[at581x] Apply configured false and zero values in the settings action

Signed-off-by: dependabot[bot] <support@github.com>

.agents/skills/code-review/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: code-review
+description: Review guidance for ESPHome pull requests. Use this when reviewing a pull request that changes ESPHome Python, C++, or component code, to check it against the project's coding conventions, embedded-systems memory rules, testing requirements, and breaking-change policy.
+---
+
+# Reviewing ESPHome pull requests
+
+ESPHome parses YAML into C++ firmware for memory-constrained microcontrollers
+(ESP32, ESP8266, RP2040, LibreTiny). Review changes with that in mind: RAM and
+flash are scarce, and code runs unattended for months.
+
+`AGENTS.md` in the repository root is the full contributor guide and the
+authority when it disagrees with this summary. The developer documentation at
+https://developers.esphome.io explains the component lifecycle and the reasoning
+behind these rules. This skill lists the concrete things worth flagging in a
+review; read `AGENTS.md` for the detail behind any item.
+
+Only raise findings that the diff actually introduces or changes. Do not ask for
+drive-by cleanup of pre-existing code the PR did not touch.
+
+## Memory and embedded constraints (highest value)
+
+Heap allocation after `setup()` is treated as a reliability bug, not a
+performance nit, because it fragments a small shared heap. Flag:
+
+- New heap allocation on a hot path or after setup that could be avoided.
+- `std::vector` where the size is known at compile time (use `std::array`, or
+  `StaticVector<T, N>` when a `push_back` API is needed) or fixed at runtime
+  init (use `FixedVector<T>`).
+- Listener / child-entity registration lists stored as `std::vector`; these have
+  a compile-time-known count and should use `cg.slot_counter()` plus
+  `StaticVector`.
+- `std::vector<uint8_t>` for a byte buffer that never grows: prefer
+  `std::unique_ptr<uint8_t[]>` or `std::array`.
+- `std::map` / `std::set` / `std::unordered_map` for small datasets (1-16
+  elements): a `std::vector` of a small struct with linear search is lighter.
+- `std::deque` anywhere: it allocates 512-byte blocks and should be avoided.
+- `std::string` storing a value set once from config: prefer `StringRef` (the
+  literal already lives in flash).
+- `std::string` / `std::to_string` / string-returning helpers on hot paths where
+  a buffer or view API exists.
+
+## C++ conventions
+
+- Include what you use: a file referencing a symbol must include the header that
+  declares it, even if it currently arrives transitively. New or changed uses of
+  a symbol need the matching include.
+- Prefix all member access with `this->`.
+- Naming: `lower_snake_case` for functions/methods/variables, `UpperCamelCase`
+  for classes/structs/enums, `UPPER_SNAKE_CASE` for namespace-scope constants,
+  trailing underscore on protected/private fields.
+- `enum class` values must be prefixed with the enum name in `UPPER_SNAKE_CASE`
+  (e.g. `UARTFlushResult::UART_FLUSH_RESULT_SUCCESS`). Bare names like `SUCCESS`,
+  `FAIL`, or `OK` collide with SDK macros on some platforms and break the build.
+- Prefer `const`/`enum` over `#define`; `#define` is only for conditional
+  compilation and code-generation sizes.
+- Never call `millis()` in a `loop()` body; use
+  `App.get_loop_component_start_time()`. A rate-limit gate below ~16 ms (the loop
+  period) does nothing.
+- Pick the timing primitive by cadence: gated `loop()` under 250 ms,
+  `set_interval` at 500 ms and above.
+- Do not override a base method to return the value it already returns (e.g.
+  `get_setup_priority()` returning `setup_priority::DATA`).
+- Wrap string literals passed as printf `%s` args in `LOG_STR_LITERAL()`.
+- Required, invariant dependencies should be constructor parameters, not setters.
+- Callback registration methods must be templated (`template<typename F>`), not
+  typed as `std::function`, so lightweight forwarders avoid a heap allocation.
+- Two-space indent, `using` over `typedef`, wrap at 120 columns.
+
+## Python conventions
+
+- Type-annotate every new function signature (params and return), new dataclass
+  fields, and new module-level variables. Import `ConfigType` from
+  `esphome.types`.
+- Use the walrus operator to avoid a double lookup, e.g.
+  `if (blah := config.get(CONF_BLAH)) is not None:`.
+- Reuse existing validators from `config_validation.py` (`cv.rename_key`,
+  `cv.has_exactly_one_key`, etc.) via `cv.All(...)` instead of hand-rolling.
+- `esphome/const.py` is frozen: no new `CONF_` constants there. Define them in
+  the component's own `.py`, or in `esphome/components/const/__init__.py` when
+  shared. The same constant defined in three or more component files fails CI.
+- State that must persist during code generation goes in `CORE.data` namespaced
+  under the component `DOMAIN` (a `@dataclass`), not module-level mutable globals.
+- Prefer callback-based triggers via `build_callback_automation()`; only use a
+  `Trigger<Ts...>` subclass when the forwarder needs mutable state.
+
+## Testing and coverage
+
+- New and changed lines and branches need test coverage, including defensive
+  early-returns, error paths, and no-op guards. A mocked-out function is not
+  covered; exercise the real call path too.
+- Component YAML tests live in `tests/components/<component>/`. Never define
+  buses (uart, i2c, spi, modbus) directly in a test file: pull them from
+  `tests/test_build_components/common/` through dict-style `packages:` so CI can
+  group builds. List-style packages or top-level merge keys block grouping.
+- Config-only checks use the `validate.*.yaml` prefix; compiled checks use
+  `test.*.yaml`.
+
+## Breaking changes and public API
+
+- Base classes under `esphome/core/` and documented config options are public
+  API. Undocumented `public` members of a component are internal.
+- A breaking change needs justification, a migration path in the PR description,
+  and a deprecation window where feasible (`ESPDEPRECATED` in C++,
+  `cv.rename_key(..., removed_in=...)` in Python). Changing a codegen-injected
+  lambda signature is not a breaking change.
+
+## Process and PR hygiene
+
+- PR titles start with a `[tag]` prefix: the component name (e.g. `[uart] ...`)
+  or `[core]` for shared code.
+- Prose in docs, comments, and commit messages should be plain English. Keep
+  inline comments short and only where the code is not self-explanatory; do not
+  restate what the code says.
+- Verify the PR fills out `.github/PULL_REQUEST_TEMPLATE.md` and adds
+  `CODEOWNERS` entries for a new component.

