AnsiFore.BOLD_RED,
                     f"'{c}' is an invalid character for names. Valid characters are: "
@@ -2045,7 +1923,7 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
 
     yaml = yaml_util.load_yaml(CORE.config_path)
     if CONF_ESPHOME not in yaml or CONF_NAME not in yaml[CONF_ESPHOME]:
-        safe_print(
+        print(
             color(
                 AnsiFore.BOLD_RED, "Complex YAML files cannot be automatically renamed."
             )
@@ -2092,9 +1970,7 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
             )
             > 1
         ):
-            safe_print(
-                color(AnsiFore.BOLD_RED, "Too many matches in YAML to safely rename")
-            )
+            print(color(AnsiFore.BOLD_RED, "Too many matches in YAML to safely rename"))
             return 1
 
         new_raw = re.sub(
@@ -2112,7 +1988,7 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
     # ``kitchen``; running ``esphome rename weird-file.yaml kitchen``
     # would otherwise just re-flash the same hostname).
     if new_name == old_name:
-        safe_print(
+        print(
             color(
                 AnsiFore.BOLD_RED,
                 f"'{new_name}' is already the device's name.",
@@ -2122,7 +1998,7 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
 
     new_path: Path = CORE.config_dir / (new_name + ".yaml")
     if new_path.resolve() == CORE.config_path.resolve():
-        safe_print(
+        print(
             color(
                 AnsiFore.BOLD_RED,
                 f"'{new_name}' is already the device's name.",
@@ -2130,7 +2006,7 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
         )
         return 1
     if new_path.exists():
-        safe_print(
+        print(
             color(
                 AnsiFore.BOLD_RED,
                 f"Cannot rename: {new_path} already exists. "
@@ -2138,7 +2014,7 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
             )
         )
         return 1
-    safe_print(
+    print(
         f"Updating {color(AnsiFore.CYAN, str(CORE.config_path))} to {color(AnsiFore.CYAN, str(new_path))}"
     )
     print()
@@ -2147,7 +2023,7 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
 
     rc = run_external_process(*ESPHOME_COMMAND, "config", str(new_path))
     if rc != 0:
-        safe_print(color(AnsiFore.BOLD_RED, "Rename failed. Reverting changes."))
+        print(color(AnsiFore.BOLD_RED, "Rename failed. Reverting changes."))
         new_path.unlink()
         return 1
 
@@ -2173,7 +2049,7 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
     if CORE.config_path != new_path:
         CORE.config_path.unlink()
 
-    safe_print(color(AnsiFore.BOLD_GREEN, "SUCCESS"))
+    print(color(AnsiFore.BOLD_GREEN, "SUCCESS"))
     print()
     return 0
 
@@ -2493,10 +2369,7 @@ def parse_args(argv):
     )
 
     parser_clean_all = subparsers.add_parser(
-        "clean-all",
-        help="Clean all build and platform files, including machine-global "
-        "toolchain caches shared by all configurations, so other projects will "
-        "re-download them on next build.",
+        "clean-all", help="Clean all build and platform files."
     )
     parser_clean_all.add_argument(
         "configuration", help="Your YAML file or configuration directory.", nargs="*"
@@ -2584,12 +2457,7 @@ def parse_args(argv):
     # a deprecation warning).
     arguments = argv[1:]
 
-    # argcomplete only does anything when the shell-completion machinery
-    # invokes us with _ARGCOMPLETE set; skip the import otherwise.
-    if "_ARGCOMPLETE" in os.environ:
-        import argcomplete
-
-        argcomplete.autocomplete(parser)
+    argcomplete.autocomplete(parser)
 
     if len(arguments) > 0 and arguments[0] in SIMPLE_CONFIG_ACTIONS:
         args, unknown_args = parser.parse_known_args(arguments)
@@ -2600,49 +2468,6 @@ def parse_args(argv):
     return parser.parse_args(arguments)
 
 
-def _warn_if_source_tree_mismatch() -> None:
-    """Warn when the checkout the user is standing in is not the one being run.
-
-    An editable install records one absolute path, so a venv shared between git
-    worktrees (or reused after a checkout is copied or renamed) keeps importing
-    the tree it was installed from. Every command then silently runs, and
-    compiles, sources the user is not looking at. Only fires inside a checkout,
-    so ordinary installs never see it.
-    """
-    try:
-        cwd = Path.cwd()
-    except OSError:
-        return  # working directory is gone; a diagnostic must not break startup
-    for candidate in (cwd, *cwd.parents):
-        if (candidate / "esphome" / "__main__.py").is_file():
-            standing_in = candidate.resolve()
-            break
-    else:
-        return  # not inside a checkout; nothing to compare against
-
-    running = Path(__file__).resolve().parent.parent
-    # Both sides are resolved, so on a case-sensitive filesystem this matches
-    # plain equality. samefile() compares device and inode, which additionally
-    # covers a case-insensitive filesystem (macOS) reaching one directory by
-    # differently cased paths. Falls back to equality if either path is gone.
-    try:
-        same = standing_in.samefile(running)
-    except OSError:
-        same = standing_in == running
-    if same:
-        return
-
-    _LOGGER.warning(
-        "Running ESPHome from a different checkout than the one you are in:\n"
-        "  running from: %s\n"
-        "  you are in:   %s\n"
-        "The installed esphome resolves to the first, so its sources are used.\n"
-        "Run 'python -m esphome' from the second to use that one instead.",
-        running,
-        standing_in,
-    )
-
-
 def run_esphome(argv):
     from esphome.address_cache import AddressCache
 
@@ -2661,7 +2486,6 @@ def run_esphome(argv):
         args.log_level = "CRITICAL"
 
     setup_log(log_level=args.log_level)
-    _warn_if_source_tree_mismatch()
 
     if args.command in PRE_CONFIG_ACTIONS:
         try:
@@ -2693,11 +2517,10 @@ def run_esphome(argv):
         return 0
 
     # Bundle support: if the configuration is a .esphomebundle, extract it
-    # and rewrite conf_path to the extracted YAML config. The suffix check
-    # stays inline so the ordinary run never imports esphome.bundle.
-    if conf_path.name.lower().endswith(BUNDLE_EXTENSION):
-        from esphome.bundle import prepare_bundle_for_compile
+    # and rewrite conf_path to the extracted YAML config.
+    from esphome.bundle import is_bundle_path, prepare_bundle_for_compile
 
+    if is_bundle_path(conf_path):
         _LOGGER.info("Extracting config bundle %s...", conf_path)
         conf_path = prepare_bundle_for_compile(conf_path)
         # Update the argument so downstream code sees the extracted path
@@ -2732,35 +2555,31 @@ def run_esphome(argv):
                 conf_path.name,
             )
 
-    cache_missed = config is None
-    if cache_missed:
-        from esphome.config import read_config
-
+    if config is None:
         config = read_config(
             command_line_substitutions,
             skip_external_update=skip_external,
-            # Snapshot only needed by `esphome config --no-defaults`.
-            snapshot_user_config=getattr(args, "no_defaults", False),
         )
-        if config is None:
-            return 2
+        # Refresh the cache so the next upload/logs hits the fast path
+        # instead of re-running read_config. Skip when the storage
+        # sidecar is absent (no compile has run): the cache would
+        # never be loaded back, so writing secrets to disk is wasted.
+        if cache_eligible and config is not None:
+            from esphome.compiled_config import save_compiled_config
+            from esphome.storage_json import ext_storage_path
+
+            if ext_storage_path(conf_path.name).exists():
+                save_compiled_config(config)
+    if config is None:
+        return 2
     CORE.config = config
 
     # Fallback for platforms whose validators didn't set the toolchain
     # (only the esp32 component reads esp32.framework.toolchain). All
-    # other platforms only support PlatformIO today. Must run before the
-    # cache refresh below so its sidecar records the same toolchain a
-    # compile would.
+    # other platforms only support PlatformIO today.
     if CORE.toolchain is None:
         CORE.toolchain = Toolchain.PLATFORMIO
 
-    # Refresh the cache so the next upload/logs hits the fast path
-    # instead of re-running read_config.
-    if cache_eligible and cache_missed:
-        from esphome.compiled_config import save_compiled_config_and_sidecar
-
-        save_compiled_config_and_sidecar(config)
-
     if args.command not in POST_CONFIG_ACTIONS:
         safe_print(f"Unknown command {args.command}")
         return 1

esphome/analyze_memory/cli.py

@@ -20,7 +20,6 @@ from . import (
     RAM_SECTIONS,
     MemoryAnalyzer,
 )
-from .toolchain import find_elf_path, find_idedata_path, idedata_candidates
 
 if TYPE_CHECKING:
     from . import ComponentMemory
@@ -760,25 +759,45 @@ def main():
         print(f"Error: {build_path} is not a directory", file=sys.stderr)
         sys.exit(1)
 
-    elf_path = find_elf_path(build_path)
-    if not elf_path:
-        print(f"Error: no firmware ELF found in {build_dir}", file=sys.stderr)
+    # Find firmware.elf
+    elf_file = None
+    for elf_candidate in [
+        build_path / "firmware.elf",
+        build_path / ".pioenvs" / build_path.name / "firmware.elf",
+    ]:
+        if elf_candidate.exists():
+            elf_file = str(elf_candidate)
+            break
+
+    if not elf_file:
+        print(f"Error: firmware.elf not found in {build_dir}", file=sys.stderr)
         sys.exit(1)
-    elf_file = str(elf_path)
+
+    # Find idedata.json - check current directory first, then home
+    device_name = build_path.name
+    idedata_candidates = [
+        Path.cwd() / ".esphome" / "idedata" / f"{device_name}.json",
+        Path.home() / ".esphome" / "idedata" / f"{device_name}.json",
+    ]
 
     idedata = None
-    if idedata_path := find_idedata_path(build_path):
+    for idedata_path in idedata_candidates:
+        if not idedata_path.exists():
+            continue
         try:
             with idedata_path.open(encoding="utf-8") as f:
                 raw_data = json.load(f)
             idedata = IDEData(raw_data)
             print(f"Loaded idedata from: {idedata_path}", file=sys.stderr)
+            break
         except (json.JSONDecodeError, OSError) as e:
             print(f"Warning: Failed to load idedata: {e}", file=sys.stderr)
 
     if not idedata:
-        searched = "\n  ".join(str(p) for p in idedata_candidates(build_path))
-        print(f"Warning: idedata not found, searched:\n  {searched}", file=sys.stderr)
+        print(
+            f"Warning: idedata not found (searched {idedata_candidates[0]} and {idedata_candidates[1]})",
+            file=sys.stderr,
+        )
 
     analyzer = MemoryAnalyzerCLI(elf_file, idedata=idedata)
     analyzer.analyze()

esphome/analyze_memory/ram_strings.py

@@ -8,7 +8,7 @@ memory-constrained platforms like ESP8266.
 from __future__ import annotations
 
 from collections import defaultdict
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 import logging
 from pathlib import Path
 import re
@@ -65,7 +65,6 @@ class RamSymbol:
     size: int
     section: str
     demangled: str = ""  # Demangled name, set after batch demangling
-    aliases: list[str] = field(default_factory=list)  # Other names at same address
 
 
 class RamStringsAnalyzer:
@@ -236,11 +235,6 @@ class RamStringsAnalyzer:
         except (subprocess.CalledProcessError, FileNotFoundError):
             return
 
-        # Track symbols by address so aliases (multiple names for the same
-        # object, e.g. the newlib __lock___* mutexes that all alias one
-        # StaticSemaphore_t) are reported once instead of once per name.
-        symbols_by_addr: dict[int, RamSymbol] = {}
-
         for line in output.split("\n"):
             parts = line.split()
             if len(parts) < 4:
@@ -259,18 +253,6 @@ class RamStringsAnalyzer:
             if sym_type not in DATA_SYMBOL_TYPES:
                 continue
 
-            if (existing := symbols_by_addr.get(addr)) is not None:
-                # Prefer a global (uppercase type) name as the primary so
-                # nm output order can't hide it behind a local alias.
-                if sym_type.isupper() and existing.sym_type.islower():
-                    existing.aliases.append(existing.name)
-                    existing.name = name
-                    existing.sym_type = sym_type
-                else:
-                    existing.aliases.append(name)
-                existing.size = max(existing.size, size)
-                continue
-
             # Check if symbol is in a RAM section
             for section_name in self.ram_sections:
                 if section_name not in self.sections:
@@ -278,15 +260,15 @@ class RamStringsAnalyzer:
 
                 section = self.sections[section_name]
                 if section.address <= addr < section.address + section.size:
-                    symbol = RamSymbol(
-                        name=name,
-                        sym_type=sym_type,
-                        address=addr,
-                        size=size,
-                        section=section_name,
+                    self.ram_symbols.append(
+                        RamSymbol(
+                            name=name,
+                            sym_type=sym_type,
+                            address=addr,
+                            size=size,
+                            section=section_name,
+                        )
                     )
-                    symbols_by_addr[addr] = symbol
-                    self.ram_symbols.append(symbol)
                     break
 
     def _demangle_symbols(self) -> None:
@@ -454,13 +436,7 @@ class RamStringsAnalyzer:
         for symbol in largest_symbols:
             # Use demangled name if available, otherwise raw name
             display_name = symbol.demangled or symbol.name
-            # Truncate the name, not the alias note, so merged aliases stay
-            # visible even for long demangled C++ names.
-            alias_note = f" (+{len(symbol.aliases)} aliases)" if symbol.aliases else ""
-            max_name_len = 49 - len(alias_note)
-            if len(display_name) > max_name_len:
-                display_name = display_name[:max_name_len]
-            name_display = display_name + alias_note
+            name_display = display_name[:49] if len(display_name) > 49 else display_name
             lines.append(
                 f"{name_display:<50} {symbol.sym_type:<6} {symbol.size:>8} B  {symbol.section}"
             )

esphome/analyze_memory/toolchain.py

@@ -23,78 +23,6 @@ TOOLCHAIN_PREFIXES = [
 ]
 
 
-def find_elf_path(build_path: Path) -> Path | None:
-    """Locate the firmware ELF inside an ESPHome build directory.
-
-    The layout depends on the toolchain that produced the build, so try each
-    known one in turn.
-
-    Args:
-        build_path: Path to an ESPHome build directory
-
-    Returns:
-        Path to the ELF file, or None if no known layout matches
-    """
-    name = build_path.name
-    for candidate in (
-        # Native ESP-IDF: idf.py writes build/<name>.elf, which ESPHome copies
-        # to build/firmware.elf (see espidf.toolchain.create_elf_copy)
-        build_path / "build" / "firmware.elf",
-        # PlatformIO
-        build_path / "firmware.elf",
-        build_path / ".pioenvs" / name / "firmware.elf",
-        # LibreTiny uses raw_firmware.elf
-        build_path / "raw_firmware.elf",
-        build_path / ".pioenvs" / name / "raw_firmware.elf",
-        # Zephyr (nRF52); the SDK nests the artifacts one level deeper from 2.9.2
-        build_path / ".pioenvs" / name / "zephyr" / "zephyr" / "zephyr.elf",
-        build_path / ".pioenvs" / name / "zephyr" / "zephyr.elf",
-    ):
-        if candidate.is_file():
-            return candidate
-    return None
-
-
-def idedata_candidates(build_path: Path) -> list[Path]:
-    """Return the idedata locations searched for a build directory, in order.
-
-    Exposed so a caller reporting "not found" can name the paths it tried
-    without keeping its own copy of the list.
-
-    Args:
-        build_path: Path to an ESPHome build directory
-
-    Returns:
-        The candidate idedata JSON paths, most specific first
-    """
-    name = build_path.name
-    return [
-        # In .pioenvs for test builds
-        build_path / ".pioenvs" / name / "idedata.json",
-        # Both toolchains cache it in the data dir, which holds this build dir:
-        # <data_dir>/idedata/<name>.json next to <data_dir>/build/<name>
-        build_path.parent.parent / "idedata" / f"{name}.json",
-        # Regular builds, invoked from the config dir or from anywhere
-        Path.cwd() / ".esphome" / "idedata" / f"{name}.json",
-        Path.home() / ".esphome" / "idedata" / f"{name}.json",
-    ]
-
-
-def find_idedata_path(build_path: Path) -> Path | None:
-    """Locate the idedata JSON belonging to an ESPHome build directory.
-
-    Args:
-        build_path: Path to an ESPHome build directory
-
-    Returns:
-        Path to the idedata JSON, or None if it was not found
-    """
-    for candidate in idedata_candidates(build_path):
-        if candidate.is_file():
-            return candidate
-    return None
-
-
 def _find_in_platformio_packages(tool_name: str) -> str | None:
     """Search for a tool in PlatformIO package directories.
 

esphome/api_client.py

@@ -1,198 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-from contextlib import suppress
-import logging
-import threading
-from typing import TYPE_CHECKING, Any
-import warnings
-
-# Suppress protobuf version warnings
-with warnings.catch_warnings():
-    warnings.filterwarnings(
-        "ignore", category=UserWarning, message=".*Protobuf gencode version.*"
-    )
-    from aioesphomeapi import APIClient, parse_log_message
-    from aioesphomeapi.log_runner import async_run
-
-from esphome.const import CONF_ENCRYPTION, CONF_KEY, CONF_PORT, __version__
-from esphome.core import CORE
-from esphome.stacktrace import LogLineProcessor
-from esphome.util import safe_print
-
-if TYPE_CHECKING:
-    from collections.abc import Callable
-
-    from aioesphomeapi.api_pb2 import (
-        SubscribeLogsResponse,  # pylint: disable=no-name-in-module
-    )
-
-
-_LOGGER = logging.getLogger(__name__)
-
-
-async def async_run_logs(
-    config: dict[str, Any],
-    addresses: list[str],
-    subscribe_states: bool = True,
-    mqtt_resolver: Callable[[threading.Event], list[str]] | None = None,
-) -> None:
-    """Run the logs command in the event loop.
-
-    If ``mqtt_resolver`` is given, it is called in a worker thread (paho-mqtt
-    has no asyncio support on Windows) concurrently with the connection
-    attempts to ``addresses``, and any addresses it discovers are fed into
-    the running client. It owns its own failure handling (returning [] when
-    discovery fails) and must honor the ``threading.Event`` it is passed so
-    teardown is not delayed by the lookup's wait window; the initial broker
-    connect itself is only bounded by the socket timeout.
-    """
-    from datetime import datetime
-
-    conf = config["api"]
-    name = config["esphome"]["name"]
-    port: int = int(conf[CONF_PORT])
-    noise_psk: str | None = None
-    if (encryption := conf.get(CONF_ENCRYPTION)) and (key := encryption.get(CONF_KEY)):
-        noise_psk = key
-
-    _LOGGER.info(
-        "Starting log output from %s using esphome API", " or ".join(addresses)
-    )
-
-    cli = APIClient(
-        addresses[0],  # Primary address for compatibility
-        port,
-        "",  # Password auth removed in 2026.1.0
-        client_info=f"ESPHome Logs {__version__}",
-        noise_psk=noise_psk,
-        addresses=addresses,  # Pass all addresses for automatic retry
-        provide_time=False,
-    )
-
-    # Decoder resolution policy lives in LogLineProcessor.
-    processor = LogLineProcessor(config, CORE.target_platform)
-
-    mqtt_task: asyncio.Task[None] | None = None
-    mqtt_stop_event = threading.Event()
-
-    def _cancel_mqtt_discovery() -> None:
-        """Stop the broker lookup once a connection has been established.
-
-        Its answer is only useful while still disconnected: after that it
-        either duplicates the connected address or arrives too late to
-        matter, so don't keep an idle broker session open for it.
-        """
-        mqtt_stop_event.set()
-        if mqtt_task is not None and not mqtt_task.done():
-            mqtt_task.cancel()
-
-    async def _resolve_mqtt_addresses() -> None:
-        """Discover the device address via the MQTT broker in the background."""
-        try:
-            mqtt_ips = await asyncio.to_thread(mqtt_resolver, mqtt_stop_event)
-            if not mqtt_ips:
-                _LOGGER.debug(
-                    "MQTT discovery %s",
-                    "aborted" if mqtt_stop_event.is_set() else "found no addresses",
-                )
-                return
-            if cli.add_addresses(mqtt_ips):
-                _LOGGER.info("Discovered address(es) via MQTT: %s", ", ".join(mqtt_ips))
-            else:
-                _LOGGER.debug(
-                    "MQTT-discovered address(es) already known: %s", ", ".join(mqtt_ips)
-                )
-        except Exception:  # pylint: disable=broad-except
-            # A background task failure would otherwise stay invisible for
-            # the whole session and only re-raise at teardown
-            _LOGGER.exception("MQTT address discovery failed")
-
-    def on_log(msg: SubscribeLogsResponse) -> None:
-        """Handle a new log message."""
-        time_ = datetime.now().astimezone()
-        message: bytes = msg.message
-        text = message.decode("utf8", "backslashreplace")
-        nanoseconds = time_.microsecond // 1000
-        timestamp = (
-            f"[{time_.hour:02}:{time_.minute:02}:{time_.second:02}.{nanoseconds:03}]"
-        )
-        for parsed_msg in parse_log_message(text, timestamp):
-            # safe_print handles the dashboard \033 escaping and falls back
-            # to backslashreplace encoding on stdouts that can't represent
-            # the wifi signal-bar block characters (Windows redirected
-            # cp1252 pipe).
-            safe_print(parsed_msg)
-        for raw_line in text.splitlines():
-            processor.process_line(raw_line)
-
-    # Safe to fall back to plaintext here only for this diagnostics use
-    # case: the stream is one-way from device to client, and this code
-    # never accepts commands or acts on any message the device sends.
-    # An on-path attacker could still both inject fabricated log lines
-    # and passively read the device's log output (and any state data
-    # delivered when subscribe_states is enabled), so this does lose
-    # confidentiality as well as authentication/integrity. That tradeoff
-    # is acceptable for operator-visible logs, which aioesphomeapi also
-    # warns may come from an unverified device. Never mirror this opt-in
-    # for any connection that sends data to the device or uses Home
-    # Assistant actions.
-    stop = await async_run(
-        cli,
-        on_log,
-        name=name,
-        subscribe_states=subscribe_states,
-        allow_plaintext_fallback=True,
-        # A top-level ``deep_sleep:`` block means the device is only awake
-        # briefly; cap the reconnect backoff so a wake window is not missed.
-        deep_sleep="deep_sleep" in config,
-        on_connect=_cancel_mqtt_discovery if mqtt_resolver is not None else None,
-    )
-    try:
-        # Don't start (or keep) the broker lookup if a connection already
-        # succeeded; the stop event doubles as the not-needed-anymore latch
-        # and get_esphome_device_ip returns immediately when it is set.
-        if mqtt_resolver is not None and not mqtt_stop_event.is_set():
-            mqtt_task = asyncio.create_task(_resolve_mqtt_addresses())
-        await asyncio.Event().wait()
-    finally:
-        try:
-            if mqtt_task is not None:
-                # Unblock the worker thread first so it can't hold up
-                # loop.shutdown_default_executor() for the full lookup timeout.
-                mqtt_stop_event.set()
-                # Give the worker a moment to exit through its own error
-                # handling; cancelling first would race out a late failure.
-                done, _ = await asyncio.wait([mqtt_task], timeout=1.0)
-                if not done:
-                    mqtt_task.cancel()
-                # return_exceptions keeps a CancelledError from the cancel()
-                # above from re-raising here and jumping over the stop() below.
-                # The task handles Exception itself, so only a BaseException
-                # escape (e.g. SystemExit from the worker) can land here.
-                (result,) = await asyncio.gather(mqtt_task, return_exceptions=True)
-                if isinstance(result, BaseException) and not isinstance(
-                    result, asyncio.CancelledError
-                ):
-                    _LOGGER.error("MQTT address discovery failed", exc_info=result)
-        finally:
-            # Must run even if a second cancellation lands mid-cleanup above
-            await stop()
-
-
-def run_logs(
-    config: dict[str, Any],
-    addresses: list[str],
-    subscribe_states: bool = True,
-    mqtt_resolver: Callable[[threading.Event], list[str]] | None = None,
-) -> None:
-    """Run the logs command."""
-    with suppress(KeyboardInterrupt):
-        asyncio.run(
-            async_run_logs(
-                config,
-                addresses,
-                subscribe_states=subscribe_states,
-                mqtt_resolver=mqtt_resolver,
-            )
-        )

esphome/async_thread.py

@@ -11,136 +11,46 @@ from __future__ import annotations
 
 import asyncio
 from collections.abc import Awaitable, Callable
-from itertools import count
-import logging
 import threading
-from typing import cast
+from typing import Generic, TypeVar
 
-_LOGGER = logging.getLogger(__name__)
-
-# How long the orphan watcher waits for an abandoned coroutine before giving
-# up, so a hung operation does not park a watcher thread forever.
-ORPHAN_WAIT_TIMEOUT = 300.0
+_T = TypeVar("_T")
 
 
-_runner_ids = count(1)
-
-
-class AsyncDispatchTimeout(TimeoutError):
-    """The caller stopped waiting; the coroutine was abandoned.
-
-    A subclass so callers can tell the dispatcher's own expiry apart from a
-    ``TimeoutError`` raised inside the coroutine, while existing
-    ``except TimeoutError`` handlers keep working.
-    """
-
-
-class AsyncThreadRunner[T](threading.Thread):
+class AsyncThreadRunner(threading.Thread, Generic[_T]):
     """Run an async coroutine in a daemon thread and expose its result.
 