.claude/skills

@@ -0,0 +1 @@
+../.agents/skills

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -9,6 +9,29 @@ body:
         If you have a feature request or enhancement, please [request them here instead][fr].
 
         [fr]: https://github.com/orgs/esphome/discussions
+  - type: markdown
+    attributes:
+      value: |
+        ## Use of AI in bug reports
+
+        AI tools are good at carrying out well-defined tasks, but they are not good at troubleshooting.
+        Please do NOT paste an AI-generated wall of text into the issue template - if the AI hasn't solved
+        your problem, its wild guesses are not likely to help.
+
+        Please DO include your own words and observations, compile/boot logs, and
+        especially a minimal reproducible example of your YAML configuration that demonstrates the problem.
+
+        It is however quite acceptable to use AI to translate your *own* report,
+        if you aren't a competent English speaker.
+
+        If you really think it will be useful to include an AI's analysis, preferably wrap it in a `<details>` block which will be collapsed by default.
+
+        If you are using AI to help solve a problem, rather than asking it to speculate about what the problem is,
+        it can be more useful to ask it to create a step-by-step troubleshooting procedure.
+        AI is also useful for generating boilerplate code, such as a minimal reproducible example of your YAML
+        configuration that demonstrates the problem.
+
+        Used properly, AI can be a useful tool to help you solve your problem, but don't let it get in the way.
   - type: textarea
     validations:
       required: true

.github/actions/build-image/action.yaml

@@ -42,7 +42,7 @@ runs:
 
     - name: Build and push to ghcr by digest
       id: build-ghcr
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
@@ -67,7 +67,7 @@ runs:
 