-    ``event`` is always set, even when the coroutine crashes, so waiters
-    never hang; ``completed`` distinguishes a delivered result (even a
-    legitimate ``None``) from a coroutine that never finished. Prefer
-    :func:`run_async`; use this class directly only when a failure should
-    degrade to a default value instead of raising.
+    The runner catches all exceptions from the coroutine and stores them in
+    ``exception`` so ``event`` is always set — this prevents callers waiting
+    on ``event`` from hanging forever when the coroutine crashes.
+
+    Typical usage::
+
+        runner = AsyncThreadRunner(lambda: my_coro(arg))
+        runner.start()
+        if not runner.event.wait(timeout=5.0):
+            ...  # timed out
+        if runner.exception is not None:
+            raise runner.exception
+        result = runner.result
     """
 
-    def __init__(self, coro_factory: Callable[[], Awaitable[T]]) -> None:
-        super().__init__(daemon=True, name=f"async-thread-runner-{next(_runner_ids)}")
+    def __init__(self, coro_factory: Callable[[], Awaitable[_T]]) -> None:
+        super().__init__(daemon=True)
         self._coro_factory = coro_factory
-        self.result: T | None = None
+        self.result: _T | None = None
         self.exception: BaseException | None = None
-        self.completed = False
         self.event = threading.Event()
 
     async def _runner(self) -> None:
         try:
             self.result = await self._coro_factory()
-            # Distinguishes a delivered result from "never ran", since None
-            # is a valid result value.
-            self.completed = True
-        except BaseException as exc:  # noqa: BLE001  # pylint: disable=broad-except
-            # Capture everything, including BaseException — otherwise a
-            # cancellation or SystemExit would leave ``exception`` unset and
-            # waiters would mistake the empty ``result`` for success.
+        except Exception as exc:  # noqa: BLE001  # pylint: disable=broad-except
+            # Capture all exceptions so ``event`` is always set — otherwise a
+            # crash would hang the waiter forever.
             self.exception = exc
         finally:
             self.event.set()
 
     def run(self) -> None:
-        try:
-            asyncio.run(self._runner())
-        except BaseException as exc:  # noqa: BLE001  # pylint: disable=broad-except
-            # asyncio.run itself can fail before _runner executes (e.g. loop
-            # creation under fd exhaustion); record it so waiters never hang.
-            # A failure during loop cleanup after the coroutine completed
-            # must not clobber the delivered result, hence the guard.
-            if self.exception is None and not self.completed:
-                self.exception = exc
-            else:
-                _LOGGER.debug(
-                    "Event loop teardown failed after outcome recorded",
-                    exc_info=True,
-                )
-        finally:
-            self.event.set()
-
-
-def run_async[T](
-    coro_factory: Callable[[], Awaitable[T]],
-    timeout: float | None = None,
-    on_orphan: Callable[[T], None] | None = None,
-) -> T:
-    """Run a coroutine in a daemon-thread event loop and return its result.
-
-    Raises :class:`AsyncDispatchTimeout` if the coroutine does not finish
-    within ``timeout`` seconds; the thread is abandoned and exits with the
-    interpreter. If the abandoned coroutine later produces a result,
-    ``on_orphan`` (if given) is called with it so resources such as a
-    connected socket can be released; delivery is best effort and bounded
-    by ``ORPHAN_WAIT_TIMEOUT``.
-    """
-    runner: AsyncThreadRunner[T] = AsyncThreadRunner(coro_factory)
-    runner.start()
-    if not runner.event.wait(timeout):
-
-        def _cleanup() -> None:
-            if not runner.event.wait(ORPHAN_WAIT_TIMEOUT):
-                # The one state where a resource can genuinely leak; leave
-                # a trace so a recurring hang is attributable.
-                _LOGGER.info(
-                    "Orphan watcher gave up after %.0fs; a late result may leak",
-                    ORPHAN_WAIT_TIMEOUT,
-                )
-                return
-            if not runner.completed:
-                # The only place an abandoned thread's real error surfaces;
-                # without it a late failure hides behind the TimeoutError.
-                # INFO, not DEBUG: it fires at most once per abandoned
-                # operation and the cause may not reproduce on a rerun.
-                _LOGGER.info(
-                    "Abandoned async operation failed",
-                    exc_info=runner.exception,
-                )
-                return
-            if (result := runner.result) is None:
-                return
-            if on_orphan is None:
-                _LOGGER.debug("Discarding late result; no on_orphan handler")
-                return
-            try:
-                on_orphan(result)
-            except Exception:  # pylint: disable=broad-except
-                # INFO, not DEBUG: a failed release means a real leak, and
-                # it fires at most once per abandoned operation.
-                _LOGGER.info("Error releasing orphaned result", exc_info=True)
-
-        threading.Thread(
-            target=_cleanup, daemon=True, name="async-orphan-cleanup"
-        ).start()
-        raise AsyncDispatchTimeout("Timed out waiting for async operation")
-    if (exc := runner.exception) is not None:
-        raise exc
-    if not runner.completed:
-        raise RuntimeError("Async operation finished without a result or an exception")
-    return cast("T", runner.result)
+        asyncio.run(self._runner())

esphome/build_gen/espidf.py

@@ -6,11 +6,7 @@ from pathlib import Path
 from esphome.components.esp32 import get_esp32_variant, idf_version
 import esphome.config_validation as cv
 from esphome.core import CORE
-from esphome.framework_helpers import (
-    get_project_compile_flags,
-    get_project_cxx_compile_flags,
-    get_project_link_flags,
-)
+from esphome.framework_helpers import get_project_compile_flags, get_project_link_flags
 from esphome.helpers import mkdir_p, write_file_if_changed
 
 # Replaces the IDF default C++ standard (-std=gnu++2b appended to
@@ -95,14 +91,6 @@ def get_project_cmakelists(minimal: bool = False) -> str:
         for flag in project_compile_opts
     )
 
-    # Flags registered via cg.add_cxx_build_flag() go on CXX_COMPILE_OPTIONS
-    # (not COMPILE_OPTIONS) because GCC warns when a C++-only flag such as
-    # -Wno-volatile is passed on a C compile.
-    cxx_compile_options = "\n".join(
-        f'idf_build_set_property(CXX_COMPILE_OPTIONS "{flag}" APPEND)'
-        for flag in get_project_cxx_compile_flags()
-    )
-
     cpp_standard_options = (
         CPP_STANDARD_TEMPLATE.format(standard=CORE.cpp_standard)
         if CORE.cpp_standard
@@ -167,8 +155,6 @@ include($ENV{{IDF_PATH}}/tools/cmake/project.cmake)
 
 {cpp_standard_options}
 
-{cxx_compile_options}
-
 {extra_compile_options}
 
 {managed_components_property}
@@ -210,27 +196,15 @@ def get_component_cmakelists() -> str:
 if(CMAKE_SCRIPT_MODE_FILE)
     file(GLOB_RECURSE app_sources
         "${{CMAKE_CURRENT_SOURCE_DIR}}/*.cpp"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.cc"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.cxx"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.c++"
         "${{CMAKE_CURRENT_SOURCE_DIR}}/*.c"
         "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.cpp"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.cc"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.cxx"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.c++"
         "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.c"
     )
 else()
     file(GLOB_RECURSE app_sources CONFIGURE_DEPENDS
         "${{CMAKE_CURRENT_SOURCE_DIR}}/*.cpp"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.cc"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.cxx"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.c++"
         "${{CMAKE_CURRENT_SOURCE_DIR}}/*.c"
         "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.cpp"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.cc"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.cxx"
-        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.c++"
         "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.c"
     )
 endif()

esphome/build_gen/platformio.py

@@ -108,6 +108,7 @@ Import("env")
 def write_cxx_flags_script() -> None:
     path = CORE.relative_build_path(CXX_FLAGS_FILE_NAME)
     contents = CXX_FLAGS_FILE_CONTENTS
-    for flag in sorted(CORE.cxx_build_flags):
-        contents += f'env.Append(CXXFLAGS=["{flag}"])\n'
+    if not CORE.is_host:
+        contents += 'env.Append(CXXFLAGS=["-Wno-volatile"])'
+        contents += "\n"
     write_file_if_changed(path, contents)

esphome/bundle.py

@@ -7,12 +7,12 @@ and compiled directly: ``esphome compile my_device.esphomebundle.tar.gz``
 
 from __future__ import annotations
 
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 from enum import StrEnum
 import io
 import json
 import logging
-from pathlib import Path, PurePath, PurePosixPath, PureWindowsPath
+from pathlib import Path
 import re
 import shutil
 import tarfile
@@ -20,7 +20,6 @@ from typing import Any
 
 from esphome import const, yaml_util
 from esphome.const import (
-    BUNDLE_EXTENSION,
     CONF_ESPHOME,
     CONF_EXTERNAL_COMPONENTS,
     CONF_INCLUDES,
@@ -30,12 +29,10 @@ from esphome.const import (
     CONF_TYPE,
 )
 from esphome.core import CORE, EsphomeError
-from esphome.util import filter_yaml_files
 
 _LOGGER = logging.getLogger(__name__)
 
-DOMAIN = "bundle"
-
+BUNDLE_EXTENSION = ".esphomebundle.tar.gz"
 MANIFEST_FILENAME = "manifest.json"
 CURRENT_MANIFEST_VERSION = 1
 MAX_DECOMPRESSED_SIZE = 500 * 1024 * 1024  # 500 MB
@@ -52,7 +49,6 @@ class ManifestKey(StrEnum):
     MANIFEST_VERSION = "manifest_version"
     ESPHOME_VERSION = "esphome_version"
     CONFIG_FILENAME = "config_filename"
-    CONFIG_DIR = "config_dir"
     FILES = "files"
     HAS_SECRETS = "has_secrets"
 
@@ -124,153 +120,6 @@ def _find_used_secret_keys(yaml_files: list[Path]) -> set[str]:
     return keys
 
 
-@dataclass
-class BundleData:
-    """Files components asked to include, keyed under DOMAIN in CORE.data."""
-
-    extra_files: list[Path] = field(default_factory=list)
-    # Directories whose YAML files are scanned for !secret references but
-    # never bundled, e.g. git package checkouts the builder re-fetches.
-    secret_scan_dirs: set[Path] = field(default_factory=set)
-    # Original config dir parsed from an extracted bundle's manifest.json,
-    # kept in the path flavor of the machine the bundle was created on.
-    # The checked flag makes the manifest lookup happen at most once per run;
-    # CORE.data is cleared between runs.
-    original_config_dir: PurePath | None = None
-    original_config_dir_checked: bool = False
-
-
-def _get_data() -> BundleData:
-    if DOMAIN not in CORE.data:
-        CORE.data[DOMAIN] = BundleData()
-    return CORE.data[DOMAIN]
-
-
-def add_bundle_file(path: Path) -> None:
-    """Register a file that a bundle must include.
-
-    Bundle discovery walks the validated config, so it only finds files the config
-    names. Components call this during validation for files it cannot see, such as a
-    file that is referenced from inside another file.
-
-    A relative path is taken as relative to the config directory. Files outside the
-    config directory are skipped when the bundle is built.
-    """
-    _get_data().extra_files.append(CORE.relative_config_path(path))
-
-
-def add_secret_scan_dir(path: Path) -> None:
-    """Register a directory to scan for ``!secret`` references when bundling.
-
-    The directory's files are not added to the bundle. Components call this
-    for YAML the build consumes without bundling it — such as git-fetched
-    packages, which the builder re-fetches — so the secrets those files
-    reference are still shipped in the filtered secrets file.
-
-    A relative path is taken as relative to the config directory.
-    """
-    if not path.is_absolute():
-        path = CORE.relative_config_path(path)
-    _get_data().secret_scan_dirs.add(path)
-
-
-def _secret_scan_yaml_files() -> list[Path]:
-    """Return the YAML files inside registered secret-scan directories."""
-    return filter_yaml_files(
-        f
-        for scan_dir in _get_data().secret_scan_dirs
-        for f in yaml_util.find_files(scan_dir, "*")
-    )
-
-
-# Windows paths start with a drive letter or contain backslashes; POSIX
-# paths do neither in practice, so this is how the flavor of a recorded
-# path string is recognized on any host.
-_WINDOWS_DRIVE_RE = re.compile(r"^[A-Za-z]:")
-
-
-def _path_flavor(value: str) -> type[PurePath]:
-    """Pick the pure path class matching the flavor ``value`` was written in."""
-    if "\\" in value or _WINDOWS_DRIVE_RE.match(value):
-        return PureWindowsPath
-    return PurePosixPath
-
-
-def _load_original_config_dir() -> PurePath | None:
-    """Read the original config dir from an extracted bundle's manifest.
-
-    Returns None when the current config dir is not an extracted bundle or
-    the manifest does not record the original config dir.
-    """
-    manifest_path = CORE.config_dir / MANIFEST_FILENAME
-    try:
-        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
-    except FileNotFoundError:
-        # The common case: this config dir is not an extracted bundle.
-        return None
-    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as err:
-        # A manifest.json is present but unreadable or malformed. Say so
-        # instead of letting it look identical to "not a bundle".
-        _LOGGER.warning("Bundle: ignoring unreadable %s: %s", manifest_path, err)
-        return None
-    if not isinstance(manifest, dict):
-        return None
-    # A manifest.json in the config dir does not have to be ours. Only trust
-    # one that looks like a bundle manifest for exactly this config file.
-    version = manifest.get(ManifestKey.MANIFEST_VERSION)
-    if not isinstance(version, int) or version < 1:
-        return None
-    if manifest.get(ManifestKey.CONFIG_FILENAME) != CORE.config_path.name:
-        return None
-    config_dir = manifest.get(ManifestKey.CONFIG_DIR)
-    if not isinstance(config_dir, str) or not config_dir:
-        return None
-    return _path_flavor(config_dir)(config_dir)
-
-
-def remap_bundle_path(value: str) -> Path | None:
-    """Remap an absolute path from the machine a bundle was created on.
-
-    A bundled config may reference files by absolute path. The referenced
-    files ship inside the bundle at their config-relative locations, but the
-    YAML text is copied verbatim, so after extraction on another machine the
-    absolute reference points at a path that only existed on the creating
-    machine. The bundle manifest records that machine's config dir; when
-    ``value`` names a path that lived under it, return the corresponding
-    file next to the extracted config.
-
-    ``value`` is the raw path string from the config. It is parsed with the
-    original machine's path flavor, so a bundle created on Windows remaps on
-    a POSIX build server and vice versa.
-
-    Returns None when not compiling an extracted bundle, when ``value`` was
-    not under the original config dir, or when the bundle does not contain
-    the file.
-    """
-    data = _get_data()
-    if not data.original_config_dir_checked:
-        data.original_config_dir_checked = True
-        data.original_config_dir = _load_original_config_dir()
-    original_dir = data.original_config_dir
-    if original_dir is None:
-        return None
-    path = type(original_dir)(value)
-    if not path.is_absolute():
-        return None
-    try:
-        rel = path.relative_to(original_dir)
-    except ValueError:
-        return None
-    # relative_to is lexical, so ".." segments survive it. Refuse them: the
-    # remapped file must land strictly inside the extracted config tree.
-    if ".." in rel.parts:
-        return None
-    remapped = CORE.relative_config_path(Path(*rel.parts))
-    if not remapped.exists():
-        return None
-    return remapped
-
-
 @dataclass
 class BundleFile:
     """A file to include in the bundle."""
@@ -297,7 +146,6 @@ class BundleManifest:
     config_filename: str
     files: list[str]
     has_secrets: bool
-    config_dir: str | None = None
 
 
 class ConfigBundleCreator:
@@ -338,7 +186,6 @@ class ConfigBundleCreator:
         yaml_sources = [
             bf.source for bf in files if bf.source.suffix in (".yaml", ".yml")
         ]
-        yaml_sources.extend(_secret_scan_yaml_files())
         used_secret_keys = _find_used_secret_keys(yaml_sources)
         filtered_secrets = self._build_filtered_secrets(used_secret_keys)
 
@@ -423,13 +270,6 @@ class ConfigBundleCreator:
         """
         discovered = yaml_util.discover_user_yaml_files(self._config_path)
         self._secrets_paths.update(discovered.secrets)
-        # A !secret inside a file this re-parse does not reach (for example
-        # a git-fetched package the builder re-fetches) still resolves
-        # against the config-dir secrets.yaml at build time, so always
-        # consider that file; filtering no-ops when no key matches.
-        default_secrets = self._config_dir / yaml_util.SECRET_YAML
-        if default_secrets.is_file():
-            self._secrets_paths.add(default_secrets.resolve())
         config_resolved = self._config_path.resolve()
         for fpath in discovered.files:
             if fpath == config_resolved:
@@ -446,18 +286,13 @@ class ConfigBundleCreator:
         with known file extensions are also resolved and checked.
 
         Core ESPHome concepts that use relative paths or directories
-        are handled explicitly. Files the config does not name at all are
-        registered by their component with add_bundle_file().
+        are handled explicitly.
         """
         config = self._config
 
         # Generic walk: find all file paths in the validated config
         self._walk_config_for_files(config)
 
-        # Files registered by components during validation
-        for extra_file in _get_data().extra_files:
-            self._add_file(extra_file)
-
         # --- Core ESPHome concepts needing explicit handling ---
 
         # esphome.includes / includes_c - can be relative paths and directories
@@ -570,7 +405,6 @@ class ConfigBundleCreator:
             ManifestKey.MANIFEST_VERSION: CURRENT_MANIFEST_VERSION,
             ManifestKey.ESPHOME_VERSION: const.__version__,
             ManifestKey.CONFIG_FILENAME: self._config_path.name,
-            ManifestKey.CONFIG_DIR: str(self._config_dir),
             ManifestKey.FILES: [f.path for f in files],
             ManifestKey.HAS_SECRETS: has_secrets,
         }
@@ -655,14 +489,12 @@ def read_bundle_manifest(bundle_path: Path) -> BundleManifest:
     except tarfile.TarError as err:
         raise EsphomeError(f"Failed to read bundle: {err}") from err
 
-    config_dir = manifest.get(ManifestKey.CONFIG_DIR)
     return BundleManifest(
         manifest_version=manifest[ManifestKey.MANIFEST_VERSION],
         esphome_version=manifest.get(ManifestKey.ESPHOME_VERSION, "unknown"),
         config_filename=manifest[ManifestKey.CONFIG_FILENAME],
         files=manifest.get(ManifestKey.FILES, []),
         has_secrets=manifest.get(ManifestKey.HAS_SECRETS, False),
-        config_dir=config_dir if isinstance(config_dir, str) else None,
     )
 
 
@@ -755,6 +587,11 @@ def _validate_tar_members(tar: tarfile.TarFile, target_dir: Path) -> None:
             )
 
 
+def is_bundle_path(path: Path) -> bool:
+    """Check if a path looks like a bundle file."""
+    return path.name.lower().endswith(BUNDLE_EXTENSION)
+
+
 def _add_bytes_to_tar(tar: tarfile.TarFile, name: str, data: bytes) -> None:
     """Add in-memory bytes to a tar archive with deterministic metadata."""
     info = tarfile.TarInfo(name=name)

esphome/codegen.py

@@ -25,7 +25,6 @@ from esphome.cpp_generator import (  # noqa: F401
     add,
     add_build_flag,
     add_build_unflag,
-    add_cxx_build_flag,
     add_define,
     add_global,
     add_library,
@@ -49,13 +48,10 @@ from esphome.cpp_helpers import (  # noqa: F401
     build_registry_entry,
     build_registry_list,
     extract_registry_entry_config,
-    get_slot_count,
     gpio_pin_expression,
     past_safe_mode,
     register_component,
     register_parented,
-    set_setup_priority,
-    slot_counter,
 )
 from esphome.cpp_types import (  # noqa: F401
     NAN,

esphome/compiled_config.py

@@ -1,178 +1,26 @@
 """Validated-config cache for the upload/logs fast path.
 
-compile dumps the validated config to <data_dir>/storage/<file>.validated.json;
+compile dumps the validated config to <data_dir>/storage/<file>.validated.yaml;
 the next upload/logs for that YAML reuses it instead of running the full
-read_config pipeline. The cache is deliberately lossy: only ``!lambda``
-bodies survive typed (``Lambda``); IDs, time periods, MAC/IP addresses,
-paths, UUIDs and enums store the same string form the YAML dumper
-produced for them. JSON additionally coerces non-str dict keys to
-strings; validated configs only use string keys (every schema key
-validator is ``cv.string``). mtime gates staleness.
+read_config pipeline. YAML round-trip (yaml_util.dump/load_yaml) keeps
+!lambda/!include/IDs/paths intact; mtime gates staleness.
 """
 
 from __future__ import annotations
 
-import json
 import logging
 from pathlib import Path
-from typing import Any
 
-from esphome.const import __version__ as ESPHOME_VERSION
-from esphome.core import CORE, EsphomeError, Lambda
+from esphome.core import CORE
 from esphome.helpers import write_file
-from esphome.storage_json import StorageJSON, ext_storage_path, storage_path
+from esphome.storage_json import StorageJSON, ext_storage_path
 from esphome.types import ConfigType
 
 _LOGGER = logging.getLogger(__name__)
 
-# Bump when the on-disk shape changes; a mismatched version falls back
-# to read_config. The envelope also stamps the writing esphome version:
-# after an upgrade the cache holds the previous release's validation, so
-# it falls back once and the re-save self-heals.
-_CACHE_VERSION = 1
-_LAMBDA_KEY = "__esphome_lambda__"
-
 
 def compiled_config_path(config_filename: str) -> Path:
     """Path to the cached validated config alongside the storage sidecar."""
-    return CORE.data_dir / "storage" / f"{config_filename}.validated.json"
-
-
-def save_compiled_config(config: ConfigType) -> None:
-    """Write the validated-config cache. Always-write so mtime stays fresh.
-
-    Mode 0600 because config validation resolved !secret inline.
-    Failures are non-fatal: the fast path falls back to read_config.
-    """
-    try:
-        # The legacy YAML cache holds inline-resolved secrets and nothing
-        # reads it anymore; drop it even when the write below fails. A
-        # failed removal leaves resolved secrets on disk, so it warns.
-        try:
-            _legacy_compiled_config_path(CORE.config_filename).unlink(missing_ok=True)
-        except OSError as err:
-            _LOGGER.warning(
-                "Could not remove the legacy validated-config cache: %s", err
-            )
-        rendered = json.dumps(
-            {"v": _CACHE_VERSION, "esphome": ESPHOME_VERSION, "config": config},
-            separators=(",", ":"),
-            default=_json_default,
-        )
-        write_file(compiled_config_path(CORE.config_filename), rendered, private=True)
-    except TypeError as err:
-        # Structural, not transient: this config can never cache (e.g. a
-        # non-basic dict key), so every upload/logs pays the slow path.
-        _LOGGER.warning("Cannot cache the validated config: %s", err)
-    except Exception as err:  # noqa: BLE001  # pylint: disable=broad-except
-        # Likely persistent (permissions, full disk): every upload/logs
-        # pays the slow path until it clears, so surface it.
-        _LOGGER.warning("Skipping compiled config cache write: %s", err)
-
-
-def save_compiled_config_and_sidecar(config: ConfigType) -> None:
-    """Refresh the cache from the upload/logs fallback (CORE.config must be set).
-
-    The cache is only written when a complete sidecar is on disk:
-    load_compiled_config can't use it otherwise, and it holds resolved
-    secrets.
-    """
-    if _refresh_sidecar():
-        save_compiled_config(config)
-
-
-def _refresh_sidecar() -> bool:
-    """Ensure a complete sidecar is on disk; True when one is.
-
-    Writes one (without claiming a build) when missing or wizard-only.
-    Failures are non-fatal; the next upload/logs pays the slow path again.
-    """
-    try:
-        path = storage_path()
-        try:
-            old = StorageJSON.load_strict(path)
-        except Exception as err:  # noqa: BLE001  # pylint: disable=broad-except
-            # Present but unreadable: it may hold a real build's metadata,
-            # and a fresh rewrite would also stop the next compile from
-            # cleaning a possibly incoherent build tree.
-            _LOGGER.warning(
-                "Not caching: storage sidecar %s is unreadable (%s)", path, err
-            )
-            return False
-        if old is not None and old.can_apply_to_core():
-            # Compile-written; nothing to refresh.
-            return True
-        if CORE.build_path is not None and CORE.build_path.exists():
-            # An unvalidated build tree: its absent or mismatched sidecar
-            # is what makes the next compile wipe it, so don't vouch for
-            # a build this run never saw.
-            _LOGGER.warning(
-                "Not caching: build tree %s has no matching sidecar; "
-                "'esphome compile' will settle it",
-                CORE.build_path,
-            )
-            return False
-        new = StorageJSON.from_esphome_core(CORE, old, claim_build=False)
-        if not new.can_apply_to_core():
-            _LOGGER.warning("Not caching: rebuilt storage sidecar is still incomplete")
-            return False
-        new.save(path)
-        return True
-    except (OSError, EsphomeError) as err:
-        # write_file wraps OSError into EsphomeError. Persistent
-        # (unwritable storage dir), so surface that every upload/logs
-        # pays the slow path.
-        _LOGGER.warning("Could not refresh the storage sidecar: %s", err)
-    except Exception:  # noqa: BLE001  # pylint: disable=broad-except
-        # A structural bug; keep the traceback so it isn't mistaken
-        # for the I/O failure above.
-        _LOGGER.warning(
-            "Unexpected error refreshing the storage sidecar", exc_info=True
-        )
-    return False
-
-
-def load_compiled_config(conf_path: Path) -> ConfigType | None:
-    """Load the cached validated config and apply storage metadata to CORE.
-
-    Returns None (caller falls back to read_config) when the cache is
-    missing, older than the source YAML, unparseable, a different cache
-    version, or the sidecar is incomplete. The loaded config carries no
-    source ranges; callers must not feed it into read_config/write_cpp.
-    """
-    cache_path = compiled_config_path(conf_path.name)
-    if not _cache_is_fresh(cache_path, conf_path):
-        return None
-
-    try:
-        envelope = json.loads(
-            cache_path.read_text(encoding="utf-8"), object_hook=_decode_object
-        )
-    except (OSError, ValueError) as err:
-        _LOGGER.debug("Ignoring unreadable compiled config cache: %s", err)
-        return None
-
-    if (
-        not isinstance(envelope, dict)
-        or envelope.get("v") != _CACHE_VERSION
-        or envelope.get("esphome") != ESPHOME_VERSION
-        or not isinstance(config := envelope.get("config"), dict)
-    ):
-        _LOGGER.debug("Ignoring compiled config cache with a foreign envelope")
-        return None
-
-    storage = StorageJSON.load(ext_storage_path(conf_path.name))
-    if storage is None or not storage.can_apply_to_core():
-        _LOGGER.debug("Ignoring compiled config cache: sidecar missing or incomplete")
-        return None
-    storage.apply_to_core()
-    return config
-
-
-# Remove before 2027.8: by then every maintained install has saved the
-# JSON cache at least once and dropped its legacy YAML file.
-def _legacy_compiled_config_path(config_filename: str) -> Path:
-    """Path of the pre-JSON YAML cache; only ever removed."""
     return CORE.data_dir / "storage" / f"{config_filename}.validated.yaml"
 
 
@@ -184,21 +32,45 @@ def _cache_is_fresh(cache_path: Path, source_path: Path) -> bool:
         return False
 
 
-def _json_default(value: Any) -> Any:
-    """Mirror ESPHomeDumper's representers: Lambda stays typed, the rest
-    stringify (IDs, time periods, MAC/IP addresses, paths, UUIDs, enums).
+def save_compiled_config(config: ConfigType) -> None:
+    """Write the validated-config cache. Always-write so mtime stays fresh.
 
-    IncludeFile/Extend/Remove have no JSON mirror and would stringify
-    wrong, but none survive validation (config.py's packages merge and
-    the substitution pass consume them) so no guard is spent on them.
+    Mode 0600 because show_secrets=True resolves !secret inline.
+    Failures are non-fatal: the fast path falls back to read_config.
     """
-    if isinstance(value, Lambda):
-        return {_LAMBDA_KEY: value.value}
-    return str(value)
+    from esphome import yaml_util
+
+    try:
+        rendered = yaml_util.dump(config, show_secrets=True)
+        write_file(compiled_config_path(CORE.config_filename), rendered, private=True)
+    except Exception as err:  # noqa: BLE001  # pylint: disable=broad-except
+        _LOGGER.debug("Skipping compiled config cache write: %s", err)
 
 
-def _decode_object(obj: dict[str, Any]) -> Any:
-    """Revive the Lambda sentinel; every other mapping passes through."""
-    if len(obj) == 1 and isinstance(value := obj.get(_LAMBDA_KEY), str):
-        return Lambda(value)
-    return obj
+def load_compiled_config(conf_path: Path) -> ConfigType | None:
+    """Load the cached validated config and apply storage metadata to CORE.
+
+    Returns None (caller falls back to read_config) when the cache is
+    missing, older than the source YAML, unparseable, or the sidecar
+    is incomplete.
+    """
+    cache_path = compiled_config_path(conf_path.name)
+    if not _cache_is_fresh(cache_path, conf_path):
+        return None
+
+    from esphome import yaml_util
+
+    try:
+        config = yaml_util.load_yaml(cache_path, clear_secrets=False)
+    except Exception:  # noqa: BLE001  # pylint: disable=broad-except
+        return None
+
+    storage = StorageJSON.load(ext_storage_path(conf_path.name))
+    if storage is None:
+        return None
+    # apply_to_core assumes a real compile wrote the sidecar; wizard-only
+    # sidecars leave both of these unset and can't drive upload/logs.
+    if not storage.core_platform and not storage.target_platform:
+        return None
+    storage.apply_to_core()
+    return config

esphome/component_aliases.py

@@ -1,10 +0,0 @@
-"""Component alias registry.
-
-Generated by script/build_alias_registry.py - do not edit manually.
-See the component-alias section of esphome/loader.py.
-"""
-
-# alias -> (canonical component, removal version or None)
-COMPONENT_ALIASES: dict[str, tuple[str, str | None]] = {
-    "rp2040": ("rp2", "2027.7.0"),
-}

esphome/components/__init__.py

@@ -1,6 +0,0 @@
-# Importing `esphome.loader` here installs the component-alias
-# ``sys.meta_path`` finder before any submodule lookup runs. Without this,
-# `from esphome.components import <legacy_alias>` from a fresh interpreter
-# can race the finder install and raise ImportError, since the legacy
-# alias dir no longer exists on disk.
-from esphome import loader as _loader  # noqa: F401

esphome/components/a01nyub/a01nyub.cpp

@@ -25,7 +25,7 @@ void A01nyubComponent::check_buffer_() {
   if (this->buffer_[3] == checksum) {
     float distance = (this->buffer_[1] << 8) + this->buffer_[2];
     if (distance > 280) {
-      float meters = distance / 1000.0f;
+      float meters = distance / 1000.0;
       ESP_LOGV(TAG, "Distance from sensor: %f mm, %f m", distance, meters);
       this->publish_state(meters);
     } else {

esphome/components/ac_dimmer/ac_dimmer.cpp

@@ -216,7 +216,7 @@ void AcDimmer::setup() {
 }
 
 void AcDimmer::write_state(float state) {
-  state = std::acos(1 - (2 * state)) / std::numbers::pi_v<float>;  // RMS power compensation
+  state = std::acos(1 - (2 * state)) / std::numbers::pi;  // RMS power compensation
   auto new_value = static_cast<uint16_t>(roundf(state * 65535));
   if (new_value != 0 && this->store_.value == 0)
     this->store_.init_cycle = this->init_with_half_cycle_;

esphome/components/adc/__init__.py

@@ -227,13 +227,12 @@ ESP32_VARIANT_ADC2_PIN_TO_CHANNEL = {
 
 def validate_adc_pin(value):
     if str(value).upper() == "VCC":
-        if CORE.is_rp2:
+        if CORE.is_rp2040:
             return pins.internal_gpio_input_pin_schema(29)
         return cv.only_on([PLATFORM_ESP8266])("VCC")
 
-    # Deprecated in favour of the `internal_temperature` platform, remove before 2027.2.0
     if str(value).upper() == "TEMPERATURE":
-        return cv.only_on_rp2("TEMPERATURE")
+        return cv.only_on_rp2040("TEMPERATURE")
 
     if CORE.is_esp32:
         conf = pins.internal_gpio_input_pin_schema(value)
@@ -262,11 +261,11 @@ def validate_adc_pin(value):
             raise cv.Invalid("ESP8266: Only pin A0 (GPIO17) supports ADC")
         return conf
 
-    if CORE.is_rp2:
+    if CORE.is_rp2040:
         conf = pins.internal_gpio_input_pin_schema(value)
         number = conf[CONF_NUMBER]
         if number not in (26, 27, 28, 29):
-            raise cv.Invalid("RP2: Only pins 26, 27, 28 and 29 support ADC")
+            raise cv.Invalid("RP2040: Only pins 26, 27, 28 and 29 support ADC")
         return conf
 
     if CORE.is_libretiny:

esphome/components/adc/adc_sensor.h

@@ -123,9 +123,9 @@ class ADCSensor final : public sensor::Sensor, public PollingComponent, public v
   void set_autorange(bool autorange) { this->autorange_ = autorange; }
 #endif  // USE_ESP32
 
-#ifdef USE_RP2
+#ifdef USE_RP2040
   void set_is_temperature() { this->is_temperature_ = true; }
-#endif  // USE_RP2
+#endif  // USE_RP2040
 
  protected:
   uint8_t sample_count_{1};
@@ -152,9 +152,9 @@ class ADCSensor final : public sensor::Sensor, public PollingComponent, public v
   static adc_oneshot_unit_handle_t shared_adc_handles[2];
 #endif  // USE_ESP32
 
-#ifdef USE_RP2
+#ifdef USE_RP2040
   bool is_temperature_{false};
-#endif  // USE_RP2
+#endif  // USE_RP2040
 
 #ifdef USE_ZEPHYR
   const struct adc_dt_spec *channel_ = nullptr;

esphome/components/adc/adc_sensor_common.cpp

@@ -3,7 +3,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc";
+static const char *const TAG = "adc.common";
 
 const LogString *sampling_mode_to_str(SamplingMode mode) {
   switch (mode) {

esphome/components/adc/adc_sensor_esp32.cpp

@@ -6,7 +6,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc";
+static const char *const TAG = "adc.esp32";
 
 adc_oneshot_unit_handle_t ADCSensor::shared_adc_handles[2] = {nullptr, nullptr};
 

esphome/components/adc/adc_sensor_esp8266.cpp

@@ -13,7 +13,7 @@ ADC_MODE(ADC_VCC)
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc";
+static const char *const TAG = "adc.esp8266";
 
 void ADCSensor::setup() {
 #ifndef USE_ADC_SENSOR_VCC

esphome/components/adc/adc_sensor_libretiny.cpp

@@ -5,7 +5,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc";
+static const char *const TAG = "adc.libretiny";
 
 void ADCSensor::setup() {
 #ifndef USE_ADC_SENSOR_VCC

esphome/components/adc/adc_sensor_rp2040.cpp

@@ -1,4 +1,4 @@
-#ifdef USE_RP2
+#ifdef USE_RP2040
 
 #include "adc_sensor.h"
 #include "esphome/core/log.h"
@@ -17,26 +17,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc";
-
-// The on-die temperature sensor sits on the last ADC channel: input 4 on RP2040
-// and RP2350A, but input 8 on RP2350B, which has eight external channels rather
-// than four.
-//
-// This deliberately does not use the SDK's ADC_TEMPERATURE_CHANNEL_NUM. That
-// derives from NUM_ADC_CHANNELS, which <pico.h> settles from a board header, and
-// arduino-pico supplies a fixed B-die one for every RP2350 build. The real die
-// is only declared later, by the variant's pins_arduino.h, so the SDK constant
-// reads 8 on A-die boards. PICO_RP2350A itself is correct by the time this file
-// is compiled, on both arduino-pico and pico-sdk builds.
-#if defined(PICO_RP2350) && !defined(PICO_RP2350A)
-#error "PICO_RP2350A is not defined, so the RP2350 die is unknown and the temperature ADC channel cannot be chosen"
-#endif
-#if defined(PICO_RP2350) && !PICO_RP2350A
-static constexpr uint8_t TEMPERATURE_ADC_INPUT = 8;
-#else
-static constexpr uint8_t TEMPERATURE_ADC_INPUT = 4;
-#endif
+static const char *const TAG = "adc.rp2040";
 
 void ADCSensor::setup() {
   static bool initialized = false;
@@ -71,7 +52,7 @@ float ADCSensor::sample() {
   if (this->is_temperature_) {
     adc_set_temp_sensor_enabled(true);
     delay(1);
-    adc_select_input(TEMPERATURE_ADC_INPUT);
+    adc_select_input(4);
 
     for (uint8_t sample = 0; sample < this->sample_count_; sample++) {
       raw = adc_read();
@@ -121,4 +102,4 @@ float ADCSensor::sample() {
 
 }  // namespace esphome::adc
 
-#endif  // USE_RP2
+#endif  // USE_RP2040

esphome/components/adc/adc_sensor_zephyr.cpp

@@ -7,7 +7,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc";
+static const char *const TAG = "adc.zephyr";
 
 void ADCSensor::setup() {
   if (!adc_is_ready_dt(this->channel_)) {

esphome/components/adc/sensor.py

@@ -10,8 +10,8 @@ from esphome.components.esp32 import (
 from esphome.components.nrf52.const import AIN_TO_GPIO, EXTRA_ADC
 from esphome.components.zephyr import (
     zephyr_add_overlay,
-    zephyr_add_overlay_builder,
     zephyr_add_prj_conf,
+    zephyr_add_user,
 )
 from esphome.config_helpers import filter_source_files_from_platform
 import esphome.config_validation as cv
@@ -67,13 +67,6 @@ def validate_config(config):
         # Alter value here so `config` command prints the recommended change
         config[CONF_ATTENUATION] = _attenuation("12db")
 
-    # Remove before 2027.2.0
-    if config[CONF_PIN] == "TEMPERATURE":
-        _LOGGER.warning(
-            "[adc] `pin: TEMPERATURE` is deprecated, use the `internal_temperature` "
-            "sensor platform instead. Will be removed in 2027.2.0"
-        )
-
     return config
 
 
@@ -120,18 +113,6 @@ CONFIG_SCHEMA = cv.All(
 CONF_ADC_CHANNEL_ID = "adc_channel_id"
 
 
-def _overlay_io_channels():
-    channel_count = CORE.data[CONF_ADC_CHANNEL_ID]
-    entries = ", ".join(f"<&adc {channel_id}>" for channel_id in range(channel_count))
-    return f"""
-            / {{
-                zephyr,user {{
-                    io-channels = {entries};
-                }};
-            }};
-            """
-
-
 async def to_code(config):
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
@@ -140,7 +121,6 @@ async def to_code(config):
     if config[CONF_PIN] == "VCC":
         cg.add_define("USE_ADC_SENSOR_VCC")
     elif config[CONF_PIN] == "TEMPERATURE":
-        # Remove before 2027.2.0
         cg.add(var.set_is_temperature())
     elif not CORE.is_nrf52 or config[CONF_PIN][CONF_NUMBER] not in EXTRA_ADC:
         pin = await cg.gpio_pin_expression(config[CONF_PIN])
@@ -193,8 +173,9 @@ async def to_code(config):
         if isinstance(pin_number, int):
             GPIO_TO_AIN = {v: k for k, v in AIN_TO_GPIO.items()}
             pin_number = GPIO_TO_AIN[pin_number]
-        zephyr_add_overlay_builder(_overlay_io_channels)
-        zephyr_add_overlay(f"""
+        zephyr_add_user("io-channels", f"<&adc {channel_id}>")
+        zephyr_add_overlay(
+            f"""
                 &adc {{
                     #address-cells = <1>;
                     #size-cells = <0>;
@@ -209,7 +190,8 @@ async def to_code(config):
                         zephyr,oversampling = <8>;
                     }};
                 }};
-            """)
+            """
+        )
 
 
 FILTER_SOURCE_FILES = filter_source_files_from_platform(
@@ -219,7 +201,7 @@ FILTER_SOURCE_FILES = filter_source_files_from_platform(
             PlatformFramework.ESP32_IDF,
         },
         "adc_sensor_esp8266.cpp": {PlatformFramework.ESP8266_ARDUINO},
-        "adc_sensor_rp2.cpp": {PlatformFramework.RP2_ARDUINO},
+        "adc_sensor_rp2040.cpp": {PlatformFramework.RP2040_ARDUINO},
         "adc_sensor_libretiny.cpp": {
             PlatformFramework.BK72XX_ARDUINO,
             PlatformFramework.RTL87XX_ARDUINO,

esphome/components/airthings_ble/__init__.py

@@ -1,26 +1,23 @@
 import esphome.codegen as cg
-from esphome.components import ble_device_base
+from esphome.components import esp32_ble_tracker
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
 
-AUTO_LOAD = ["ble_device_base"]
+DEPENDENCIES = ["esp32_ble_tracker"]
 CODEOWNERS = ["@jeromelaban"]
 
 airthings_ble_ns = cg.esphome_ns.namespace("airthings_ble")
 AirthingsListener = airthings_ble_ns.class_(
-    "AirthingsListener", ble_device_base.ESPBTDeviceListener
+    "AirthingsListener", esp32_ble_tracker.ESPBTDeviceListener
 )
 
-CONFIG_SCHEMA = cv.All(
-    ble_device_base.rename_legacy_hub_id("airthings_ble"),
-    cv.Schema(
-        {
-            cv.GenerateID(): cv.declare_id(AirthingsListener),
-        }
-    ).extend(ble_device_base.BLE_DEVICE_SCHEMA),
-)
+CONFIG_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(): cv.declare_id(AirthingsListener),
+    }
+).extend(esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA)
 
 
 async def to_code(config):
     var = cg.new_Pvariable(config[CONF_ID])
-    await ble_device_base.register_ble_device(var, config)
+    await esp32_ble_tracker.register_ble_device(var, config)

esphome/components/airthings_ble/airthings_listener.cpp

@@ -2,13 +2,15 @@
 #include "esphome/core/log.h"
 #include <cinttypes>
 
+#ifdef USE_ESP32
+
 namespace esphome::airthings_ble {
 
 static const char *const TAG = "airthings_ble";
 
-bool AirthingsListener::parse_device(const ble_device_base::ESPBTDevice &device) {
+bool AirthingsListener::parse_device(const esp32_ble_tracker::ESPBTDevice &device) {
   for (auto &it : device.get_manufacturer_datas()) {
-    if (it.uuid == ble_device_base::ESPBTUUID::from_uint32(0x0334)) {
+    if (it.uuid == esp32_ble_tracker::ESPBTUUID::from_uint32(0x0334)) {
       if (it.data.size() < 4)
         continue;
 
@@ -27,3 +29,5 @@ bool AirthingsListener::parse_device(const ble_device_base::ESPBTDevice &device)
 }
 
 }  // namespace esphome::airthings_ble
+
+#endif

esphome/components/airthings_ble/airthings_listener.h

@@ -1,13 +1,17 @@
 #pragma once
 
+#ifdef USE_ESP32
+
 #include "esphome/core/component.h"
-#include "esphome/components/ble_device_base/ble_device.h"
+#include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 
 namespace esphome::airthings_ble {
 
-class AirthingsListener final : public ble_device_base::ESPBTDeviceListener {
+class AirthingsListener final : public esp32_ble_tracker::ESPBTDeviceListener {
  public:
-  bool parse_device(const ble_device_base::ESPBTDevice &device) override;
+  bool parse_device(const esp32_ble_tracker::ESPBTDevice &device) override;
 };
 
 }  // namespace esphome::airthings_ble
+
+#endif

esphome/components/am43/cover/am43_cover.cpp

@@ -114,13 +114,13 @@ void Am43Component::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_
       this->decoder_->decode(param->notify.value, param->notify.value_len);
 
       if (this->decoder_->has_position()) {
-        this->position = ((float) this->decoder_->position_ / 100.0f);
+        this->position = ((float) this->decoder_->position_ / 100.0);
         if (!this->invert_position_)
           this->position = 1 - this->position;
-        if (this->position > 0.97f)
-          this->position = 1.0f;
-        if (this->position < 0.02f)
-          this->position = 0.0f;
+        if (this->position > 0.97)
+          this->position = 1.0;
+        if (this->position < 0.02)
+          this->position = 0.0;
         this->publish_state();
       }
 

esphome/components/animation/__init__.py

@@ -1,41 +1,114 @@
-# ---------------------------------------------------------------------------
-# Legacy top-level `animation:` deprecation shim -- REMOVE this whole file after
-# 2027.1.0.
-#
-# Animations are now a platform of the `image:` component (`platform:
-# animation`); the real schema, actions and codegen live in `image.py`. This
-# module only keeps the deprecated top-level `animation:` key working during the
-# deprecation window: it reuses that schema/codegen and adds a one-shot
-# deprecation warning (with a pasteable migrated `image:` block) at validation
-# time. Deleting this file drops the top-level form entirely.
-# ---------------------------------------------------------------------------
+import logging
 
+from esphome import automation
+import esphome.codegen as cg
+from esphome.components.const import CONF_LOOP
 import esphome.components.image as espImage
 import esphome.config_validation as cv
+from esphome.const import CONF_ID, CONF_REPEAT
 
-from . import image as animation_image
-from .image import ANIMATION_CONFIG_SCHEMA, setup_animation
+_LOGGER = logging.getLogger(__name__)
 
-# The deprecated top-level `animation:` shim gets the same batched
-# downloads as the `image:` platform form.
-PREFETCH_FILES = animation_image.PREFETCH_FILES
-
-AUTO_LOAD = ["image", "file"]
+AUTO_LOAD = ["image"]
 CODEOWNERS = ["@syndlex"]
 DEPENDENCIES = ["display"]
 MULTI_CONF = True
 MULTI_CONF_NO_DEFAULT = True
 
-DOMAIN = "animation"
+CONF_START_FRAME = "start_frame"
+CONF_END_FRAME = "end_frame"
+CONF_FRAME = "frame"
 
-LEGACY_REMOVAL_VERSION = "2027.1.0"
+animation_ns = cg.esphome_ns.namespace("animation")
 
-_capture_legacy_entry, _warn_legacy_animation = (
-    espImage.legacy_platform_migration_warning(DOMAIN, DOMAIN, LEGACY_REMOVAL_VERSION)
+Animation_ = animation_ns.class_("Animation", espImage.Image_)
+
+# Actions
+NextFrameAction = animation_ns.class_(
+    "AnimationNextFrameAction", automation.Action, cg.Parented.template(Animation_)
+)
+PrevFrameAction = animation_ns.class_(
+    "AnimationPrevFrameAction", automation.Action, cg.Parented.template(Animation_)
+)
+SetFrameAction = animation_ns.class_(
+    "AnimationSetFrameAction", automation.Action, cg.Parented.template(Animation_)
 )
 
-CONFIG_SCHEMA = cv.All(_capture_legacy_entry, ANIMATION_CONFIG_SCHEMA)
+CONFIG_SCHEMA = cv.All(
+    espImage.IMAGE_SCHEMA.extend(
+        {
+            cv.Required(CONF_ID): cv.declare_id(Animation_),
+            cv.Optional(CONF_LOOP): cv.All(
+                {
+                    cv.Optional(CONF_START_FRAME, default=0): cv.positive_int,
+                    cv.Optional(CONF_END_FRAME): cv.positive_int,
+                    cv.Optional(CONF_REPEAT): cv.positive_int,
+                }
+            ),
+        },
+    ),
+    espImage.validate_settings,
+)
 