     - name: Build and push to dockerhub by digest
       id: build-dockerhub
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false

.github/actions/restore-python/action.yml

@@ -32,7 +32,7 @@ runs:
       # detects the activated venv via ``VIRTUAL_ENV`` so the venv layout
       # downstream jobs rely on is preserved.
       if: steps.cache-venv.outputs.cache-hit != 'true'
-      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       with:
         enable-cache: true
         # Pull request saves land in per-PR scopes nothing else can

.github/skills

@@ -0,0 +1 @@
+../.agents/skills

.github/workflows/ci-api-proto.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up uv
         # ``--system`` (below) installs into the setup-python interpreter;
         # no venv is created or restored by this workflow.
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           # Pull-request-only workflow: a save could never be shared and

.github/workflows/ci-docker.yml

@@ -67,7 +67,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
 
       - name: Determine tag and whether to push
         id: tag
@@ -159,7 +159,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
 
       - name: Log in to the GitHub container registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

.github/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
         # detects the activated venv via ``VIRTUAL_ENV`` so downstream jobs
         # that ``. venv/bin/activate`` see an identical layout.
         if: steps.cache-venv.outputs.cache-hit != 'true'
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           # Pull request saves land in per-PR scopes nothing else can
@@ -321,7 +321,7 @@ jobs:
           . venv/bin/activate
           pytest -vv --cov-report=xml --tb=native --durations=30 -n auto tests --ignore=tests/integration/
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
       - name: Save Python virtual environment cache
         if: github.ref == 'refs/heads/dev'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -350,7 +350,7 @@ jobs:
       - name: Check out code from GitHub
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Report empty upload to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           run_command: empty-upload
           force: true
@@ -413,7 +413,7 @@ jobs:
       - name: Set up uv
         # Only needed on cache miss to populate the venv.
         if: steps.cache-venv.outputs.cache-hit != 'true'
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           # Pull request saves land in per-PR scopes nothing else can
@@ -1274,7 +1274,7 @@ jobs:
         # install step (order-of-magnitude faster on cold boots,
         # with its own wheel cache). actions/setup-python still
         # provides the interpreter.
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           # Pull request saves land in per-PR scopes nothing else can

.github/workflows/codeql.yml

@@ -56,7 +56,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -84,6 +84,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/lock.yml

@@ -14,4 +14,4 @@ jobs:
     permissions:
       issues: write         # issues.lock on closed issues
       pull-requests: write  # issues.lock on closed pull requests
-    uses: esphome/workflows/.github/workflows/lock.yml@0fdd5e311b7e744069166696072a1a9cbc5fbeb6  # 2026.8.1
+    uses: esphome/workflows/.github/workflows/lock.yml@cc3e76de337dc59bc1cba8da58d963cd23b873f1  # 2026.9.0

.github/workflows/release.yml

@@ -123,7 +123,7 @@ jobs:
           python-version: "3.12"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
 
       - name: Log in to docker hub
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -202,7 +202,7 @@ jobs:
           merge-multiple: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
 
       - name: Log in to docker hub
         if: matrix.registry == 'dockerhub'

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
     # No GITHUB_TOKEN permissions: the reusable workflow mints an ESPHome
     # GitHub App token so the labels, comments and closures come from
     # esphome[bot] instead of github-actions[bot].
-    uses: esphome/workflows/.github/workflows/stale.yml@a1c1485ab46ef41a84a6a9d8abd7fa4b7628fd70  # main
+    uses: esphome/workflows/.github/workflows/stale.yml@cc3e76de337dc59bc1cba8da58d963cd23b873f1  # main
     secrets:
       ESPHOME_GITHUB_APP_PRIVATE_KEY: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
     with:

.github/workflows/sync-device-classes.yml

@@ -47,7 +47,7 @@ jobs:
         # setup-python interpreter so subsequent ``prek`` /
         # ``script/run-in-env.py`` steps find the deps without a
         # ``uv run`` prefix.
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           # Pin uv version so the action does not have to fetch the