-FINAL_VALIDATE_SCHEMA = _warn_legacy_animation
 
-to_code = setup_animation
+NEXT_FRAME_SCHEMA = automation.maybe_simple_id(
+    {
+        cv.GenerateID(): cv.use_id(Animation_),
+    }
+)
+PREV_FRAME_SCHEMA = automation.maybe_simple_id(
+    {
+        cv.GenerateID(): cv.use_id(Animation_),
+    }
+)
+SET_FRAME_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(): cv.use_id(Animation_),
+        cv.Required(CONF_FRAME): cv.uint16_t,
+    }
+)
+
+
+@automation.register_action(
+    "animation.next_frame", NextFrameAction, NEXT_FRAME_SCHEMA, synchronous=True
+)
+@automation.register_action(
+    "animation.prev_frame", PrevFrameAction, PREV_FRAME_SCHEMA, synchronous=True
+)
+@automation.register_action(
+    "animation.set_frame", SetFrameAction, SET_FRAME_SCHEMA, synchronous=True
+)
+async def animation_action_to_code(config, action_id, template_arg, args):
+    paren = await cg.get_variable(config[CONF_ID])
+    var = cg.new_Pvariable(action_id, template_arg, paren)
+
+    if (frame := config.get(CONF_FRAME)) is not None:
+        template_ = await cg.templatable(frame, args, cg.uint16)
+        cg.add(var.set_frame(template_))
+    return var
+
+
+async def to_code(config):
+    (
+        prog_arr,
+        width,
+        height,
+        image_type,
+        trans_value,
+        frame_count,
+    ) = await espImage.write_image(config, all_frames=True)
+
+    var = cg.new_Pvariable(
+        config[CONF_ID],
+        prog_arr,
+        width,
+        height,
+        frame_count,
+        image_type,
+        trans_value,
+    )
+    if loop_config := config.get(CONF_LOOP):
+        start = loop_config[CONF_START_FRAME]
+        end = loop_config.get(CONF_END_FRAME, frame_count)
+        count = loop_config.get(CONF_REPEAT, -1)
+        cg.add(var.set_loop(start, end, count))

esphome/components/animation/image.py

@@ -1,120 +0,0 @@
-from esphome import automation
-import esphome.codegen as cg
-from esphome.components.const import CONF_LOOP
-from esphome.components.file import image as file_image
-from esphome.components.file.image import image_schema, write_image
-from esphome.components.image import Image_, validate_settings
-import esphome.config_validation as cv
-from esphome.const import CONF_ID, CONF_REPEAT
-from esphome.types import ConfigType
-
-CODEOWNERS = ["@syndlex"]
-
-# The animation platform shares the file platform's remote file handling,
-# including its batch-download hook.
-PREFETCH_FILES = file_image.PREFETCH_FILES
-AUTO_LOAD = ["file"]
-DEPENDENCIES = ["display"]
-
-CONF_START_FRAME = "start_frame"
-CONF_END_FRAME = "end_frame"
-CONF_FRAME = "frame"
-
-animation_ns = cg.esphome_ns.namespace("animation")
-
-Animation_ = animation_ns.class_("Animation", Image_)
-
-# Actions
-NextFrameAction = animation_ns.class_(
-    "AnimationNextFrameAction", automation.Action, cg.Parented.template(Animation_)
-)
-PrevFrameAction = animation_ns.class_(
-    "AnimationPrevFrameAction", automation.Action, cg.Parented.template(Animation_)
-)
-SetFrameAction = animation_ns.class_(
-    "AnimationSetFrameAction", automation.Action, cg.Parented.template(Animation_)
-)
-
-ANIMATION_SCHEMA = image_schema(Animation_).extend(
-    {
-        cv.Optional(CONF_LOOP): cv.All(
-            {
-                cv.Optional(CONF_START_FRAME, default=0): cv.positive_int,
-                cv.Optional(CONF_END_FRAME): cv.positive_int,
-                cv.Optional(CONF_REPEAT): cv.positive_int,
-            }
-        ),
-    },
-)
-
-# Shared schema used by both the (deprecated) top-level `animation:` key and the
-# `image:` `platform: animation` entry.
-ANIMATION_CONFIG_SCHEMA = cv.All(ANIMATION_SCHEMA, validate_settings)
-
-
-NEXT_FRAME_SCHEMA = automation.maybe_simple_id(
-    {
-        cv.GenerateID(): cv.use_id(Animation_),
-    }
-)
-PREV_FRAME_SCHEMA = automation.maybe_simple_id(
-    {
-        cv.GenerateID(): cv.use_id(Animation_),
-    }
-)
-SET_FRAME_SCHEMA = cv.Schema(
-    {
-        cv.GenerateID(): cv.use_id(Animation_),
-        cv.Required(CONF_FRAME): cv.uint16_t,
-    }
-)
-
-
-@automation.register_action(
-    "animation.next_frame", NextFrameAction, NEXT_FRAME_SCHEMA, synchronous=True
-)
-@automation.register_action(
-    "animation.prev_frame", PrevFrameAction, PREV_FRAME_SCHEMA, synchronous=True
-)
-@automation.register_action(
-    "animation.set_frame", SetFrameAction, SET_FRAME_SCHEMA, synchronous=True
-)
-async def animation_action_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    var = cg.new_Pvariable(action_id, template_arg, paren)
-
-    if (frame := config.get(CONF_FRAME)) is not None:
-        template_ = await cg.templatable(frame, args, cg.uint16)
-        cg.add(var.set_frame(template_))
-    return var
-
-
-async def setup_animation(config: ConfigType) -> None:
-    (
-        prog_arr,
-        width,
-        height,
-        image_type,
-        trans_value,
-        frame_count,
-    ) = await write_image(config, all_frames=True)
-
-    var = cg.new_Pvariable(
-        config[CONF_ID],
-        prog_arr,
-        width,
-        height,
-        frame_count,
-        image_type,
-        trans_value,
-    )
-    if loop_config := config.get(CONF_LOOP):
-        start = loop_config[CONF_START_FRAME]
-        end = loop_config.get(CONF_END_FRAME, frame_count)
-        count = loop_config.get(CONF_REPEAT, -1)
-        cg.add(var.set_loop(start, end, count))
-
-
-CONFIG_SCHEMA = ANIMATION_CONFIG_SCHEMA
-
-to_code = setup_animation

esphome/components/anova/anova_base.cpp

@@ -6,9 +6,9 @@
 
 namespace esphome::anova {
 
-float ftoc(float f) { return (f - 32.0f) * (5.0f / 9.0f); }
+float ftoc(float f) { return (f - 32.0) * (5.0f / 9.0f); }
 
-float ctof(float c) { return (c * 9.0f / 5.0f) + 32.0f; }
+float ctof(float c) { return (c * 9.0f / 5.0f) + 32.0; }
 
 AnovaPacket *AnovaCodec::clean_packet_() {
   this->packet_.length = strlen((char *) this->packet_.data);

esphome/components/api/__init__.py

@@ -13,7 +13,6 @@ from esphome.const import (
     CONF_CAPTURE_RESPONSE,
     CONF_DATA,
     CONF_DATA_TEMPLATE,
-    CONF_ENCRYPTION,
     CONF_EVENT,
     CONF_ID,
     CONF_KEY,
@@ -103,6 +102,7 @@ SERVICE_ARG_FALLBACK_TYPES: dict[str, MockObj] = {
         for name, t in _SERVICE_ARG_SCALAR_TYPES.items()
     },
 }
+CONF_ENCRYPTION = "encryption"
 CONF_BATCH_DELAY = "batch_delay"
 CONF_CUSTOM_SERVICES = "custom_services"
 CONF_HOMEASSISTANT_SERVICES = "homeassistant_services"
@@ -112,23 +112,6 @@ CONF_MAX_SEND_QUEUE = "max_send_queue"
 CONF_STATE_SUBSCRIPTION_ONLY = "state_subscription_only"
 
 
-def _register_provisioning_source(config: ConfigType) -> ConfigType:
-    """Register the API as a provisioning source when encryption is enabled.
-
-    With no ``key`` the device boots unprovisioned and is set up on first
-    connection; a YAML ``key`` means it is born provisioned. Either way the API
-    drives the provisioning manager, so it counts as a source for `provisioning:`.
-    A hardcoded ``key`` is reported so `provisioning:` can warn about it.
-    """
-    if (encryption := config.get(CONF_ENCRYPTION)) is not None:
-        from esphome.components import provisioning
-
-        provisioning.register_source("api")
-        if CONF_KEY in encryption:
-            provisioning.report_hardcoded_credentials("api")
-    return config
-
-
 def validate_encryption_key(value):
     value = cv.string_strict(value)
     try:
@@ -317,23 +300,21 @@ CONFIG_SCHEMA = cv.All(
                 CONF_LISTEN_BACKLOG,
                 esp8266=1,  # Limited RAM (~40KB free), LWIP raw sockets
                 esp32=4,  # More RAM (520KB), BSD sockets
-                rp2=1,  # Limited RAM (264KB), LWIP raw sockets like ESP8266
+                rp2040=1,  # Limited RAM (264KB), LWIP raw sockets like ESP8266
                 bk72xx=4,  # Moderate RAM, BSD-style sockets
                 rtl87xx=4,  # Moderate RAM, BSD-style sockets
                 host=4,  # Abundant resources
                 ln882x=4,  # Moderate RAM
-                nrf52=4,  # ~256KB RAM, BSD sockets
             ): cv.int_range(min=1, max=10),
             cv.SplitDefault(
                 CONF_MAX_CONNECTIONS,
                 esp8266=4,  # ~40KB free RAM, each connection uses ~500-1000 bytes
                 esp32=5,  # 520KB RAM available
-                rp2=4,  # 264KB RAM but LWIP constraints
+                rp2040=4,  # 264KB RAM but LWIP constraints
                 bk72xx=5,  # Moderate RAM
                 rtl87xx=5,  # Moderate RAM
                 host=8,  # Abundant resources
                 ln882x=5,  # Moderate RAM
-                nrf52=4,  # ~256KB RAM, BSD sockets, Thread (single HA controller)
             ): cv.int_range(min=1, max=20),
             # Maximum queued send buffers per connection before dropping connection
             # Each buffer uses ~8-12 bytes overhead plus actual message size
@@ -343,7 +324,7 @@ CONFIG_SCHEMA = cv.All(
                 CONF_MAX_SEND_QUEUE,
                 esp8266=4,  # Limited RAM, need to fail fast
                 esp32=8,  # More RAM, can buffer more
-                rp2=8,  # Moderate RAM
+                rp2040=8,  # Moderate RAM
                 bk72xx=8,  # Moderate RAM
                 nrf52=8,  # Moderate RAM
                 rtl87xx=8,  # Moderate RAM
@@ -354,7 +335,6 @@ CONFIG_SCHEMA = cv.All(
     ).extend(cv.COMPONENT_SCHEMA),
     cv.rename_key(CONF_SERVICES, CONF_ACTIONS),
     _consume_api_sockets,
-    _register_provisioning_source,
 )
 
 
@@ -488,16 +468,13 @@ async def to_code(config: ConfigType) -> None:
             cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
         else:
             # No key provided, but encryption desired
-            # Until a key is set, the device accepts both Noise connections
-            # using the well-known all-zeros PSK (preferred: the key travels
-            # encrypted, protecting against passive sniffing) and plaintext
-            # connections (deprecated, remove after 2027.2.0) so a client can
-            # provide a noise key and the device then switches to noise only.
+            # This will allow a plaintext client to provide a noise key,
+            # send it to the device, and then switch to noise.
             # The key will be saved in flash and used for future connections
             # and plaintext disabled. Only a factory reset can remove it.
             cg.add_define("USE_API_PLAINTEXT")
         cg.add_define("USE_API_NOISE")
-        cg.add_library("esphome/noise-c", "0.1.21")
+        cg.add_library("esphome/noise-c", "0.1.11")
         # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
         cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
         cg.add_build_flag("-DHAVE_INLINE_ASM=1")
@@ -561,20 +538,17 @@ HOMEASSISTANT_ACTION_ACTION_SCHEMA = cv.All(
 )
 
 
-# synchronous=False: when on_success/on_error is configured, play() stores the
-# trigger args until the HomeassistantActionResponse arrives, so non-owning args
-# (StringRef into the API receive buffer) must not be used.
 @automation.register_action(
     "homeassistant.action",
     HomeAssistantServiceCallAction,
     HOMEASSISTANT_ACTION_ACTION_SCHEMA,
-    synchronous=False,
+    synchronous=True,
 )
 @automation.register_action(
     "homeassistant.service",
     HomeAssistantServiceCallAction,
     HOMEASSISTANT_ACTION_ACTION_SCHEMA,
-    synchronous=False,
+    synchronous=True,
 )
 async def homeassistant_service_to_code(
     config: ConfigType,
@@ -668,8 +642,6 @@ HOMEASSISTANT_EVENT_ACTION_SCHEMA = cv.Schema(
 )
 
 
-# synchronous=True is safe here: the event schema has no on_success/on_error,
-# so play() never stores the trigger args.
 @automation.register_action(
     "homeassistant.event",
     HomeAssistantServiceCallAction,

esphome/components/api/api.proto

@@ -19,7 +19,6 @@ service APIConnection {
   rpc device_info (DeviceInfoRequest) returns (DeviceInfoResponse) {
     option (needs_authentication) = false;
   }
-  rpc device_capabilities (DeviceCapabilitiesRequest) returns (DeviceCapabilitiesResponse) {}
   rpc list_entities (ListEntitiesRequest) returns (void) {}
   rpc subscribe_states (SubscribeStatesRequest) returns (void) {}
   rpc subscribe_logs (SubscribeLogsRequest) returns (void) {}
@@ -159,16 +158,6 @@ message AuthenticationResponse {
   bool invalid_password = 1;
 }
 
-// Reason a party is requesting the connection be closed.
-enum DisconnectReason {
-  // No specific reason / not provided (default for older peers).
-  DISCONNECT_REASON_UNSPECIFIED = 0;
-  // The device's provisioning window has expired. The device must be reset
-  // (power-cycled) to reopen the provisioning window before it will accept a
-  // connection again.
-  DISCONNECT_REASON_PROVISIONING_CLOSED = 1;
-}
-
 // Request to close the connection.
 // Can be sent by both the client and server
 message DisconnectRequest {
@@ -177,10 +166,6 @@ message DisconnectRequest {
   option (no_delay) = true;
 
   // Do not close the connection before the acknowledgement arrives
-
-  // Optional reason the connection is being closed. Older peers that do not
-  // send this field will report DISCONNECT_REASON_UNSPECIFIED (0).
-  DisconnectReason reason = 1;
 }
 
 message DisconnectResponse {
@@ -244,12 +229,6 @@ message SerialProxyInfo {
 //   model = 127 (core/config.BOARD_MAX_LENGTH, validated in platform schemas)
 //   project_name/project_version = 127 (core/config.PROJECT_MAX_LENGTH)
 //   suggested_area = 120 (core/config.FRIENDLY_NAME_MAX_LEN via AREA_SCHEMA)
-//
-// Some fields below are marked "Superseded by DeviceCapabilitiesResponse". They
-// have moved to that message as of API 1.15, but are still sent here so that
-// older clients keep working. Do NOT mark them (deprecated) until the removal
-// release: in this repo (deprecated) makes the generator drop the field
-// entirely, so the device would stop sending it.
 message DeviceInfoResponse {
   option (id) = 10;
   option (source) = SOURCE_SERVER;
@@ -287,8 +266,6 @@ message DeviceInfoResponse {
 
   // Deprecated in API version 1.9
   uint32 legacy_bluetooth_proxy_version = 11 [deprecated=true, (field_ifdef) = "USE_BLUETOOTH_PROXY"];
-
-  // Superseded by DeviceCapabilitiesResponse.bluetooth_proxy as of API 1.15.
   uint32 bluetooth_proxy_feature_flags = 15 [(field_ifdef) = "USE_BLUETOOTH_PROXY"];
 
   string manufacturer = 12 [(max_data_length) = 20, (force) = true];
@@ -297,14 +274,11 @@ message DeviceInfoResponse {
 
   // Deprecated in API version 1.10
   uint32 legacy_voice_assistant_version = 14 [deprecated=true, (field_ifdef) = "USE_VOICE_ASSISTANT"];
-
-  // Superseded by DeviceCapabilitiesResponse.voice_assistant as of API 1.15.
   uint32 voice_assistant_feature_flags = 17 [(field_ifdef) = "USE_VOICE_ASSISTANT"];
 
   string suggested_area = 16 [(max_data_length) = 120, (force) = true, (field_ifdef) = "USE_AREAS"];
 
   // The Bluetooth mac address of the device. For example "AC:BC:32:89:0E:AA"
-  // Superseded by DeviceCapabilitiesResponse.bluetooth_proxy.mac_address as of API 1.15.
   string bluetooth_mac_address = 18 [(max_data_length) = 17, (force) = true, (field_ifdef) = "USE_BLUETOOTH_PROXY"];
 
   // Supports receiving and saving api encryption key
@@ -317,76 +291,11 @@ message DeviceInfoResponse {
   AreaInfo area = 22 [(field_ifdef) = "USE_AREAS"];
 
   // Indicates if Z-Wave proxy support is available and features supported
-  // Superseded by DeviceCapabilitiesResponse.zwave_proxy as of API 1.15.
   uint32 zwave_proxy_feature_flags = 23 [(field_ifdef) = "USE_ZWAVE_PROXY"];
-  // Superseded by DeviceCapabilitiesResponse.zwave_proxy as of API 1.15.
   uint32 zwave_home_id = 24 [(field_ifdef) = "USE_ZWAVE_PROXY"];
 
   // Serial proxy instance metadata
-  // Superseded by DeviceCapabilitiesResponse.serial_proxies as of API 1.15.
   repeated SerialProxyInfo serial_proxies = 25 [(field_ifdef) = "USE_SERIAL_PROXY", (fixed_array_size_define) = "SERIAL_PROXY_COUNT"];
-
-  // Device is unprovisioned and accepts Noise handshakes with the well-known
-  // all-zeros PSK, so the api encryption key can be provisioned without being
-  // sent in plaintext (protects against passive sniffing, not active MITM)
-  bool api_encryption_provisionable = 26 [(field_ifdef) = "USE_API_NOISE"];
-}
-
-// ==================== DEVICE CAPABILITIES ====================
-
-// Asks the device which optional features it supports.
-//
-// This message exists so that DeviceInfoResponse does not have to keep growing
-// a flat list of feature flags. DeviceInfoResponse is served before
-// authentication, so it is limited to identity information. Capabilities are
-// only served on an authenticated connection (encrypted as well, when
-// encryption is configured).
-//
-// Clients that see api_version >= 1.15 should read these values from
-// DeviceCapabilitiesResponse and ignore the matching DeviceInfoResponse fields.
-// Older clients keep reading DeviceInfoResponse, which still carries the same
-// values, so this is not a breaking change.
-message DeviceCapabilitiesRequest {
-  option (id) = 149;
-  option (source) = SOURCE_CLIENT;
-  // Empty
-}
-
-// Each feature gets its own sub-message so that it can gain fields over time
-// without crowding the top-level field numbering.
-//
-// Note: a sub-message whose fields are all at their default value is not sent
-// at all, so the presence of a sub-message is not a reliable test for "this
-// feature is compiled in". Clients should test a value inside it, for example
-// a non-zero feature_flags, exactly as they do today with DeviceInfoResponse.
-
-message BluetoothProxyCapabilities {
-  // Bitmask of the features this proxy supports
-  uint32 feature_flags = 1;
-  // The Bluetooth mac address of the device. For example "AC:BC:32:89:0E:AA"
-  string mac_address = 2 [(max_data_length) = 17, (force) = true];
-}
-
-message VoiceAssistantCapabilities {
-  // Bitmask of the features this voice assistant supports
-  uint32 feature_flags = 1;
-}
-
-message ZWaveProxyCapabilities {
-  // Bitmask of the features this proxy supports
-  uint32 feature_flags = 1;
-  uint32 home_id = 2;
-}
-
-message DeviceCapabilitiesResponse {
-  option (id) = 150;
-  option (source) = SOURCE_SERVER;
-
-  BluetoothProxyCapabilities bluetooth_proxy = 1 [(field_ifdef) = "USE_BLUETOOTH_PROXY"];
-  VoiceAssistantCapabilities voice_assistant = 2 [(field_ifdef) = "USE_VOICE_ASSISTANT"];
-  ZWaveProxyCapabilities zwave_proxy = 3 [(field_ifdef) = "USE_ZWAVE_PROXY"];
-  repeated SerialProxyInfo serial_proxies = 4
-      [(field_ifdef) = "USE_SERIAL_PROXY", (fixed_array_size_define) = "SERIAL_PROXY_COUNT"];
 }
 
 message ListEntitiesRequest {
@@ -1760,7 +1669,7 @@ enum BluetoothDeviceRequestType {
 message BluetoothDeviceRequest {
   option (id) = 68;
   option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   BluetoothDeviceRequestType request_type = 2;
@@ -1771,7 +1680,7 @@ message BluetoothDeviceRequest {
 message BluetoothDeviceConnectionResponse {
   option (id) = 69;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   bool connected = 2;
@@ -1782,7 +1691,7 @@ message BluetoothDeviceConnectionResponse {
 message BluetoothGATTGetServicesRequest {
   option (id) = 70;
   option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
 }
@@ -1826,7 +1735,7 @@ message BluetoothGATTService {
 message BluetoothGATTGetServicesResponse {
   option (id) = 71;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   repeated BluetoothGATTService services = 2;
@@ -1835,7 +1744,7 @@ message BluetoothGATTGetServicesResponse {
 message BluetoothGATTGetServicesDoneResponse {
   option (id) = 72;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
 }
@@ -1843,7 +1752,7 @@ message BluetoothGATTGetServicesDoneResponse {
 message BluetoothGATTReadRequest {
   option (id) = 73;
   option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1852,7 +1761,7 @@ message BluetoothGATTReadRequest {
 message BluetoothGATTReadResponse {
   option (id) = 74;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1864,7 +1773,7 @@ message BluetoothGATTReadResponse {
 message BluetoothGATTWriteRequest {
   option (id) = 75;
   option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1876,7 +1785,7 @@ message BluetoothGATTWriteRequest {
 message BluetoothGATTReadDescriptorRequest {
   option (id) = 76;
   option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1885,7 +1794,7 @@ message BluetoothGATTReadDescriptorRequest {
 message BluetoothGATTWriteDescriptorRequest {
   option (id) = 77;
   option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1896,7 +1805,7 @@ message BluetoothGATTWriteDescriptorRequest {
 message BluetoothGATTNotifyRequest {
   option (id) = 78;
   option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1906,7 +1815,7 @@ message BluetoothGATTNotifyRequest {
 message BluetoothGATTNotifyDataResponse {
   option (id) = 79;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1917,13 +1826,13 @@ message BluetoothGATTNotifyDataResponse {
 message SubscribeBluetoothConnectionsFreeRequest {
   option (id) = 80;
   option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 }
 
 message BluetoothConnectionsFreeResponse {
   option (id) = 81;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint32 free = 1;
   uint32 limit = 2;
@@ -1936,7 +1845,7 @@ message BluetoothConnectionsFreeResponse {
 message BluetoothGATTErrorResponse {
   option (id) = 82;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1946,7 +1855,7 @@ message BluetoothGATTErrorResponse {
 message BluetoothGATTWriteResponse {
   option (id) = 83;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1955,7 +1864,7 @@ message BluetoothGATTWriteResponse {
 message BluetoothGATTNotifyResponse {
   option (id) = 84;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 handle = 2;
@@ -1964,7 +1873,7 @@ message BluetoothGATTNotifyResponse {
 message BluetoothDevicePairingResponse {
   option (id) = 85;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   bool paired = 2;
@@ -1974,7 +1883,7 @@ message BluetoothDevicePairingResponse {
 message BluetoothDeviceUnpairingResponse {
   option (id) = 86;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   bool success = 2;
@@ -1990,7 +1899,7 @@ message UnsubscribeBluetoothLEAdvertisementsRequest {
 message BluetoothDeviceClearCacheResponse {
   option (id) = 88;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   bool success = 2;
@@ -2807,7 +2716,7 @@ message SerialProxyRequestResponse {
 message BluetoothSetConnectionParamsRequest {
   option (id) = 145;
   option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   uint32 min_interval = 2;  // units of 1.25ms
@@ -2819,7 +2728,7 @@ message BluetoothSetConnectionParamsRequest {
 message BluetoothSetConnectionParamsResponse {
   option (id) = 146;
   option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_BLUETOOTH_PROXY_CONNECTIONS";
+  option (ifdef) = "USE_BLUETOOTH_PROXY";
 
   uint64 address = 1;
   int32 error = 2;

esphome/components/api/api_connection.cpp

@@ -23,12 +23,8 @@
 #include "esphome/core/application.h"
 #include "esphome/core/entity_base.h"
 #include "esphome/core/hal.h"
-#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/version.h"
-#ifdef USE_PROVISIONING
-#include "esphome/components/provisioning/provisioning.h"
-#endif
 