.pre-commit-config.yaml

@@ -10,7 +10,7 @@ ci:
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.16.6
+    rev: v0.16.8
     hooks:
       # Run the linter.
       - id: ruff

AGENTS.md

@@ -431,7 +431,17 @@ file does, and it is the authority when they disagree. The most useful starting
           MyComponent *parent_;
         };
         ```
-        Register with `@automation.register_action("my_component.do_something", MyAction, schema, synchronous=True)`. Use `synchronous=True` for actions that run to completion inside `play()` without deferring. Use `synchronous=False` if the action may suspend/defer execution (e.g. `delay`, `wait_until`, `script.wait`) or store trigger arguments for later use.
+        Register it without writing a builder:
+        ```python
+        automation.register_simple_action(
+            "my_component.do_something", MyAction, schema, synchronous=True
+        )
+        ```
+        The constructor receives the object named by `config[CONF_ID]`. Use `register_bare_action` for a
+        no-argument constructor, `register_parented_action` for a class deriving from `Parented<T>`, and
+        the `@automation.register_action(...)` decorator only when the builder must also set fields.
+
+        Use `synchronous=True` for actions that run to completion inside `play()` without deferring. Use `synchronous=False` if the action may suspend/defer execution (e.g. `delay`, `wait_until`, `script.wait`) or store trigger arguments for later use.
 
     *   **Conditions:**
         ```cpp
@@ -443,7 +453,8 @@ file does, and it is the authority when they disagree. The most useful starting
           MyComponent *parent_;
         };
         ```
-        Register with `@automation.register_condition("my_component.is_active", MyCondition, schema)`.
+        Register with `automation.register_simple_condition("my_component.is_active", MyCondition, schema)`;
+        `register_bare_condition`, `register_parented_condition` and the decorator follow the action rules.
 
 *   **Type Hints:** Type-hint all function signatures, including test functions and config validators (e.g. `def validate_x(config: ConfigType) -> ConfigType:`, `def test_x() -> None:`). Import `ConfigType` from `esphome.types`.
 

CODEOWNERS

@@ -100,6 +100,7 @@ esphome/components/bmp581_i2c/* @danielkent-net @kahrendt
 esphome/components/bmp581_spi/* @danielkent-net @kahrendt
 esphome/components/bp1658cj/* @Cossid
 esphome/components/bp5758d/* @Cossid
+esphome/components/bridge/* @kbx81
 esphome/components/bthome_mithermometer/* @nagyrobi
 esphome/components/button/* @esphome/core
 esphome/components/bytebuffer/* @clydebarrow
@@ -111,6 +112,8 @@ esphome/components/captive_portal/* @esphome/core
 esphome/components/cc1101/* @gabest11 @lygris
 esphome/components/ccs811/* @habbie
 esphome/components/cd74hc4067/* @asoehlke
+esphome/components/cdc_acm_uart/* @kbx81
+esphome/components/cdc_acm_uart/bridge/* @kbx81
 esphome/components/ch422g/* @clydebarrow @jesterret
 esphome/components/ch423/* @dwmw2
 esphome/components/chsc6x/* @kkosik20
@@ -179,7 +182,6 @@ esphome/components/esp32_camera_web_server/* @ayufan
 esphome/components/esp32_can/* @Sympatron
 esphome/components/esp32_hosted/* @swoboda1337
 esphome/components/esp32_hosted/update/* @swoboda1337
-esphome/components/esp32_improv/* @jesserockz
 esphome/components/esp32_rmt/* @jesserockz
 esphome/components/esp32_rmt_led_strip/* @jesserockz
 esphome/components/esp8266/* @esphome/core
@@ -263,8 +265,10 @@ esphome/components/i2s_audio/* @jesserockz
 esphome/components/i2s_audio/microphone/* @jesserockz
 esphome/components/i2s_audio/speaker/* @jesserockz @kahrendt
 esphome/components/iaqcore/* @yozik04
+esphome/components/icnt86/* @danepowell
 esphome/components/ili9xxx/* @clydebarrow @nielsnl68
 esphome/components/improv_base/* @esphome/core
+esphome/components/improv_ble/* @jesserockz
 esphome/components/improv_serial/* @esphome/core
 esphome/components/ina226/* @latonita @Sergio303
 esphome/components/ina260/* @mreditor97
@@ -474,6 +478,7 @@ esphome/components/sendspin/image/* @kahrendt
 esphome/components/sendspin/media_player/* @kahrendt
 esphome/components/sendspin/media_source/* @kahrendt
 esphome/components/sendspin/sensor/* @kahrendt
+esphome/components/sendspin/switch/* @kahrendt
 esphome/components/sendspin/text_sensor/* @kahrendt
 esphome/components/sensirion_common/* @martgras
 esphome/components/sensor/* @esphome/core
@@ -586,6 +591,7 @@ esphome/components/uart/* @esphome/core
 esphome/components/uart/button/* @ssieb
 esphome/components/uart/event/* @eoasmxd
 esphome/components/uart/packet_transport/* @clydebarrow
+esphome/components/uart_mux/* @kbx81
 esphome/components/udp/* @clydebarrow
 esphome/components/ufire_ec/* @pvizeli
 esphome/components/ufire_ise/* @pvizeli