 #ifdef USE_DEEP_SLEEP
 #include "esphome/components/deep_sleep/deep_sleep_component.h"
@@ -89,13 +85,6 @@ static_assert(ESPHOME_DEVICE_NAME_MAX_LEN <= 31, "Update max_data_length for nam
 static_assert(ESPHOME_FRIENDLY_NAME_MAX_LEN <= 120, "Update max_data_length for friendly_name in api.proto");
 
 static const char *const TAG = "api.connection";
-
-#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_WARN
-void log_dropped_message(const char *tag, int line, const LogString *what) {
-  esp_log_printf_(ESPHOME_LOG_LEVEL_WARN, tag, line, ESPHOME_LOG_FORMAT("%s dropped, TCP buffer full"),
-                  LOG_STR_ARG(what));
-}
-#endif
 #ifdef USE_CAMERA
 static const int CAMERA_STOP_STREAM = 5000;
 #endif
@@ -160,6 +149,11 @@ APIConnection::APIConnection(std::unique_ptr<socket::Socket> sock, APIServer *pa
 #else
 #error "No frame helper defined"
 #endif
+#ifdef USE_CAMERA
+  if (camera::Camera::instance() != nullptr) {
+    this->image_reader_ = std::unique_ptr<camera::CameraImageReader>{camera::Camera::instance()->create_image_reader()};
+  }
+#endif
 }
 
 void APIConnection::start() {
@@ -201,29 +195,6 @@ APIConnection::~APIConnection() {
 #endif
 }
 
-#if defined(USE_API_NOISE) && defined(USE_API_PLAINTEXT)
-void APIConnection::upgrade_helper_to_noise_() {
-  // The client opened with a Noise hello while this device has no encryption
-  // key set. Replace the plaintext helper with a Noise helper so the key can
-  // be provisioned over an encrypted channel: the noise context PSK is all
-  // zeros when unprovisioned, and NNpsk0 still runs a fresh ephemeral X25519
-  // exchange, so a passive listener cannot read the session. A publicly known
-  // PSK authenticates nobody; this protects against sniffing only.
-  auto *plaintext = static_cast<APIPlaintextFrameHelper *>(this->helper_.get());
-  uint8_t header[3];
-  uint8_t header_len = plaintext->get_consumed_header(header);
-  auto *noise = new APINoiseFrameHelper(plaintext->release_socket_for_switch(), this->parent_->get_noise_ctx());
-  // Carry over the peername-based client name (Hello has not arrived yet)
-  const char *name = plaintext->get_client_name();
-  noise->set_client_name(name, strlen(name));
-  this->helper_.reset(noise);  // destroys the plaintext helper
-  APIError err = noise->init_from_handoff(header, header_len);
-  if (err != APIError::OK) {
-    this->fatal_error_with_log_(LOG_STR("Noise handoff failed"), err);
-  }
-}
-#endif  // USE_API_NOISE && USE_API_PLAINTEXT
-
 void APIConnection::destroy_active_iterator_() {
   switch (this->active_iterator_) {
     case ActiveIterator::LIST_ENTITIES:
@@ -282,15 +253,6 @@ void APIConnection::loop() {
         // No more data available
         break;
       } else if (err != APIError::OK) {
-#if defined(USE_API_NOISE) && defined(USE_API_PLAINTEXT)
-        // Checked inside the error branch to keep the hot err == OK path
-        // free of it; this can only fire on the first bytes of a plaintext
-        // helper on an unprovisioned device
-        if (err == APIError::PROTOCOL_SWITCH_TO_NOISE) {
-          this->upgrade_helper_to_noise_();
-          return;
-        }
-#endif
         this->fatal_error_with_log_(LOG_STR("Reading failed"), err);
         return;
       } else {
@@ -797,7 +759,6 @@ uint16_t APIConnection::try_send_climate_info(EntityBase *entity, APIConnection
   msg.supports_action = traits.has_feature_flags(climate::CLIMATE_SUPPORTS_ACTION);
   // Current feature flags and other supported parameters
   msg.feature_flags = traits.get_feature_flags();
-  msg.temperature_unit = static_cast<enums::TemperatureUnit>(traits.get_temperature_unit());
   msg.supported_modes = &traits.get_supported_modes();
   msg.visual_min_temperature = traits.get_visual_min_temperature();
   msg.visual_max_temperature = traits.get_visual_max_temperature();
@@ -1135,7 +1096,6 @@ void APIConnection::try_send_camera_image_() {
   if (!this->image_reader_)
     return;
 
-  const auto *cam = camera::Camera::instance();
   // Send as many chunks as possible without blocking
   while (this->image_reader_->available()) {
     if (!this->helper_->can_write_without_blocking())
@@ -1145,11 +1105,11 @@ void APIConnection::try_send_camera_image_() {
     bool done = this->image_reader_->available() == to_send;
 
     CameraImageResponse msg;
-    msg.key = cam->get_object_id_hash();
+    msg.key = camera::Camera::instance()->get_object_id_hash();
     msg.set_data(this->image_reader_->peek_data_buffer(), to_send);
     msg.done = done;
 #ifdef USE_DEVICES
-    msg.device_id = cam->get_device_id();
+    msg.device_id = camera::Camera::instance()->get_device_id();
 #endif
 
     if (!this->send_message(msg)) {
@@ -1165,19 +1125,15 @@ void APIConnection::try_send_camera_image_() {
 void APIConnection::set_camera_state(std::shared_ptr<camera::CameraImage> image) {
   if (!this->flags_.state_subscription)
     return;
-  if (this->image_reader_ && this->image_reader_->available())
+  if (!this->image_reader_)
     return;
-  if (!image->was_requested_by(esphome::camera::API_REQUESTER) && !image->was_requested_by(esphome::camera::IDLE))
+  if (this->image_reader_->available())
     return;
-  if (!this->image_reader_) {
-    // Created on the first image this connection will send, so connections
-    // that never receive one never pay for a reader. Only a registered
-    // camera's listener can reach this, so instance() is non-null here.
-    this->image_reader_ = std::unique_ptr<camera::CameraImageReader>{camera::Camera::instance()->create_image_reader()};
+  if (image->was_requested_by(esphome::camera::API_REQUESTER) || image->was_requested_by(esphome::camera::IDLE)) {
+    this->image_reader_->set_image(std::move(image));
+    // Try to send immediately to reduce latency
+    this->try_send_camera_image_();
   }
-  this->image_reader_->set_image(std::move(image));
-  // Try to send immediately to reduce latency
-  this->try_send_camera_image_();
 }
 uint16_t APIConnection::try_send_camera_info(EntityBase *entity, APIConnection *conn, uint32_t remaining_size) {
   auto *camera = static_cast<camera::Camera *>(entity);
@@ -1243,7 +1199,6 @@ void APIConnection::on_subscribe_bluetooth_le_advertisements_request(
 void APIConnection::on_unsubscribe_bluetooth_le_advertisements_request() {
   bluetooth_proxy::global_bluetooth_proxy->unsubscribe_api_connection(this);
 }
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 void APIConnection::on_bluetooth_device_request(const BluetoothDeviceRequest &msg) {
   bluetooth_proxy::global_bluetooth_proxy->bluetooth_device_request(msg);
 }
@@ -1277,15 +1232,13 @@ void APIConnection::on_subscribe_bluetooth_connections_free_request() {
   }
 }
 
-void APIConnection::on_bluetooth_set_connection_params_request(const BluetoothSetConnectionParamsRequest &msg) {
-  bluetooth_proxy::global_bluetooth_proxy->bluetooth_set_connection_params(msg);
-}
-#endif
-
 void APIConnection::on_bluetooth_scanner_set_mode_request(const BluetoothScannerSetModeRequest &msg) {
   bluetooth_proxy::global_bluetooth_proxy->bluetooth_scanner_set_mode(
       msg.mode == enums::BluetoothScannerMode::BLUETOOTH_SCANNER_MODE_ACTIVE);
 }
+void APIConnection::on_bluetooth_set_connection_params_request(const BluetoothSetConnectionParamsRequest &msg) {
+  bluetooth_proxy::global_bluetooth_proxy->bluetooth_set_connection_params(msg);
+}
 #endif
 
 #ifdef USE_VOICE_ASSISTANT
@@ -1340,8 +1293,7 @@ void APIConnection::on_voice_assistant_announce_request(const VoiceAssistantAnno
   }
 }
 
-bool APIConnection::send_voice_assistant_get_configuration_response_(
-    const VoiceAssistantConfigurationRequest & /*msg*/) {
+bool APIConnection::send_voice_assistant_get_configuration_response_(const VoiceAssistantConfigurationRequest &msg) {
   VoiceAssistantConfigurationResponse resp;
   if (!this->check_voice_assistant_api_connection_()) {
     // send_message encodes synchronously, so this stack local outlives the encode
@@ -1361,6 +1313,22 @@ bool APIConnection::send_voice_assistant_get_configuration_response_(
     }
   }
 
+  // Filter external wake words
+  for (auto &wake_word : msg.external_wake_words) {
+    if (wake_word.model_type != "micro") {
+      // microWakeWord only
+      continue;
+    }
+
+    resp.available_wake_words.emplace_back();
+    auto &resp_wake_word = resp.available_wake_words.back();
+    resp_wake_word.id = StringRef(wake_word.id);
+    resp_wake_word.wake_word = StringRef(wake_word.wake_word);
+    for (const auto &lang : wake_word.trained_languages) {
+      resp_wake_word.trained_languages.push_back(lang);
+    }
+  }
+
   resp.active_wake_words = &config.active_wake_words;
   resp.max_active_wake_words = config.max_active_wake_words;
   return this->send_message(resp);
@@ -1380,7 +1348,7 @@ void APIConnection::on_voice_assistant_set_configuration(const VoiceAssistantSet
 
 #ifdef USE_ZWAVE_PROXY
 void APIConnection::on_z_wave_proxy_frame(const ZWaveProxyFrame &msg) {
-  zwave_proxy::global_zwave_proxy->send_frame(this, msg.data, msg.data_len);
+  zwave_proxy::global_zwave_proxy->send_frame(msg.data, msg.data_len);
 }
 
 void APIConnection::on_z_wave_proxy_request(const ZWaveProxyRequest &msg) {
@@ -1465,7 +1433,6 @@ uint16_t APIConnection::try_send_water_heater_info(EntityBase *entity, APIConnec
   msg.target_temperature_step = traits.get_target_temperature_step();
   msg.supported_modes = &traits.get_supported_modes();
   msg.supported_features = traits.get_feature_flags();
-  msg.temperature_unit = static_cast<enums::TemperatureUnit>(traits.get_temperature_unit());
   return fill_and_encode_entity_info(wh, msg, conn, remaining_size);
 }
 
@@ -1543,13 +1510,7 @@ void APIConnection::on_infrared_rf_transmit_raw_timings_request(const InfraredRF
 #endif
 
 #if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
-void APIConnection::send_infrared_rf_receive_event(const InfraredRFReceiveEvent &msg) {
-  if (!this->send_message(msg)) {
-    // V: fires per decoded frame with no subscription gate, so a warning
-    // would flood the congested link it reports on.
-    ESP_LOGV(TAG, "IR/RF event dropped, TCP buffer full");
-  }
-}
+void APIConnection::send_infrared_rf_receive_event(const InfraredRFReceiveEvent &msg) { this->send_message(msg); }
 #endif
 
 #ifdef USE_SERIAL_PROXY
@@ -1560,8 +1521,8 @@ void APIConnection::on_serial_proxy_configure_request(const SerialProxyConfigure
              static_cast<uint32_t>(proxies.size()));
     return;
   }
-  proxies[msg.instance]->configure(this, msg.baudrate, msg.flow_control, static_cast<uint8_t>(msg.parity),
-                                   msg.stop_bits, msg.data_size);
+  proxies[msg.instance]->configure(msg.baudrate, msg.flow_control, static_cast<uint8_t>(msg.parity), msg.stop_bits,
+                                   msg.data_size);
 }
 
 void APIConnection::on_serial_proxy_write_request(const SerialProxyWriteRequest &msg) {
@@ -1570,7 +1531,7 @@ void APIConnection::on_serial_proxy_write_request(const SerialProxyWriteRequest
     ESP_LOGW(TAG, "Serial proxy instance %" PRIu32 " out of range", msg.instance);
     return;
   }
-  proxies[msg.instance]->write_from_client(this, msg.data, msg.data_len);
+  proxies[msg.instance]->write_from_client(msg.data, msg.data_len);
 }
 
 void APIConnection::on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &msg) {
@@ -1579,7 +1540,7 @@ void APIConnection::on_serial_proxy_set_modem_pins_request(const SerialProxySetM
     ESP_LOGW(TAG, "Serial proxy instance %" PRIu32 " out of range", msg.instance);
     return;
   }
-  proxies[msg.instance]->set_modem_pins(this, msg.line_states);
+  proxies[msg.instance]->set_modem_pins(msg.line_states);
 }
 
 void APIConnection::on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &msg) {
@@ -1591,9 +1552,7 @@ void APIConnection::on_serial_proxy_get_modem_pins_request(const SerialProxyGetM
   SerialProxyGetModemPinsResponse resp{};
   resp.instance = msg.instance;
   resp.line_states = proxies[msg.instance]->get_modem_pins();
-  if (!this->send_message(resp)) {
-    API_LOG_MSG_DROPPED(TAG, "Serial proxy response");
-  }
+  this->send_message(resp);
 }
 
 void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
@@ -1625,9 +1584,7 @@ void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
           resp.status = enums::SERIAL_PROXY_STATUS_ERROR;
           break;
       }
-      if (!this->send_message(resp)) {
-        API_LOG_MSG_DROPPED(TAG, "Serial proxy response");
-      }
+      this->send_message(resp);
       break;
     }
     default:
@@ -1636,11 +1593,7 @@ void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
   }
 }
 
-void APIConnection::send_serial_proxy_data(const SerialProxyDataReceived &msg) {
-  if (!this->send_message(msg)) {
-    ESP_LOGV(TAG, "Serial proxy data dropped, TCP buffer full");
-  }
-}
+void APIConnection::send_serial_proxy_data(const SerialProxyDataReceived &msg) { this->send_message(msg); }
 #endif
 
 #ifdef USE_INFRARED
@@ -1758,28 +1711,19 @@ bool APIConnection::send_hello_response_(const HelloRequest &msg) {
   ESP_LOGV(TAG, "Hello from client: '%s' | %s | API Version %" PRIu16 ".%" PRIu16, this->helper_->get_client_name(),
            this->helper_->get_peername_to(peername), this->client_api_version_major_, this->client_api_version_minor_);
 
+  // TODO: Remove before 2026.8.0 (one version after get_object_id backward compat removal)
+  if (!this->client_supports_api_version(1, 14)) {
+    ESP_LOGW(TAG, "'%s' using outdated API %" PRIu16 ".%" PRIu16 ", update to 1.14+", this->helper_->get_client_name(),
+             this->client_api_version_major_, this->client_api_version_minor_);
+  }
+
   HelloResponse resp;
   resp.api_version_major = 1;
-  resp.api_version_minor = 15;
+  resp.api_version_minor = 14;
   // Send only the version string - the client only logs this for debugging and doesn't use it otherwise
   resp.server_info = ESPHOME_VERSION_REF;
   resp.name = StringRef(App.get_name());
 
-#ifdef USE_PROVISIONING
-  if (provisioning::global_provisioning_manager != nullptr && provisioning::global_provisioning_manager->closed()) {
-    // The provisioning window has closed without the device being provisioned.
-    // Acknowledge the hello so the client can read the server name, then request
-    // disconnect with the reason. Authentication is intentionally not completed.
-    this->log_client_(ESPHOME_LOG_LEVEL_WARN, LOG_STR("Provisioning closed; rejecting connection"));
-    if (!this->send_message(resp)) {
-      API_LOG_MSG_DROPPED(TAG, "Hello response");
-    }
-    DisconnectRequest req;
-    req.reason = enums::DISCONNECT_REASON_PROVISIONING_CLOSED;
-    return this->send_message(req);
-  }
-#endif
-
   // Auto-authenticate - password auth was removed in ESPHome 2026.1.0
   this->complete_authentication_();
 
@@ -1798,8 +1742,9 @@ bool APIConnection::send_device_info_response_() {
 #ifdef USE_AREAS
   resp.suggested_area = StringRef(App.get_area());
 #endif
-  char mac_address[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
-  uint8_t mac[MAC_ADDRESS_SIZE];
+  // Stack buffer for MAC address (XX:XX:XX:XX:XX:XX\0 = 18 bytes)
+  char mac_address[18];
+  uint8_t mac[6];
   get_mac_address_raw(mac);
   format_mac_addr_upper(mac, mac_address);
   resp.mac_address = StringRef(mac_address);
@@ -1814,7 +1759,7 @@ bool APIConnection::send_device_info_response_() {
   // Manufacturer string - define once, handle ESP8266 PROGMEM separately
 #if defined(USE_ESP8266) || defined(USE_ESP32)
 #define ESPHOME_MANUFACTURER "Espressif"
-#elif defined(USE_RP2)
+#elif defined(USE_RP2040)
 #define ESPHOME_MANUFACTURER "Raspberry Pi"
 #elif defined(USE_BK72XX)
 #define ESPHOME_MANUFACTURER "Beken"
@@ -1875,7 +1820,8 @@ bool APIConnection::send_device_info_response_() {
 #endif
 #ifdef USE_BLUETOOTH_PROXY
   resp.bluetooth_proxy_feature_flags = bluetooth_proxy::global_bluetooth_proxy->get_feature_flags();
-  char bluetooth_mac[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
+  // Stack buffer for Bluetooth MAC address (XX:XX:XX:XX:XX:XX\0 = 18 bytes)
+  char bluetooth_mac[18];
   bluetooth_proxy::global_bluetooth_proxy->get_bluetooth_mac_address_pretty(bluetooth_mac);
   resp.bluetooth_mac_address = StringRef(bluetooth_mac);
 #endif
@@ -1898,12 +1844,6 @@ bool APIConnection::send_device_info_response_() {
 #endif
 #ifdef USE_API_NOISE
   resp.api_encryption_supported = true;
-#ifndef USE_API_NOISE_PSK_FROM_YAML
-  // No key from YAML: while no key is set, the key can be provisioned over a
-  // zero-PSK Noise connection. Gated on the YAML define (not the plaintext
-  // one) so this advertisement survives the plaintext removal in 2027.2.0.
-  resp.api_encryption_provisionable = !this->parent_->get_noise_ctx().has_psk();
-#endif
 #endif
 #ifdef USE_DEVICES
   size_t device_index = 0;
@@ -1929,42 +1869,12 @@ bool APIConnection::send_device_info_response_() {
 
   return this->send_message(resp);
 }
-bool APIConnection::send_device_capabilities_response_() {
-  // These are the same values DeviceInfoResponse still reports for older clients. Keep the blocks
-  // below in sync with send_device_info_response_() until those copies are removed.
-  DeviceCapabilitiesResponse resp;
-#ifdef USE_BLUETOOTH_PROXY
-  resp.bluetooth_proxy.feature_flags = bluetooth_proxy::global_bluetooth_proxy->get_feature_flags();
-  char bluetooth_mac[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
-  bluetooth_proxy::global_bluetooth_proxy->get_bluetooth_mac_address_pretty(bluetooth_mac);
-  resp.bluetooth_proxy.mac_address = StringRef(bluetooth_mac);
-#endif
-#ifdef USE_VOICE_ASSISTANT
-  resp.voice_assistant.feature_flags = voice_assistant::global_voice_assistant->get_feature_flags();
-#endif
-#ifdef USE_ZWAVE_PROXY
-  resp.zwave_proxy.feature_flags = zwave_proxy::global_zwave_proxy->get_feature_flags();
-  resp.zwave_proxy.home_id = zwave_proxy::global_zwave_proxy->get_home_id();
-#endif
-#ifdef USE_SERIAL_PROXY
-  size_t serial_proxy_index = 0;
-  for (auto const &proxy : App.get_serial_proxies()) {
-    if (serial_proxy_index >= SERIAL_PROXY_COUNT)
-      break;
-    auto &info = resp.serial_proxies[serial_proxy_index++];
-    info.name = StringRef(proxy->get_name());
-    info.port_type = proxy->get_port_type();
-  }
-#endif
-  return this->send_message(resp);
-}
 void APIConnection::on_hello_request(const HelloRequest &msg) {
   if (!this->send_hello_response_(msg)) {
     this->on_fatal_error();
   }
 }
-void APIConnection::on_disconnect_request(const DisconnectRequest & /*msg*/) {
-  // The reason is informational when a client disconnects us; we always ack and close.
+void APIConnection::on_disconnect_request() {
   if (!this->send_disconnect_response_()) {
     this->on_fatal_error();
   }
@@ -1979,11 +1889,6 @@ void APIConnection::on_device_info_request() {
     this->on_fatal_error();
   }
 }
-void APIConnection::on_device_capabilities_request() {
-  if (!this->send_device_capabilities_response_()) {
-    this->on_fatal_error();
-  }
-}
 
 #ifdef USE_API_HOMEASSISTANT_STATES
 void APIConnection::on_home_assistant_state_response(const HomeAssistantStateResponse &msg) {
@@ -2062,9 +1967,7 @@ void APIConnection::send_execute_service_response(uint32_t call_id, bool success
   resp.call_id = call_id;
   resp.success = success;
   resp.error_message = error_message;
-  if (!this->send_message(resp)) {
-    API_LOG_MSG_DROPPED(TAG, "Action response");
-  }
+  this->send_message(resp);
 }
 #ifdef USE_API_USER_DEFINED_ACTION_RESPONSES_JSON
 void APIConnection::send_execute_service_response(uint32_t call_id, bool success, StringRef error_message,
@@ -2075,34 +1978,12 @@ void APIConnection::send_execute_service_response(uint32_t call_id, bool success
   resp.error_message = error_message;
   resp.response_data = response_data;
   resp.response_data_len = response_data_len;
-  if (!this->send_message(resp)) {
-    API_LOG_MSG_DROPPED(TAG, "Action response");
-  }
+  this->send_message(resp);
 }
 #endif  // USE_API_USER_DEFINED_ACTION_RESPONSES_JSON
 #endif  // USE_API_USER_DEFINED_ACTION_RESPONSES
 #endif
 
-#ifdef USE_API_HOMEASSISTANT_SERVICES
-bool APIConnection::send_homeassistant_action(const HomeassistantActionRequest &call) {
-  if (!this->flags_.service_call_subscription)
-    return false;
-  if (!this->send_message(call)) {
-    API_LOG_MSG_DROPPED(TAG, "Action request");
-  }
-  return true;
-}
-#endif  // USE_API_HOMEASSISTANT_SERVICES
-
-#ifdef USE_HOMEASSISTANT_TIME
-void APIConnection::send_time_request() {
-  GetTimeRequest req;
-  if (!this->send_message(req)) {
-    API_LOG_MSG_DROPPED(TAG, "Time request");
-  }
-}
-#endif  // USE_HOMEASSISTANT_TIME
-
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES
 void APIConnection::on_homeassistant_action_response(const HomeassistantActionResponse &msg) {
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES_JSON
@@ -2121,15 +2002,6 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
   NoiseEncryptionSetKeyResponse resp;
   resp.success = false;
 
-#ifdef USE_PROVISIONING
-  // Refuse to set a key once the provisioning window has closed (defense in depth;
-  // such connections are already rejected at hello).
-  if (provisioning::global_provisioning_manager != nullptr && provisioning::global_provisioning_manager->closed()) {
-    ESP_LOGW(TAG, "Provisioning closed; rejecting key set");
-    return this->send_message(resp);
-  }
-#endif
-
   psk_t psk{};
   if (msg.key_len == 0) {
     if (this->parent_->clear_noise_psk(true)) {
@@ -2139,21 +2011,10 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
     }
   } else if (base64_decode(msg.key, msg.key_len, psk.data(), psk.size()) != psk.size()) {
     ESP_LOGW(TAG, "Invalid encryption key length");
-  } else if (APINoiseContext::is_all_zeros(psk)) {
-    // Accepting the reserved provisioning PSK would report success without
-    // enabling encryption (or silently clear an existing key)
-    ESP_LOGW(TAG, "Rejecting all-zero encryption key");
   } else if (!this->parent_->save_noise_psk(psk, true)) {
     ESP_LOGW(TAG, "Failed to save encryption key");
   } else {
     resp.success = true;
-#ifdef USE_API_PLAINTEXT
-    if (this->helper_->frame_footer_size() == 0) {
-      // Plaintext transport has no frame footer; Noise always has the MAC footer.
-      // Remove after 2027.2.0 together with plaintext support on keyless devices.
-      ESP_LOGW(TAG, "Key received over plaintext; deprecated, will be removed in 2027.2.0");
-    }
-#endif
   }
 
   return this->send_message(resp);
@@ -2177,10 +2038,7 @@ bool APIConnection::try_to_clear_buffer_slow_(bool log_out_of_space) {
   if (this->helper_->can_write_without_blocking())
     return true;
   if (log_out_of_space) {
-    // VV: refusals are either reported by the sending call site (naming what
-    // was lost) or retried without loss (the deferred batch), so this generic
-    // line only duplicates them.
-    ESP_LOGVV(TAG, "Cannot send message because of TCP buffer space");
+    ESP_LOGV(TAG, "Cannot send message because of TCP buffer space");
   }
   return false;
 }

esphome/components/api/api_connection.h

@@ -18,14 +18,13 @@
 #ifdef USE_ESP32_CRASH_HANDLER
 #include "esphome/components/esp32/crash_handler.h"
 #endif
-#ifdef USE_RP2_CRASH_HANDLER
-#include "esphome/components/rp2/crash_handler.h"
+#ifdef USE_RP2040_CRASH_HANDLER
+#include "esphome/components/rp2040/crash_handler.h"
 #endif
 #ifdef USE_ESP8266_CRASH_HANDLER
 #include "esphome/components/esp8266/crash_handler.h"
 #endif
 #include "esphome/core/entity_base.h"
-#include "esphome/core/log.h"
 #include "esphome/core/string_ref.h"
 
 #include <functional>
@@ -41,16 +40,6 @@ namespace esphome::api {
 // Forward-declared to break the api_server.h cycle; full-type inlines are in api_connection_buffer.h.
 class APIServer;
 
-// One shared flash string for every refused-frame warning: send_message()
-// fails as soon as the TCP buffer is full, and each caller only pays for its
-// short name. The guard drops the helper and its arguments below WARN.
-#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_WARN
-void log_dropped_message(const char *tag, int line, const LogString *what);
-#define API_LOG_MSG_DROPPED(tag, what) esphome::api::log_dropped_message(tag, __LINE__, LOG_STR(what))
-#else
-#define API_LOG_MSG_DROPPED(tag, what)
-#endif
-
 // Keepalive timeout in milliseconds
 static constexpr uint32_t KEEPALIVE_TIMEOUT_MS = 60000;
 // Maximum number of entities to process in a single batch during initial state/info sending
@@ -177,10 +166,11 @@ class APIConnection final : public APIServerConnectionBase {
 #endif
   bool try_send_log_message(int level, const char *tag, const char *line, size_t message_len);
 #ifdef USE_API_HOMEASSISTANT_SERVICES
-  // Returns whether this client has subscribed to Home Assistant actions; the message
-  // is only handed to the send path when subscribed. A true return does not guarantee
-  // delivery - it lets the caller warn when no connected client has the subscription.
-  bool send_homeassistant_action(const HomeassistantActionRequest &call);
+  void send_homeassistant_action(const HomeassistantActionRequest &call) {
+    if (!this->flags_.service_call_subscription)
+      return;
+    this->send_message(call);
+  }
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES
   void on_homeassistant_action_response(const HomeassistantActionResponse &msg);
 #endif  // USE_API_HOMEASSISTANT_ACTION_RESPONSES
@@ -189,7 +179,6 @@ class APIConnection final : public APIServerConnectionBase {
   void on_subscribe_bluetooth_le_advertisements_request(const SubscribeBluetoothLEAdvertisementsRequest &msg);
   void on_unsubscribe_bluetooth_le_advertisements_request();
 
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
   void on_bluetooth_device_request(const BluetoothDeviceRequest &msg);
   void on_bluetooth_gatt_read_request(const BluetoothGATTReadRequest &msg);
   void on_bluetooth_gatt_write_request(const BluetoothGATTWriteRequest &msg);
@@ -198,13 +187,15 @@ class APIConnection final : public APIServerConnectionBase {
   void on_bluetooth_gatt_get_services_request(const BluetoothGATTGetServicesRequest &msg);
   void on_bluetooth_gatt_notify_request(const BluetoothGATTNotifyRequest &msg);
   void on_subscribe_bluetooth_connections_free_request();
-  void on_bluetooth_set_connection_params_request(const BluetoothSetConnectionParamsRequest &msg);
-#endif
   void on_bluetooth_scanner_set_mode_request(const BluetoothScannerSetModeRequest &msg);
+  void on_bluetooth_set_connection_params_request(const BluetoothSetConnectionParamsRequest &msg);
 
 #endif
 #ifdef USE_HOMEASSISTANT_TIME
-  void send_time_request();
+  void send_time_request() {
+    GetTimeRequest req;
+    this->send_message(req);
+  }
 #endif
 
 #ifdef USE_VOICE_ASSISTANT
@@ -268,10 +259,9 @@ class APIConnection final : public APIServerConnectionBase {
   void on_get_time_response(const GetTimeResponse &value);
 #endif
   void on_hello_request(const HelloRequest &msg);
-  void on_disconnect_request(const DisconnectRequest &msg);
+  void on_disconnect_request();
   void on_ping_request();
   void on_device_info_request();
-  void on_device_capabilities_request();
   void on_list_entities_request() { this->begin_iterator_(ActiveIterator::LIST_ENTITIES); }
   void on_subscribe_states_request() {
     this->flags_.state_subscription = true;
@@ -289,8 +279,8 @@ class APIConnection final : public APIServerConnectionBase {
     esp32::crash_handler_log();
     esp32::crash_handler_clear();
 #endif
-#ifdef USE_RP2_CRASH_HANDLER
-    rp2::crash_handler_log();
+#ifdef USE_RP2040_CRASH_HANDLER
+    rp2040::crash_handler_log();
 #endif
 #ifdef USE_ESP8266_CRASH_HANDLER
     esp8266::crash_handler_log();
@@ -340,9 +330,7 @@ class APIConnection final : public APIServerConnectionBase {
   // Function pointer type for type-erased size calculation
   using CalculateSizeFn = uint32_t (*)(const void *);
 
-  /// Returns false as soon as the TCP buffer is full. Marked nodiscard so we
-  /// have no silent failures: every caller must handle (or log) a refusal.
-  template<typename T> [[nodiscard]] bool send_message(const T &msg) {
+  template<typename T> bool send_message(const T &msg) {
     if constexpr (T::ESTIMATED_SIZE == 0) {
       return this->send_message_(0, T::MESSAGE_TYPE, &encode_msg_noop, &msg);
     } else {
@@ -393,11 +381,10 @@ class APIConnection final : public APIServerConnectionBase {
   bool send_disconnect_response_();
   bool send_ping_response_();
   bool send_device_info_response_();
-  bool send_device_capabilities_response_();
 #ifdef USE_API_NOISE
   bool send_noise_encryption_set_key_response_(const NoiseEncryptionSetKeyRequest &msg);
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   bool send_subscribe_bluetooth_connections_free_response_();
 #endif
 #ifdef USE_VOICE_ASSISTANT
@@ -639,11 +626,6 @@ class APIConnection final : public APIServerConnectionBase {
   void destroy_active_iterator_();
   void begin_iterator_(ActiveIterator type);
   void finalize_iterator_sync_();
-#if defined(USE_API_NOISE) && defined(USE_API_PLAINTEXT)
-  // Swap the plaintext helper for a Noise helper after the client opened
-  // with a Noise hello on an unprovisioned device (zero-PSK provisioning).
-  void upgrade_helper_to_noise_();
-#endif
 #ifdef USE_CAMERA
   std::unique_ptr<camera::CameraImageReader> image_reader_;
 #endif

esphome/components/api/api_frame_helper.cpp

@@ -97,8 +97,6 @@ const LogString *api_error_to_logstr(APIError err) {
     return LOG_STR("BAD_HANDSHAKE_ERROR_BYTE");
   }
 #endif
-  // PROTOCOL_SWITCH_TO_NOISE is intercepted in APIConnection::loop() before
-  // any logging can happen, so it intentionally has no entry here.
   return LOG_STR("UNKNOWN");
 }
 

esphome/components/api/api_frame_helper.h

@@ -88,11 +88,6 @@ enum class APIError : uint16_t {
   HANDSHAKESTATE_SPLIT_FAILED = 1020,
   BAD_HANDSHAKE_ERROR_BYTE = 1021,
 #endif
-#if defined(USE_API_NOISE) && defined(USE_API_PLAINTEXT)
-  // Not an error: an unprovisioned device received a Noise client hello on a
-  // plaintext connection; the caller must hand the socket off to a Noise helper.
-  PROTOCOL_SWITCH_TO_NOISE = 1023,
-#endif
 };
 
 const LogString *api_error_to_logstr(APIError err);
@@ -149,7 +144,7 @@ class APIFrameHelper {
   // holding data too long waiting for Nagle's timer causes buffer exhaustion
   // and dropped messages.
   //
-  // ESP32 (TCP_SND_BUF=4×MSS+) / RP2040 (4×MSS) / LibreTiny (4×MSS): 4 logs per cycle
+  // ESP32 (TCP_SND_BUF=4×MSS+) / RP2040 (8×MSS) / LibreTiny (4×MSS): 4 logs per cycle
   // ESP8266 (2×MSS): 3 logs per cycle (tightest buffers)
   //
   // Flow (ESP32/RP2040/LT): Log 1 (Nagle on) -> Log 2 -> Log 3 -> Log 4 (NODELAY, flush)
@@ -205,12 +200,6 @@ class APIFrameHelper {
   // or track that they stopped early and retry without this check.
   // See Socket::ready() for details.
   bool is_socket_ready() const { return socket_ != nullptr && socket_->ready(); }
-#if defined(USE_API_NOISE) && defined(USE_API_PLAINTEXT)
-  // Move the socket out of this helper so a replacement helper can take it
-  // over (plaintext to Noise handoff on unprovisioned devices). The drained
-  // helper must be destroyed right after.
-  std::unique_ptr<socket::Socket> release_socket_for_switch() { return std::move(this->socket_); }
-#endif
   // Release excess memory from internal buffers after initial sync
   void release_buffers() {
     // rx_buf_: Safe to clear only if no partial read in progress.
@@ -312,7 +301,7 @@ class APIFrameHelper {
   // Values 1..LOG_NAGLE_COUNT count log messages in the current Nagle batch.
   // After LOG_NAGLE_COUNT logs, we flush by re-enabling NODELAY and resetting to 0.
   // ESP8266 has the tightest TCP send buffer (2×MSS) and needs conservative batching.
-  // ESP32 (4×MSS+), RP2040 (4×MSS), and LibreTiny (4×MSS) can coalesce more.
+  // ESP32 (4×MSS+), RP2040 (8×MSS), and LibreTiny (4×MSS) can coalesce more.
 #ifdef USE_ESP8266
   static constexpr uint8_t LOG_NAGLE_COUNT = 2;
 #else

esphome/components/api/api_frame_helper_noise.cpp

@@ -109,40 +109,6 @@ APIError APINoiseFrameHelper::init() {
   state_ = State::CLIENT_HELLO;
   return APIError::OK;
 }
-#ifdef USE_API_PLAINTEXT
-APIError APINoiseFrameHelper::init_from_handoff(const uint8_t *header, uint8_t header_len) {
-  APIError err = this->init();
-  if (err != APIError::OK) {
-    return err;
-  }
-  // Seed the header bytes the plaintext helper consumed before detecting the
-  // Noise indicator; try_read_frame_ resumes from rx_header_buf_len_.
-  std::memcpy(this->rx_header_buf_, header, header_len);
-  this->rx_header_buf_len_ = header_len;
-  // Pump the handshake without gating on socket_->ready(): on LWIP the
-  // plaintext helper's partial read can drain rcvevent while the rest of the
-  // client hello sits in the lastdata cache, so ready() may report false even
-  // though data is available.
-  return this->pump_handshake_();
-}
-#endif  // USE_API_PLAINTEXT
-
-/// Drive the handshake state machine until DATA, WOULD_BLOCK, or a fatal
-/// error. WOULD_BLOCK is not an error: reads stop naturally on EWOULDBLOCK
-/// and resume on the next loop().
-APIError APINoiseFrameHelper::pump_handshake_() {
-  while (this->state_ != State::DATA) {
-    APIError err = this->state_action_();
-    if (err == APIError::WOULD_BLOCK) {
-      break;
-    }
-    if (err != APIError::OK) {
-      return err;
-    }
-  }
-  return APIError::OK;
-}
-
 // Helper for handling handshake frame errors
 APIError APINoiseFrameHelper::handle_handshake_frame_error_(APIError aerr) {
   if (aerr == APIError::BAD_INDICATOR) {
@@ -165,13 +131,16 @@ APIError APINoiseFrameHelper::handle_noise_error_(int err, const LogString *func
 
 /// Run through handshake messages (if in that phase)
 APIError APINoiseFrameHelper::loop() {
-  // Check ready() once, not per state transition. On ESP8266 LWIP raw TCP,
-  // ready() returns false once the rx buffer is consumed. Re-checking each
-  // iteration would block handshake writes that must follow reads,
-  // deadlocking the handshake. pump_handshake_() stops on WOULD_BLOCK when
-  // no more data is available to read.
-  if (state_ != State::DATA && this->socket_->ready()) {
-    APIError err = this->pump_handshake_();
+  // Cache ready() outside the loop. On ESP8266 LWIP raw TCP, ready() returns false once
+  // the rx buffer is consumed. Re-checking each iteration would block handshake writes
+  // that must follow reads, deadlocking the handshake. state_action() will return
+  // WOULD_BLOCK when no more data is available to read.
+  bool socket_ready = this->socket_->ready();
+  while (state_ != State::DATA && socket_ready) {
+    APIError err = state_action_();
+    if (err == APIError::WOULD_BLOCK) {
+      break;
+    }
     if (err != APIError::OK) {
       return err;
     }
@@ -591,21 +560,18 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
  */
 APIError APINoiseFrameHelper::init_handshake_() {
   int err;
-  // Noise_NNpsk0_25519_ChaChaPoly_SHA256, built on the stack:
-  // noise_handshakestate_new_by_id copies it, so a member would waste
-  // 104 bytes per connection, and a static const would sit in RAM on
-  // ESP8266 (.rodata is DRAM there).
-  const NoiseProtocolId nid = {
-      .prefix_id = NOISE_PREFIX_STANDARD,
-      .pattern_id = NOISE_PATTERN_NN,
-      .modifier_ids = {NOISE_MODIFIER_PSK0},
-      .dh_id = NOISE_DH_CURVE25519,
-      .cipher_id = NOISE_CIPHER_CHACHAPOLY,
-      .hash_id = NOISE_HASH_SHA256,
-      .hybrid_id = NOISE_DH_NONE,
-  };
+  memset(&nid_, 0, sizeof(nid_));
+  // const char *proto = "Noise_NNpsk0_25519_ChaChaPoly_SHA256";
+  // err = noise_protocol_name_to_id(&nid_, proto, strlen(proto));
+  nid_.pattern_id = NOISE_PATTERN_NN;
+  nid_.cipher_id = NOISE_CIPHER_CHACHAPOLY;
+  nid_.dh_id = NOISE_DH_CURVE25519;
+  nid_.prefix_id = NOISE_PREFIX_STANDARD;
+  nid_.hybrid_id = NOISE_DH_NONE;
+  nid_.hash_id = NOISE_HASH_SHA256;
+  nid_.modifier_ids[0] = NOISE_MODIFIER_PSK0;
 
-  err = noise_handshakestate_new_by_id(&handshake_, &nid, NOISE_ROLE_RESPONDER);
+  err = noise_handshakestate_new_by_id(&handshake_, &nid_, NOISE_ROLE_RESPONDER);
   APIError aerr =
       handle_noise_error_(err, LOG_STR("noise_handshakestate_new_by_id"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)

esphome/components/api/api_frame_helper_noise.h

@@ -22,20 +22,12 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   }
   ~APINoiseFrameHelper() override;
   APIError init() override;
-#ifdef USE_API_PLAINTEXT
-  // Take over a connection whose first bytes were consumed by a plaintext
-  // helper on an unprovisioned device (see APIError::PROTOCOL_SWITCH_TO_NOISE).
-  // Seeds the already-read header bytes and pumps the handshake state machine
-  // until it would block.
-  APIError init_from_handoff(const uint8_t *header, uint8_t header_len);
-#endif
   APIError loop() override;
   APIError read_packet(ReadPacketBuffer *buffer) override;
   APIError write_protobuf_packet(uint8_t type, ProtoWriteBuffer buffer) override;
   APIError write_protobuf_messages(ProtoWriteBuffer buffer, std::span<const MessageInfo> messages) override;
 
  protected:
-  APIError pump_handshake_();
   APIError state_action_();
   APIError state_action_client_hello_();
   APIError state_action_server_hello_();
@@ -63,6 +55,9 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   // Buffer for noise handshake prologue (released after handshake)
   APIBuffer prologue_;
 
+  // NoiseProtocolId (size depends on implementation)
+  NoiseProtocolId nid_;
+
   // Group small types together
   // Fixed-size header buffer for noise protocol:
   // 1 byte for indicator + 2 bytes for message size (16-bit value, not varint)

esphome/components/api/api_frame_helper_plaintext.cpp

@@ -89,17 +89,6 @@ APIError APIPlaintextFrameHelper::try_read_frame_() {
     // If this was the first read, validate the indicator byte
     if (rx_header_buf_pos_ == 0 && received > 0) {
       if (rx_header_buf_[0] != 0x00) {
-#ifdef USE_API_NOISE
-        // Dual build (encryption supported but no key set): a 0x01 first byte
-        // is a Noise client hello. Hand the connection off to a Noise helper
-        // running the all-zeros provisioning PSK so the encryption key can be
-        // set without crossing the wire in plaintext. Preserve the bytes we
-        // already consumed; they are the start of the Noise 3-byte header.
-        if (rx_header_buf_[0] == 0x01) {
-          rx_header_buf_pos_ = static_cast<uint8_t>(received);
-          return APIError::PROTOCOL_SWITCH_TO_NOISE;
-        }
-#endif
         state_ = State::FAILED;
         HELPER_LOG("Bad indicator byte %u", rx_header_buf_[0]);
         return APIError::BAD_INDICATOR;

esphome/components/api/api_frame_helper_plaintext.h

@@ -23,15 +23,6 @@ class APIPlaintextFrameHelper final : public APIFrameHelper {
   APIError read_packet(ReadPacketBuffer *buffer) override;
   APIError write_protobuf_packet(uint8_t type, ProtoWriteBuffer buffer) override;
   APIError write_protobuf_messages(ProtoWriteBuffer buffer, std::span<const MessageInfo> messages) override;
-#ifdef USE_API_NOISE
-  // After try_read_frame_ returned PROTOCOL_SWITCH_TO_NOISE: copy out the
-  // header bytes already consumed from the socket (at most 3, the size of the
-  // Noise fixed header) so the replacement Noise helper can be seeded with them.
-  uint8_t get_consumed_header(uint8_t out[3]) const {
-    memcpy(out, this->rx_header_buf_, this->rx_header_buf_pos_);
-    return this->rx_header_buf_pos_;
-  }
-#endif
 
  protected:
   APIError try_read_frame_();

esphome/components/api/api_noise_context.h

@@ -10,20 +10,13 @@ using psk_t = std::array<uint8_t, 32>;
 
 class APINoiseContext {
  public:
-  // The all-zeros PSK is reserved: it marks the device as unprovisioned and
-  // doubles as the well-known provisioning PSK that unprovisioned devices
-  // accept for Noise handshakes (passive-sniffing protection only, no
-  // authentication). It is never a valid real key.
-  static bool is_all_zeros(const psk_t &psk) {
-    uint8_t acc = 0;
-    for (uint8_t b : psk) {
-      acc |= b;
-    }
-    return acc == 0;
-  }
   void set_psk(psk_t psk) {
     this->psk_ = psk;
-    this->has_psk_ = !is_all_zeros(psk);
+    bool has_psk = false;
+    for (auto i : psk) {
+      has_psk |= i;
+    }
+    this->has_psk_ = has_psk;
   }
   const psk_t &get_psk() const { return this->psk_; }
   bool has_psk() const { return this->has_psk_; }

esphome/components/api/api_overflow_buffer.cpp

@@ -12,22 +12,6 @@ APIOverflowBuffer::~APIOverflowBuffer() {
 }
 
 ssize_t APIOverflowBuffer::try_drain(socket::Socket *socket) {
-  // socket->write() can re-enter this function: a log message emitted from an
-  // lwip callback during the write goes out over the API and lands back in the
-  // frame helper's write/drain path. If a nested drain ran here it would send
-  // and free the entry the outer drain is still holding, causing a double free.
-  // Report "no progress" instead; the outer drain keeps draining, and the
-  // nested send is enqueued behind the existing backlog.
-  if (this->draining_)
-    return 0;
-
-  // RAII so the flag is cleared on every return path
-  struct DrainGuard {
-    explicit DrainGuard(bool &flag) : flag_(flag) { flag_ = true; }
-    ~DrainGuard() { this->flag_ = false; }
-    bool &flag_;
-  } guard(this->draining_);
-
   while (this->count_ > 0) {
     Entry *front = this->queue_[this->head_];
 
@@ -45,12 +29,11 @@ ssize_t APIOverflowBuffer::try_drain(socket::Socket *socket) {
       return sent;
     }
 
-    // Entry fully sent — unlink it before freeing so a freed pointer is never
-    // reachable from the queue
+    // Entry fully sent — free it and advance
+    Entry::destroy(front);
     this->queue_[this->head_] = nullptr;
     this->head_ = (this->head_ + 1) % API_MAX_SEND_QUEUE;
     this->count_--;
-    Entry::destroy(front);
   }
 
   return 0;  // All drained

esphome/components/api/api_overflow_buffer.h

@@ -69,10 +69,6 @@ class APIOverflowBuffer {
   uint8_t head_{0};
   uint8_t tail_{0};
   uint8_t count_{0};
-  // Guards against re-entrant drains: socket->write() can re-enter the API
-  // send path (e.g. a log message emitted from an lwip callback), and a nested
-  // drain would free the entry the outer drain is still holding.
-  bool draining_{false};
 };
 
 }  // namespace esphome::api

esphome/components/api/api_pb2.cpp

@@ -47,26 +47,6 @@ uint32_t HelloResponse::calculate_size() const {
   size += 2 + this->name.size();
   return size;
 }
-bool DisconnectRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
-  switch (field_id) {
-    case 1:
-      this->reason = static_cast<enums::DisconnectReason>(value);
-      break;
-    default:
-      return false;
-  }
-  return true;
-}
-uint8_t *DisconnectRequest::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
-  uint8_t *__restrict__ pos = buffer.get_pos();
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 1, static_cast<uint32_t>(this->reason));
-  return pos;
-}
-uint32_t DisconnectRequest::calculate_size() const {
-  uint32_t size = 0;
-  size += this->reason ? 2 : 0;
-  return size;
-}
 #ifdef USE_AREAS
 uint8_t *AreaInfo::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
   uint8_t *__restrict__ pos = buffer.get_pos();
@@ -170,9 +150,6 @@ uint8_t *DeviceInfoResponse::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_
   for (const auto &it : this->serial_proxies) {
     ProtoEncode::encode_sub_message(pos PROTO_ENCODE_DEBUG_ARG, buffer, 25, it);
   }
-#endif
-#ifdef USE_API_NOISE
-  ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 26, this->api_encryption_provisionable);
 #endif
   return pos;
 }
@@ -235,85 +212,6 @@ uint32_t DeviceInfoResponse::calculate_size() const {
   for (const auto &it : this->serial_proxies) {
     size += ProtoSize::calc_message_force(2, it.calculate_size());
   }
-#endif
-#ifdef USE_API_NOISE
-  size += ProtoSize::calc_bool(2, this->api_encryption_provisionable);
-#endif
-  return size;
-}
-#ifdef USE_BLUETOOTH_PROXY
-uint8_t *BluetoothProxyCapabilities::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
-  uint8_t *__restrict__ pos = buffer.get_pos();
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 1, this->feature_flags);
-  ProtoEncode::encode_short_string_force(pos PROTO_ENCODE_DEBUG_ARG, 18, this->mac_address);
-  return pos;
-}
-uint32_t BluetoothProxyCapabilities::calculate_size() const {
-  uint32_t size = 0;
-  size += ProtoSize::calc_uint32(1, this->feature_flags);
-  size += 2 + this->mac_address.size();
-  return size;
-}
-#endif
-#ifdef USE_VOICE_ASSISTANT
-uint8_t *VoiceAssistantCapabilities::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
-  uint8_t *__restrict__ pos = buffer.get_pos();
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 1, this->feature_flags);
-  return pos;
-}
-uint32_t VoiceAssistantCapabilities::calculate_size() const {
-  uint32_t size = 0;
-  size += ProtoSize::calc_uint32(1, this->feature_flags);
-  return size;
-}
-#endif
-#ifdef USE_ZWAVE_PROXY
-uint8_t *ZWaveProxyCapabilities::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
-  uint8_t *__restrict__ pos = buffer.get_pos();
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 1, this->feature_flags);
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 2, this->home_id);
-  return pos;
-}
-uint32_t ZWaveProxyCapabilities::calculate_size() const {
-  uint32_t size = 0;
-  size += ProtoSize::calc_uint32(1, this->feature_flags);
-  size += ProtoSize::calc_uint32(1, this->home_id);
-  return size;
-}
-#endif
-uint8_t *DeviceCapabilitiesResponse::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
-  uint8_t *__restrict__ pos = buffer.get_pos();
-#ifdef USE_BLUETOOTH_PROXY
-  ProtoEncode::encode_optional_sub_message(pos PROTO_ENCODE_DEBUG_ARG, buffer, 1, this->bluetooth_proxy);
-#endif
-#ifdef USE_VOICE_ASSISTANT
-  ProtoEncode::encode_optional_sub_message(pos PROTO_ENCODE_DEBUG_ARG, buffer, 2, this->voice_assistant);
-#endif
-#ifdef USE_ZWAVE_PROXY
-  ProtoEncode::encode_optional_sub_message(pos PROTO_ENCODE_DEBUG_ARG, buffer, 3, this->zwave_proxy);
-#endif
-#ifdef USE_SERIAL_PROXY
-  for (const auto &it : this->serial_proxies) {
-    ProtoEncode::encode_sub_message(pos PROTO_ENCODE_DEBUG_ARG, buffer, 4, it);
-  }
-#endif
-  return pos;
-}
-uint32_t DeviceCapabilitiesResponse::calculate_size() const {
-  uint32_t size = 0;
-#ifdef USE_BLUETOOTH_PROXY
-  size += ProtoSize::calc_message(1, this->bluetooth_proxy.calculate_size());
-#endif
-#ifdef USE_VOICE_ASSISTANT
-  size += ProtoSize::calc_message(1, this->voice_assistant.calculate_size());
-#endif
-#ifdef USE_ZWAVE_PROXY
-  size += ProtoSize::calc_message(1, this->zwave_proxy.calculate_size());
-#endif
-#ifdef USE_SERIAL_PROXY
-  for (const auto &it : this->serial_proxies) {
-    size += ProtoSize::calc_message_force(1, it.calculate_size());
-  }
 #endif
   return size;
 }
@@ -2482,8 +2380,6 @@ BluetoothLERawAdvertisementsResponse::calculate_size() const {
   }
   return size;
 }
-#endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 bool BluetoothDeviceRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
   switch (field_id) {
     case 1:
@@ -2860,8 +2756,6 @@ uint32_t BluetoothDeviceClearCacheResponse::calculate_size() const {
   size += ProtoSize::calc_int32(1, this->error);
   return size;
 }
-#endif
-#ifdef USE_BLUETOOTH_PROXY
 uint8_t *BluetoothScannerStateResponse::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
   uint8_t *__restrict__ pos = buffer.get_pos();
   ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 1, static_cast<uint32_t>(this->state));
@@ -4225,7 +4119,7 @@ uint32_t SerialProxyRequestResponse::calculate_size() const {
   return size;
 }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
 bool BluetoothSetConnectionParamsRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
   switch (field_id) {
     case 1:

esphome/components/api/api_pb2.h

@@ -11,10 +11,6 @@ namespace esphome::api {
 
 namespace enums {
 
-enum DisconnectReason : uint32_t {
-  DISCONNECT_REASON_UNSPECIFIED = 0,
-  DISCONNECT_REASON_PROVISIONING_CLOSED = 1,
-};
 enum SerialProxyPortType : uint32_t {
   SERIAL_PROXY_PORT_TYPE_TTL = 0,
   SERIAL_PROXY_PORT_TYPE_RS232 = 1,
@@ -225,7 +221,7 @@ enum MediaPlayerFormatPurpose : uint32_t {
   MEDIA_PLAYER_FORMAT_PURPOSE_ANNOUNCEMENT = 1,
 };
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
 enum BluetoothDeviceRequestType : uint32_t {
   BLUETOOTH_DEVICE_REQUEST_TYPE_CONNECT = 0,
   BLUETOOTH_DEVICE_REQUEST_TYPE_DISCONNECT = 1,
@@ -235,8 +231,6 @@ enum BluetoothDeviceRequestType : uint32_t {
   BLUETOOTH_DEVICE_REQUEST_TYPE_CONNECT_V3_WITHOUT_CACHE = 5,
   BLUETOOTH_DEVICE_REQUEST_TYPE_CLEAR_CACHE = 6,
 };
-#endif
-#ifdef USE_BLUETOOTH_PROXY
 enum BluetoothScannerState : uint32_t {
   BLUETOOTH_SCANNER_STATE_IDLE = 0,
   BLUETOOTH_SCANNER_STATE_STARTING = 1,
@@ -433,22 +427,18 @@ class HelloResponse final : public ProtoMessage {
 
  protected:
 };
-class DisconnectRequest final : public ProtoDecodableMessage {
+class DisconnectRequest final : public ProtoMessage {
  public:
   static constexpr uint8_t MESSAGE_TYPE = 5;
-  static constexpr uint8_t ESTIMATED_SIZE = 2;
+  static constexpr uint8_t ESTIMATED_SIZE = 0;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("disconnect_request"); }
 #endif
-  enums::DisconnectReason reason{};
-  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
-  uint32_t calculate_size() const;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const char *dump_to(DumpBuffer &out) const override;
 #endif
 
  protected:
-  bool decode_varint(uint32_t field_id, proto_varint_value_t value) override;
 };
 class DisconnectResponse final : public ProtoMessage {
  public:
@@ -535,7 +525,7 @@ class SerialProxyInfo final : public ProtoMessage {
 class DeviceInfoResponse final : public ProtoMessage {
  public:
   static constexpr uint8_t MESSAGE_TYPE = 10;
-  static constexpr uint16_t ESTIMATED_SIZE = 312;
+  static constexpr uint16_t ESTIMATED_SIZE = 309;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("device_info_response"); }
 #endif
@@ -588,77 +578,6 @@ class DeviceInfoResponse final : public ProtoMessage {
 #ifdef USE_ZWAVE_PROXY
   uint32_t zwave_home_id{0};
 #endif
-#ifdef USE_SERIAL_PROXY
-  std::array<SerialProxyInfo, SERIAL_PROXY_COUNT> serial_proxies{};
-#endif
-#ifdef USE_API_NOISE
-  bool api_encryption_provisionable{false};
-#endif
-  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
-  uint32_t calculate_size() const;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const char *dump_to(DumpBuffer &out) const override;
-#endif
-
- protected:
-};
-#ifdef USE_BLUETOOTH_PROXY
-class BluetoothProxyCapabilities final : public ProtoMessage {
- public:
-  uint32_t feature_flags{0};
-  StringRef mac_address{};
-  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
-  uint32_t calculate_size() const;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const char *dump_to(DumpBuffer &out) const override;
-#endif
-
- protected:
-};
-#endif
-#ifdef USE_VOICE_ASSISTANT
-class VoiceAssistantCapabilities final : public ProtoMessage {
- public:
-  uint32_t feature_flags{0};
-  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
-  uint32_t calculate_size() const;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const char *dump_to(DumpBuffer &out) const override;
-#endif
-
- protected:
-};
-#endif
-#ifdef USE_ZWAVE_PROXY
-class ZWaveProxyCapabilities final : public ProtoMessage {
- public:
-  uint32_t feature_flags{0};
-  uint32_t home_id{0};
-  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
-  uint32_t calculate_size() const;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const char *dump_to(DumpBuffer &out) const override;
-#endif
-
- protected:
-};
-#endif
-class DeviceCapabilitiesResponse final : public ProtoMessage {
- public:
-  static constexpr uint8_t MESSAGE_TYPE = 150;
-  static constexpr uint8_t ESTIMATED_SIZE = 102;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const LogString *message_name() const override { return LOG_STR("device_capabilities_response"); }
-#endif
-#ifdef USE_BLUETOOTH_PROXY
-  BluetoothProxyCapabilities bluetooth_proxy{};
-#endif
-#ifdef USE_VOICE_ASSISTANT
-  VoiceAssistantCapabilities voice_assistant{};
-#endif
-#ifdef USE_ZWAVE_PROXY
-  ZWaveProxyCapabilities zwave_proxy{};
-#endif
 #ifdef USE_SERIAL_PROXY
   std::array<SerialProxyInfo, SERIAL_PROXY_COUNT> serial_proxies{};
 #endif
@@ -2001,8 +1920,6 @@ class BluetoothLERawAdvertisementsResponse final : public ProtoMessage {
 
  protected:
 };
-#endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 class BluetoothDeviceRequest final : public ProtoDecodableMessage {
  public:
   static constexpr uint8_t MESSAGE_TYPE = 68;
@@ -2388,8 +2305,6 @@ class BluetoothDeviceClearCacheResponse final : public ProtoMessage {
 
  protected:
 };
-#endif
-#ifdef USE_BLUETOOTH_PROXY
 class BluetoothScannerStateResponse final : public ProtoMessage {
  public:
   static constexpr uint8_t MESSAGE_TYPE = 126;
@@ -3364,7 +3279,7 @@ class SerialProxyRequestResponse final : public ProtoMessage {
  protected:
 };
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
 class BluetoothSetConnectionParamsRequest final : public ProtoDecodableMessage {
  public:
   static constexpr uint8_t MESSAGE_TYPE = 145;

esphome/components/api/api_pb2_defines.h

@@ -3,7 +3,7 @@
 #pragma once
 
 #include "esphome/core/defines.h"
-#if defined(USE_BLUETOOTH_PROXY) || defined(USE_BLUETOOTH_PROXY_CONNECTIONS)
+#ifdef USE_BLUETOOTH_PROXY
 #ifndef USE_API_VARINT64
 #define USE_API_VARINT64
 #endif

esphome/components/api/api_pb2_dump.cpp

@@ -125,16 +125,6 @@ static void dump_bytes_field(DumpBuffer &out, const char *field_name, const uint
 }
 #pragma GCC diagnostic pop
 
-template<> const char *proto_enum_to_string<enums::DisconnectReason>(enums::DisconnectReason value) {
-  switch (value) {
-    case enums::DISCONNECT_REASON_UNSPECIFIED:
-      return ESPHOME_PSTR("DISCONNECT_REASON_UNSPECIFIED");
-    case enums::DISCONNECT_REASON_PROVISIONING_CLOSED:
-      return ESPHOME_PSTR("DISCONNECT_REASON_PROVISIONING_CLOSED");
-    default:
-      return ESPHOME_PSTR("UNKNOWN");
-  }
-}
 template<> const char *proto_enum_to_string<enums::SerialProxyPortType>(enums::SerialProxyPortType value) {
   switch (value) {
     case enums::SERIAL_PROXY_PORT_TYPE_TTL:
@@ -584,7 +574,7 @@ template<> const char *proto_enum_to_string<enums::MediaPlayerFormatPurpose>(enu
   }
 }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
 template<>
 const char *proto_enum_to_string<enums::BluetoothDeviceRequestType>(enums::BluetoothDeviceRequestType value) {
   switch (value) {
@@ -606,8 +596,6 @@ const char *proto_enum_to_string<enums::BluetoothDeviceRequestType>(enums::Bluet
       return ESPHOME_PSTR("UNKNOWN");
   }
 }
-#endif
-#ifdef USE_BLUETOOTH_PROXY
 template<> const char *proto_enum_to_string<enums::BluetoothScannerState>(enums::BluetoothScannerState value) {
   switch (value) {
     case enums::BLUETOOTH_SCANNER_STATE_IDLE:
@@ -876,8 +864,7 @@ const char *HelloResponse::dump_to(DumpBuffer &out) const {
   return out.c_str();
 }
 const char *DisconnectRequest::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("DisconnectRequest"));
-  dump_field(out, ESPHOME_PSTR("reason"), static_cast<enums::DisconnectReason>(this->reason));
+  out.append_p(ESPHOME_PSTR("DisconnectRequest {}"));
   return out.c_str();
 }
 const char *DisconnectResponse::dump_to(DumpBuffer &out) const {
@@ -978,58 +965,6 @@ const char *DeviceInfoResponse::dump_to(DumpBuffer &out) const {
 #ifdef USE_ZWAVE_PROXY
   dump_field(out, ESPHOME_PSTR("zwave_home_id"), this->zwave_home_id);
 #endif
-#ifdef USE_SERIAL_PROXY
-  for (const auto &it : this->serial_proxies) {
-    out.append(4, ' ').append_p(ESPHOME_PSTR("serial_proxies")).append(": ");
-    it.dump_to(out);
-    out.append("\n");
-  }
-#endif
-#ifdef USE_API_NOISE
-  dump_field(out, ESPHOME_PSTR("api_encryption_provisionable"), this->api_encryption_provisionable);
-#endif
-  return out.c_str();
-}
-#ifdef USE_BLUETOOTH_PROXY
-const char *BluetoothProxyCapabilities::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("BluetoothProxyCapabilities"));
-  dump_field(out, ESPHOME_PSTR("feature_flags"), this->feature_flags);
-  dump_field(out, ESPHOME_PSTR("mac_address"), this->mac_address);
-  return out.c_str();
-}
-#endif
-#ifdef USE_VOICE_ASSISTANT
-const char *VoiceAssistantCapabilities::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("VoiceAssistantCapabilities"));
-  dump_field(out, ESPHOME_PSTR("feature_flags"), this->feature_flags);
-  return out.c_str();
-}
-#endif
-#ifdef USE_ZWAVE_PROXY
-const char *ZWaveProxyCapabilities::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("ZWaveProxyCapabilities"));
-  dump_field(out, ESPHOME_PSTR("feature_flags"), this->feature_flags);
-  dump_field(out, ESPHOME_PSTR("home_id"), this->home_id);
-  return out.c_str();
-}
-#endif
-const char *DeviceCapabilitiesResponse::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("DeviceCapabilitiesResponse"));
-#ifdef USE_BLUETOOTH_PROXY
-  out.append(2, ' ').append_p(ESPHOME_PSTR("bluetooth_proxy")).append(": ");
-  this->bluetooth_proxy.dump_to(out);
-  out.append("\n");
-#endif
-#ifdef USE_VOICE_ASSISTANT
-  out.append(2, ' ').append_p(ESPHOME_PSTR("voice_assistant")).append(": ");
-  this->voice_assistant.dump_to(out);
-  out.append("\n");
-#endif
-#ifdef USE_ZWAVE_PROXY
-  out.append(2, ' ').append_p(ESPHOME_PSTR("zwave_proxy")).append(": ");
-  this->zwave_proxy.dump_to(out);
-  out.append("\n");
-#endif
 #ifdef USE_SERIAL_PROXY
   for (const auto &it : this->serial_proxies) {
     out.append(4, ' ').append_p(ESPHOME_PSTR("serial_proxies")).append(": ");
@@ -2004,8 +1939,6 @@ const char *BluetoothLERawAdvertisementsResponse::dump_to(DumpBuffer &out) const
   }
   return out.c_str();
 }
-#endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 const char *BluetoothDeviceRequest::dump_to(DumpBuffer &out) const {
   MessageDumpHelper helper(out, ESPHOME_PSTR("BluetoothDeviceRequest"));
   dump_field(out, ESPHOME_PSTR("address"), this->address);
@@ -2177,8 +2110,6 @@ const char *BluetoothDeviceClearCacheResponse::dump_to(DumpBuffer &out) const {
   dump_field(out, ESPHOME_PSTR("error"), this->error);
   return out.c_str();
 }
-#endif
-#ifdef USE_BLUETOOTH_PROXY
 const char *BluetoothScannerStateResponse::dump_to(DumpBuffer &out) const {
   MessageDumpHelper helper(out, ESPHOME_PSTR("BluetoothScannerStateResponse"));
   dump_field(out, ESPHOME_PSTR("state"), static_cast<enums::BluetoothScannerState>(this->state));
@@ -2770,7 +2701,7 @@ const char *SerialProxyRequestResponse::dump_to(DumpBuffer &out) const {
   return out.c_str();
 }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
 const char *BluetoothSetConnectionParamsRequest::dump_to(DumpBuffer &out) const {
   MessageDumpHelper helper(out, ESPHOME_PSTR("BluetoothSetConnectionParamsRequest"));
   dump_field(out, ESPHOME_PSTR("address"), this->address);

esphome/components/api/api_pb2_includes.h

@@ -31,13 +31,6 @@
 #include <vector>
 #include <string>
 
-#if defined(LOG_LEVEL_NONE)
-// Zephyr defines LOG_LEVEL_NONE as a logging macro that collides with the LogLevel enum value of
-// the same name in the generated api_pb2.h. Undefine it for the rest of this translation unit so
-// the enum parses; nothing below needs Zephyr's logging macro.
-#undef LOG_LEVEL_NONE
-#endif
-
 namespace esphome::api {
 
 // This file only provides includes, no actual code

esphome/components/api/api_pb2_service.cpp

@@ -51,12 +51,10 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
     case DisconnectRequest::MESSAGE_TYPE: {
-      DisconnectRequest msg;
-      msg.decode(msg_data, msg_size);
 #ifdef HAS_PROTO_MESSAGE_DUMP
-      this->log_receive_message_(LOG_STR("on_disconnect_request"), msg);
+      this->log_receive_message_(LOG_STR("on_disconnect_request"));
 #endif
-      this->on_disconnect_request(msg);
+      this->on_disconnect_request();
       break;
     }
     case DisconnectResponse::MESSAGE_TYPE: {
@@ -302,7 +300,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
     case BluetoothDeviceRequest::MESSAGE_TYPE: {
       BluetoothDeviceRequest msg;
       msg.decode(msg_data, msg_size);
@@ -313,7 +311,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
     case BluetoothGATTGetServicesRequest::MESSAGE_TYPE: {
       BluetoothGATTGetServicesRequest msg;
       msg.decode(msg_data, msg_size);
@@ -324,7 +322,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
     case BluetoothGATTReadRequest::MESSAGE_TYPE: {
       BluetoothGATTReadRequest msg;
       msg.decode(msg_data, msg_size);
@@ -335,7 +333,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
     case BluetoothGATTWriteRequest::MESSAGE_TYPE: {
       BluetoothGATTWriteRequest msg;
       msg.decode(msg_data, msg_size);
@@ -346,7 +344,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
     case BluetoothGATTReadDescriptorRequest::MESSAGE_TYPE: {
       BluetoothGATTReadDescriptorRequest msg;
       msg.decode(msg_data, msg_size);
@@ -357,7 +355,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
     case BluetoothGATTWriteDescriptorRequest::MESSAGE_TYPE: {
       BluetoothGATTWriteDescriptorRequest msg;
       msg.decode(msg_data, msg_size);
@@ -368,7 +366,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
     case BluetoothGATTNotifyRequest::MESSAGE_TYPE: {
       BluetoothGATTNotifyRequest msg;
       msg.decode(msg_data, msg_size);
@@ -379,7 +377,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
     case 80 /* SubscribeBluetoothConnectionsFreeRequest is empty */: {
 #ifdef HAS_PROTO_MESSAGE_DUMP
       this->log_receive_message_(LOG_STR("on_subscribe_bluetooth_connections_free_request"));
@@ -694,7 +692,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
     case BluetoothSetConnectionParamsRequest::MESSAGE_TYPE: {
       BluetoothSetConnectionParamsRequest msg;
       msg.decode(msg_data, msg_size);
@@ -705,13 +703,6 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       break;
     }
 #endif
-    case 149 /* DeviceCapabilitiesRequest is empty */: {
-#ifdef HAS_PROTO_MESSAGE_DUMP
-      this->log_receive_message_(LOG_STR("on_device_capabilities_request"));
-#endif
-      this->on_device_capabilities_request();
-      break;
-    }
     default:
       break;
   }

esphome/components/api/api_pb2_service.h

@@ -21,14 +21,12 @@ class APIServerConnectionBase {
 
   void on_hello_request(const HelloRequest &value){};
 
-  void on_disconnect_request(const DisconnectRequest &value){};
+  void on_disconnect_request(){};
   void on_disconnect_response(){};
   void on_ping_request(){};
   void on_ping_response(){};
   void on_device_info_request(){};
 
-  void on_device_capabilities_request(){};
-
   void on_list_entities_request(){};
 
   void on_subscribe_states_request(){};
@@ -115,32 +113,32 @@ class APIServerConnectionBase {
   void on_subscribe_bluetooth_le_advertisements_request(const SubscribeBluetoothLEAdvertisementsRequest &value){};
 #endif
 
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   void on_bluetooth_device_request(const BluetoothDeviceRequest &value){};
 #endif
 
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   void on_bluetooth_gatt_get_services_request(const BluetoothGATTGetServicesRequest &value){};
 #endif
 
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   void on_bluetooth_gatt_read_request(const BluetoothGATTReadRequest &value){};
 #endif
 
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   void on_bluetooth_gatt_write_request(const BluetoothGATTWriteRequest &value){};
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   void on_bluetooth_gatt_read_descriptor_request(const BluetoothGATTReadDescriptorRequest &value){};
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   void on_bluetooth_gatt_write_descriptor_request(const BluetoothGATTWriteDescriptorRequest &value){};
 #endif
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   void on_bluetooth_gatt_notify_request(const BluetoothGATTNotifyRequest &value){};
 #endif
 
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   void on_subscribe_bluetooth_connections_free_request(){};
 #endif
 
@@ -235,7 +233,7 @@ class APIServerConnectionBase {
   void on_serial_proxy_request(const SerialProxyRequest &value){};
 #endif
 
-#ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#ifdef USE_BLUETOOTH_PROXY
   void on_bluetooth_set_connection_params_request(const BluetoothSetConnectionParamsRequest &value){};
 #endif
 };

esphome/components/api/api_server.cpp

@@ -107,32 +107,8 @@ void APIServer::setup() {
 
   // Initialize last_connected_ for reboot timeout tracking
   this->last_connected_ = App.get_loop_component_start_time();
-#if defined(USE_PROVISIONING) && defined(USE_API_NOISE)
-  // Register with the provisioning manager (provisioning:) as a source and
-  // report our current state (provisioned == an encryption key is set). When the
-  // window closes, disconnect any client still attempting to provision so it learns
-  // the reason. The manager owns the timeout, window state and on_timeout automation.
-  if (provisioning::global_provisioning_manager != nullptr) {
-    this->provisioning_source_ = provisioning::global_provisioning_manager->register_source();
-    provisioning::global_provisioning_manager->set_source_provisioned(this->provisioning_source_,
-                                                                      this->noise_ctx_.has_psk());
-    provisioning::global_provisioning_manager->add_on_closed_callback([this]() {
-      for (auto &c : this->active_clients()) {
-        DisconnectRequest req;
-        req.reason = enums::DISCONNECT_REASON_PROVISIONING_CLOSED;
-        // Best-effort: if the send buffer is full the reason is dropped, but the
-        // client still learns the window is closed when it reconnects (rejected at
-        // hello) or via the socket close.
-        if (!c->send_message(req)) {
-          API_LOG_MSG_DROPPED(TAG, "Disconnect request");
-        }
-      }
-    });
-  }
-#endif
-  // Set warning status if reboot timeout is enabled (suppressed while provisioning
-  // is pending so the device waits to be onboarded instead of rebooting).
-  if (this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
+  // Set warning status if reboot timeout is enabled
+  if (this->reboot_timeout_ != 0) {
     this->status_set_warning(LOG_STR("waiting for client connection"));
   }
 }
@@ -145,10 +121,8 @@ void APIServer::loop() {
 
   if (this->api_connection_count_ == 0) {
     // Check reboot timeout - done in loop to avoid scheduler heap churn
-    // (cancelled scheduler items sit in heap memory until their scheduled time).
-    // Suppressed while a provisioning window is pending so the device waits to be
-    // onboarded / reset instead of rebooting itself; resumes once provisioned.
-    if (this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
+    // (cancelled scheduler items sit in heap memory until their scheduled time)
+    if (this->reboot_timeout_ != 0) {
       const uint32_t now = App.get_loop_component_start_time();
       if (now - this->last_connected_ > this->reboot_timeout_) {
         ESP_LOGE(TAG, "No clients; rebooting");
@@ -220,8 +194,7 @@ void APIServer::remove_client_(uint8_t client_index) {
   this->clients_[last_index].reset();
 
   // Last client disconnected - set warning and start tracking for reboot timeout
-  // (suppressed while provisioning is pending - see loop()).
-  if (this->api_connection_count_ == 0 && this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
+  if (this->api_connection_count_ == 0 && this->reboot_timeout_ != 0) {
     this->status_set_warning(LOG_STR("waiting for client connection"));
     this->last_connected_ = App.get_loop_component_start_time();
   }
@@ -259,7 +232,7 @@ void __attribute__((flatten)) APIServer::accept_new_connections_() {
     conn->start();
 
     // First client connected - clear warning and update timestamp
-    if (this->api_connection_count_ == 1 && this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
+    if (this->api_connection_count_ == 1 && this->reboot_timeout_ != 0) {
       this->status_clear_warning();
       this->last_connected_ = App.get_loop_component_start_time();
     }
@@ -267,13 +240,12 @@ void __attribute__((flatten)) APIServer::accept_new_connections_() {
 }
 
 void APIServer::dump_config() {
-  char addr_buf[network::USE_ADDRESS_BUFFER_SIZE];
   ESP_LOGCONFIG(TAG,
                 "Server:\n"
                 "  Address: %s:%u\n"
                 "  Listen backlog: %u\n"
                 "  Max connections: %u",
-                network::get_use_address_to(addr_buf), this->port_, this->listen_backlog_, MAX_API_CONNECTIONS);
+                network::get_use_address(), this->port_, this->listen_backlog_, MAX_API_CONNECTIONS);
 #ifdef USE_API_NOISE
   ESP_LOGCONFIG(TAG, "  Noise encryption: %s", YESNO(this->noise_ctx_.has_psk()));
   if (!this->noise_ctx_.has_psk()) {
@@ -396,11 +368,8 @@ void APIServer::on_update(update::UpdateEntity *obj) {
 void APIServer::on_zwave_proxy_request(const ZWaveProxyRequest &msg) {
   // We could add code to manage a second subscription type, but, since this message type is
   //  very infrequent and small, we simply send it to all clients
-  for (auto &c : this->active_clients()) {
-    if (!c->send_message(msg)) {
-      API_LOG_MSG_DROPPED(TAG, "Home ID notification");
-    }
-  }
+  for (auto &c : this->active_clients())
+    c->send_message(msg);
 }
 #endif
 
@@ -431,16 +400,8 @@ void APIServer::set_batch_delay(uint16_t batch_delay) { this->batch_delay_ = bat
 
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 void APIServer::send_homeassistant_action(const HomeassistantActionRequest &call) {
-  bool has_subscriber = false;
   for (auto &client : this->active_clients()) {
-    has_subscriber |= client->send_homeassistant_action(call);
-  }
-  if (!has_subscriber) {
-    // Home Assistant subscribes to actions shortly *after* authenticating, so actions
-    // fired right at connection time (on_client_connected, on_time_sync, ...) can
-    // arrive before the subscription and are lost - warn instead of failing silently.
-    ESP_LOGW(TAG, "Home Assistant %s '%s' dropped; %s", call.is_event ? "event" : "action", call.service.c_str(),
-             this->is_connected() ? "client has not subscribed to actions (yet)" : "no client connected");
+    client->send_homeassistant_action(call);
   }
 }
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES
@@ -581,9 +542,7 @@ bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString
       ESP_LOGW(TAG, "Disconnecting all clients to reset PSK");
       for (auto &c : this->active_clients()) {
         DisconnectRequest req;
-        if (!c->send_message(req)) {
-          API_LOG_MSG_DROPPED(TAG, "Disconnect request");
-        }
+        c->send_message(req);
       }
     });
   }
@@ -612,16 +571,8 @@ bool APIServer::save_noise_psk(psk_t psk, bool make_active) {
   }
 
   SavedNoisePsk new_saved_psk{psk};
-  bool result = this->update_noise_psk_(new_saved_psk, LOG_STR("Noise PSK saved"), LOG_STR("Failed to save Noise PSK"),
-                                        make_active);
-#ifdef USE_PROVISIONING
-  // The device now has a key; report provisioned so the provisioning window is
-  // satisfied and the reboot timeout resumes normal operation.
-  if (result && provisioning::global_provisioning_manager != nullptr) {
-    provisioning::global_provisioning_manager->set_source_provisioned(this->provisioning_source_, true);
-  }
-#endif
-  return result;
+  return this->update_noise_psk_(new_saved_psk, LOG_STR("Noise PSK saved"), LOG_STR("Failed to save Noise PSK"),
+                                 make_active);
 #endif
 }
 bool APIServer::clear_noise_psk(bool make_active) {
@@ -632,16 +583,8 @@ bool APIServer::clear_noise_psk(bool make_active) {
   return false;
 #else
   SavedNoisePsk empty_psk{};
-  bool result = this->update_noise_psk_(empty_psk, LOG_STR("Noise PSK cleared"), LOG_STR("Failed to clear Noise PSK"),
-                                        make_active);
-#ifdef USE_PROVISIONING
-  // The key was cleared; report unprovisioned so a subsequent reboot reopens the
-  // provisioning window.
-  if (result && provisioning::global_provisioning_manager != nullptr) {
-    provisioning::global_provisioning_manager->set_source_provisioned(this->provisioning_source_, false);
-  }
-#endif
-  return result;
+  return this->update_noise_psk_(empty_psk, LOG_STR("Noise PSK cleared"), LOG_STR("Failed to clear Noise PSK"),
+                                 make_active);
 #endif
 }
 #endif

esphome/components/api/api_server.h

@@ -14,9 +14,6 @@
 #include "esphome/core/controller.h"
 #include "esphome/core/log.h"
 #include "esphome/core/string_ref.h"
-#ifdef USE_PROVISIONING
-#include "esphome/components/provisioning/provisioning.h"
-#endif
 #ifdef USE_LOGGER
 #include "esphome/components/logger/logger.h"
 #endif
@@ -258,19 +255,6 @@ class APIServer final : public Component,
   // Remove a disconnected client by index. Swaps with the last populated slot and resets it.
   void __attribute__((noinline)) remove_client_(uint8_t client_index);
 
-#ifdef USE_PROVISIONING
-  // True while a configured provisioning window is still pending (the device is
-  // unprovisioned). Suppresses the reboot timeout and its warning so the device is
-  // not auto-rebooted while waiting to be provisioned. False when no provisioning
-  // window is configured.
-  bool provisioning_pending_() const {
-    return provisioning::global_provisioning_manager != nullptr &&
-           provisioning::global_provisioning_manager->window_pending();
-  }
-#else
-  bool provisioning_pending_() const { return false; }
-#endif
-
 #ifdef USE_API_NOISE
   bool update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg, const LogString *fail_log_msg,
                          bool make_active);
@@ -348,10 +332,7 @@ class APIServer final : public Component,
   uint8_t listen_backlog_{4};
   bool shutting_down_ = false;
   uint8_t api_connection_count_{0};
-#if defined(USE_PROVISIONING) && defined(USE_API_NOISE)
-  // Index assigned by the provisioning manager for reporting this transport's state.
-  uint8_t provisioning_source_{0};
-#endif
+  // 7 bytes used, 1 byte padding
 
 #ifdef USE_API_NOISE
   APINoiseContext noise_ctx_;

esphome/components/api/client.py

@@ -1,10 +1,171 @@
-"""Backward-compatibility shim; the log client lives in esphome.api_client.
+from __future__ import annotations
 
-Importing this module executes the whole api component package, which pulls
-in the validation stack. CLI code paths should import esphome.api_client
-directly so the logs fast path stays light.
-"""
+import asyncio
+from datetime import datetime
+import importlib
+import logging
+from typing import TYPE_CHECKING, Any
+import warnings
 
-from esphome.api_client import async_run_logs, run_logs
+# Suppress protobuf version warnings
+with warnings.catch_warnings():
+    warnings.filterwarnings(
+        "ignore", category=UserWarning, message=".*Protobuf gencode version.*"
+    )
+    from aioesphomeapi import APIClient, parse_log_message
+    from aioesphomeapi.log_runner import async_run
 
-__all__ = ["async_run_logs", "run_logs"]
+import contextlib
+
+from esphome.const import CONF_KEY, CONF_PORT, __version__
+from esphome.core import CORE, EsphomeError
+from esphome.util import safe_print
+
+from . import CONF_ENCRYPTION
+
+if TYPE_CHECKING:
+    from aioesphomeapi.api_pb2 import (
+        SubscribeLogsResponse,  # pylint: disable=no-name-in-module
+    )
+
+
+_LOGGER = logging.getLogger(__name__)
+
+
+class _LogLineProcessor:
+    """Feeds incoming log lines to the stack-trace decoder.
+
+    Two responsibilities beyond just calling the decoder:
+    1. Catch EsphomeError. on_log runs inside an asyncio protocol
+       callback; if an exception escapes, the loop tears the transport
+       down with "Fatal error: protocol.data_received() call failed."
+       and ReconnectLogic immediately reconnects, the device replays
+       the same crash trace, and we loop forever.
+    2. Disable decoding after the first failure. _decode_pc shells out
+       to PlatformIO via _run_idedata, which is expensive; a single
+       crash dump can contain many PC/BT lines and we don't want to
+       retry the failing subprocess for each one.
+    """
+
+    def __init__(self, config: dict[str, Any], platform_handler: Any | None) -> None:
+        self._config = config
+        self._platform_handler = platform_handler
+        self._decode_enabled = True
+        self.backtrace_state = False
+
+    def process_line(self, raw_line: str) -> None:
+        if not self._decode_enabled:
+            return
+        try:
+            if self._platform_handler is not None:
+                self.backtrace_state = self._platform_handler(
+                    self._config, raw_line, self.backtrace_state
+                )
+        except EsphomeError as exc:
+            self._decode_enabled = False
+            self.backtrace_state = False
+            # _run_idedata raises EsphomeError with no message; fall back
+            # to a generic explanation when str(exc) is empty.
+            detail = str(exc) or "build artifacts not found locally"
+            _LOGGER.warning(
+                "Crash trace decoding unavailable: %s. "
+                "Run 'esphome compile' for this device to enable PC decoding.",
+                detail,
+            )
+
+
+async def async_run_logs(
+    config: dict[str, Any],
+    addresses: list[str],
+    subscribe_states: bool = True,
+) -> None:
+    """Run the logs command in the event loop."""
+    conf = config["api"]
+    name = config["esphome"]["name"]
+    port: int = int(conf[CONF_PORT])
+    noise_psk: str | None = None
+    if (encryption := conf.get(CONF_ENCRYPTION)) and (key := encryption.get(CONF_KEY)):
+        noise_psk = key
+
+    if len(addresses) == 1:
+        _LOGGER.info("Starting log output from %s using esphome API", addresses[0])
+    else:
+        _LOGGER.info(
+            "Starting log output from %s using esphome API", " or ".join(addresses)
+        )
+
+    cli = APIClient(
+        addresses[0],  # Primary address for compatibility
+        port,
+        "",  # Password auth removed in 2026.1.0
+        client_info=f"ESPHome Logs {__version__}",
+        noise_psk=noise_psk,
+        addresses=addresses,  # Pass all addresses for automatic retry
+        provide_time=False,
+    )
+
+    # Try platform-specific stacktrace handler first, fall back to generic
+    platform_process_stacktrace = None
+    try:
+        module = importlib.import_module("esphome.components." + CORE.target_platform)
+        platform_process_stacktrace = module.process_stacktrace
+    except (AttributeError, ImportError):
+        _LOGGER.info(
+            'Stacktrace analysis is unavailable: no compatible analyzer found for target platform "%s".',
+            CORE.target_platform,
+        )
+
+    processor = _LogLineProcessor(config, platform_process_stacktrace)
+
+    def on_log(msg: SubscribeLogsResponse) -> None:
+        """Handle a new log message."""
+        time_ = datetime.now().astimezone()
+        message: bytes = msg.message
+        text = message.decode("utf8", "backslashreplace")
+        nanoseconds = time_.microsecond // 1000
+        timestamp = (
+            f"[{time_.hour:02}:{time_.minute:02}:{time_.second:02}.{nanoseconds:03}]"
+        )
+        for parsed_msg in parse_log_message(text, timestamp):
+            # safe_print handles the dashboard \033 escaping and falls back
+            # to backslashreplace encoding on stdouts that can't represent
+            # the wifi signal-bar block characters (Windows redirected
+            # cp1252 pipe).
+            safe_print(parsed_msg)
+        for raw_line in text.splitlines():
+            processor.process_line(raw_line)
+
+    # Safe to fall back to plaintext here only for this diagnostics use
+    # case: the stream is one-way from device to client, and this code
+    # never accepts commands or acts on any message the device sends.
+    # An on-path attacker could still both inject fabricated log lines
+    # and passively read the device's log output (and any state data
+    # delivered when subscribe_states is enabled), so this does lose
+    # confidentiality as well as authentication/integrity. That tradeoff
+    # is acceptable for operator-visible logs, which aioesphomeapi also
+    # warns may come from an unverified device. Never mirror this opt-in
+    # for any connection that sends data to the device or uses Home
+    # Assistant actions.
+    stop = await async_run(
+        cli,
+        on_log,
+        name=name,
+        subscribe_states=subscribe_states,
+        allow_plaintext_fallback=True,
+    )
+    try:
+        await asyncio.Event().wait()
+    finally:
+        await stop()
+
+
+def run_logs(
+    config: dict[str, Any],
+    addresses: list[str],
+    subscribe_states: bool = True,
+) -> None:
+    """Run the logs command."""
+    with contextlib.suppress(KeyboardInterrupt):
+        asyncio.run(
+            async_run_logs(config, addresses, subscribe_states=subscribe_states)
+        )

esphome/components/aqi/__init__.py

@@ -7,7 +7,6 @@ AQICalculatorType = aqi_ns.enum("AQICalculatorType")
 
 CONF_AQI = "aqi"
 CONF_CALCULATION_TYPE = "calculation_type"
-CONF_EXTENDED_RANGE = "extended_range"
 
 AQI_CALCULATION_TYPE = {
     "CAQI": AQICalculatorType.CAQI_TYPE,

esphome/components/aqi/abstract_aqi_calculator.h

@@ -6,7 +6,7 @@ namespace esphome::aqi {
 
 class AbstractAQICalculator {
  public:
-  virtual uint16_t get_aqi(float pm2_5_value, float pm10_0_value, bool extended_range) = 0;
+  virtual uint16_t get_aqi(float pm2_5_value, float pm10_0_value) = 0;
 };
 
 }  // namespace esphome::aqi

esphome/components/aqi/aqi_calculator.h

@@ -11,12 +11,10 @@ namespace esphome::aqi {
 
 class AQICalculator : public AbstractAQICalculator {
  public:
-  uint16_t get_aqi(float pm2_5_value, float pm10_0_value, bool extended_range) override {
-    float pm2_5_index = calculate_index(pm2_5_value, PM2_5_GRID, extended_range);
-    float pm10_0_index = calculate_index(pm10_0_value, PM10_0_GRID, extended_range);
+  uint16_t get_aqi(float pm2_5_value, float pm10_0_value) override {
+    float pm2_5_index = calculate_index(pm2_5_value, PM2_5_GRID);
+    float pm10_0_index = calculate_index(pm10_0_value, PM10_0_GRID);
     float aqi = std::max({pm2_5_index, pm10_0_index, 0.0f});
-    // extended_range lets the index run past the standard maximum, so clamp to the sensor's range.
-    aqi = std::min(aqi, static_cast<float>(std::numeric_limits<uint16_t>::max()));
     return static_cast<uint16_t>(std::lround(aqi));
   }
 
@@ -32,7 +30,7 @@ class AQICalculator : public AbstractAQICalculator {
       {35.5f, 55.5f},
       {55.5f, 125.5f},
       {125.5f, 225.5f},
-      {225.5f, 500.4f}  // EPA 2024: AQI 301-500 maps to PM2.5 225.5-500.4 ug/m3
+      {225.5f, std::numeric_limits<float>::max()}
       // clang-format on
   };
 
@@ -43,11 +41,11 @@ class AQICalculator : public AbstractAQICalculator {
       {155.0f, 255.0f},
       {255.0f, 355.0f},
       {355.0f, 425.0f},
-      {425.0f, 604.0f}  // EPA: AQI 301-500 maps to PM10 425-604 ug/m3 (top of the 401-500 band)
+      {425.0f, std::numeric_limits<float>::max()}
       // clang-format on
   };
 
-  static float calculate_index(float value, const float array[NUM_LEVELS][2], bool extended_range) {
+  static float calculate_index(float value, const float array[NUM_LEVELS][2]) {
     int grid_index = get_grid_index(value, array);
     if (grid_index == -1) {
       return -1.0f;
@@ -57,22 +55,14 @@ class AQICalculator : public AbstractAQICalculator {
     float conc_lo = array[grid_index][0];
     float conc_hi = array[grid_index][1];
 
-    float index = (value - conc_lo) * (aqi_hi - aqi_lo) / (conc_hi - conc_lo) + aqi_lo;
-
-    // Concentrations above the highest breakpoint run the linear fit past aqi_hi. By default we
-    // clamp to the standard maximum; with extended_range we keep the extrapolated "over-range"
-    // value so heavy pollution reports numbers beyond what the standard defines.
-    if (grid_index == NUM_LEVELS - 1 && !extended_range && index > aqi_hi) {
-      return aqi_hi;
-    }
-    return index;
+    return (value - conc_lo) * (aqi_hi - aqi_lo) / (conc_hi - conc_lo) + aqi_lo;
   }
 
   static int get_grid_index(float value, const float array[NUM_LEVELS][2]) {
     for (int i = 0; i < NUM_LEVELS; i++) {
-      // The top band is open-ended: any value at or above its lower breakpoint falls into it,
-      // and calculate_index() decides whether to clamp or extrapolate.
-      const bool in_range = (value >= array[i][0]) && (i == NUM_LEVELS - 1 || value < array[i][1]);
+      const bool in_range =
+          (value >= array[i][0]) && ((i == NUM_LEVELS - 1) ? (value <= array[i][1])   // last bucket inclusive
+                                                           : (value < array[i][1]));  // others exclusive on hi
       if (in_range) {
         return i;
       }

esphome/components/aqi/aqi_sensor.cpp

@@ -24,7 +24,6 @@ void AQISensor::setup() {
 void AQISensor::dump_config() {
   ESP_LOGCONFIG(TAG, "AQI Sensor:");
   ESP_LOGCONFIG(TAG, "  Calculation Type: %s", this->aqi_calc_type_ == AQI_TYPE ? "AQI" : "CAQI");
-  ESP_LOGCONFIG(TAG, "  Extended Range: %s", this->extended_range_ ? "enabled" : "disabled");
   if (this->pm_2_5_sensor_ != nullptr) {
     ESP_LOGCONFIG(TAG, "  PM2.5 Sensor: '%s'", this->pm_2_5_sensor_->get_name().c_str());
   }
@@ -45,7 +44,7 @@ void AQISensor::calculate_aqi_() {
     return;
   }
 
-  uint16_t aqi = calculator->get_aqi(this->pm_2_5_value_, this->pm_10_0_value_, this->extended_range_);
+  uint16_t aqi = calculator->get_aqi(this->pm_2_5_value_, this->pm_10_0_value_);
   this->publish_state(aqi);
 }
 

esphome/components/aqi/aqi_sensor.h

@@ -14,7 +14,6 @@ class AQISensor final : public sensor::Sensor, public Component {
   void set_pm_2_5_sensor(sensor::Sensor *sensor) { this->pm_2_5_sensor_ = sensor; }
   void set_pm_10_0_sensor(sensor::Sensor *sensor) { this->pm_10_0_sensor_ = sensor; }
   void set_aqi_calculation_type(AQICalculatorType type) { this->aqi_calc_type_ = type; }
-  void set_extended_range(bool extended_range) { this->extended_range_ = extended_range; }
 
  protected:
   void calculate_aqi_();
@@ -22,7 +21,6 @@ class AQISensor final : public sensor::Sensor, public Component {
   sensor::Sensor *pm_2_5_sensor_{nullptr};
   sensor::Sensor *pm_10_0_sensor_{nullptr};
   AQICalculatorType aqi_calc_type_{AQI_TYPE};
-  bool extended_range_{false};
   AQICalculatorFactory aqi_calculator_factory_;
 
   float pm_2_5_value_{NAN};

esphome/components/aqi/caqi_calculator.h

@@ -9,28 +9,25 @@ namespace esphome::aqi {
 
 class CAQICalculator : public AbstractAQICalculator {
  public:
-  // The CAQI (CITEAIR) scale defines no maximum: its top "Very high" class is simply ">100". We
-  // therefore always extrapolate the top band past 100 without limit, so the extended_range flag
-  // (which lifts the AQI calculator's fixed 500 cap) has no meaning here and is ignored.
-  uint16_t get_aqi(float pm2_5_value, float pm10_0_value, bool /*extended_range*/) override {
+  uint16_t get_aqi(float pm2_5_value, float pm10_0_value) override {
     float pm2_5_index = calculate_index(pm2_5_value, PM2_5_GRID);
     float pm10_0_index = calculate_index(pm10_0_value, PM10_0_GRID);
     float aqi = std::max({pm2_5_index, pm10_0_index, 0.0f});
-    aqi = std::min(aqi, static_cast<float>(std::numeric_limits<uint16_t>::max()));
     return static_cast<uint16_t>(std::lround(aqi));
   }
 
  protected:
-  static constexpr int NUM_LEVELS = 4;
+  static constexpr int NUM_LEVELS = 5;
 
-  static constexpr int INDEX_GRID[NUM_LEVELS][2] = {{0, 25}, {26, 50}, {51, 75}, {76, 100}};
+  static constexpr int INDEX_GRID[NUM_LEVELS][2] = {{0, 25}, {26, 50}, {51, 75}, {76, 100}, {101, 400}};
 
   static constexpr float PM2_5_GRID[NUM_LEVELS][2] = {
       // clang-format off
       {0.0f, 15.1f},
       {15.1f, 30.1f},
       {30.1f, 55.1f},
-      {55.1f, 110.1f}
+      {55.1f, 110.1f},
+      {110.1f, std::numeric_limits<float>::max()}
       // clang-format on
   };
 
@@ -39,7 +36,8 @@ class CAQICalculator : public AbstractAQICalculator {
       {0.0f, 25.1f},
       {25.1f, 50.1f},
       {50.1f, 90.1f},
-      {90.1f, 180.1f}
+      {90.1f, 180.1f},
+      {180.1f, std::numeric_limits<float>::max()}
       // clang-format on
   };
 
@@ -54,15 +52,14 @@ class CAQICalculator : public AbstractAQICalculator {
     float conc_lo = array[grid_index][0];
     float conc_hi = array[grid_index][1];
 
-    // The top band is open-ended (see get_grid_index), so for concentrations above the last
-    // breakpoint this linear fit extrapolates past 100 unbounded, matching CAQI's open ">100" class.
     return (value - conc_lo) * (aqi_hi - aqi_lo) / (conc_hi - conc_lo) + aqi_lo;
   }
 
   static int get_grid_index(float value, const float array[NUM_LEVELS][2]) {
     for (int i = 0; i < NUM_LEVELS; i++) {
-      // The top band is open-ended: any value at or above its lower breakpoint falls into it.
-      const bool in_range = (value >= array[i][0]) && (i == NUM_LEVELS - 1 || value < array[i][1]);
+      const bool in_range =
+          (value >= array[i][0]) && ((i == NUM_LEVELS - 1) ? (value <= array[i][1])   // last bucket inclusive
+                                                           : (value < array[i][1]));  // others exclusive on hi
       if (in_range) {
         return i;
       }