docker/Dockerfile

@@ -22,7 +22,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.14.7
+RUN uv pip install --no-cache-dir esphome-device-builder==1.14.9
 
 RUN \
     platformio settings set enable_telemetry No \

esphome/automation.py

@@ -102,6 +102,101 @@ def register_condition(name: str, condition_type: MockObjClass, schema: cv.Schem
     return CONDITION_REGISTRY.register(name, condition_type, schema)
 
 
+async def _build_with_parent(
+    config: ConfigType,
+    automation_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    parent = await cg.get_variable(config[CONF_ID])
+    return cg.new_Pvariable(automation_id, template_arg, parent)
+
+
+async def _build_without_parent(
+    config: ConfigType,
+    automation_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    return cg.new_Pvariable(automation_id, template_arg)
+
+
+async def _build_parented(
+    config: ConfigType,
+    automation_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    var = cg.new_Pvariable(automation_id, template_arg)
+    await cg.register_parented(var, config[CONF_ID])
+    return var
+
+
+def register_simple_action(
+    name: str,
+    action_type: MockObjClass,
+    schema: cv.Schema,
+    *,
+    synchronous: bool,
+) -> None:
+    """Register an action whose constructor takes the object named by ``config[CONF_ID]``.
+
+    Use the ``register_action`` decorator instead when the builder must also set fields.
+    """
+    register_action(name, action_type, schema, synchronous=synchronous)(
+        _build_with_parent
+    )
+
+
+def register_simple_condition(
+    name: str, condition_type: MockObjClass, schema: cv.Schema
+) -> None:
+    """Condition counterpart of ``register_simple_action``."""
+    register_condition(name, condition_type, schema)(_build_with_parent)
+
+
+def register_bare_action(
+    name: str,
+    action_type: MockObjClass,
+    schema: cv.Schema,
+    *,
+    synchronous: bool,
+) -> None:
+    """Register an action whose constructor takes no arguments."""
+    register_action(name, action_type, schema, synchronous=synchronous)(
+        _build_without_parent
+    )
+
+
+def register_bare_condition(
+    name: str, condition_type: MockObjClass, schema: cv.Schema
+) -> None:
+    """Condition counterpart of ``register_bare_action``."""
+    register_condition(name, condition_type, schema)(_build_without_parent)
+
+
+def register_parented_action(
+    name: str,
+    action_type: MockObjClass,
+    schema: cv.Schema,
+    *,
+    synchronous: bool,
+) -> None:
+    """Register an action deriving from ``Parented<T>``.
+
+    The object is constructed without arguments and ``set_parent()`` receives the object
+    named by ``config[CONF_ID]``.
+    """
+    register_action(name, action_type, schema, synchronous=synchronous)(_build_parented)
+
+
+def register_parented_condition(
+    name: str, condition_type: MockObjClass, schema: cv.Schema
+) -> None:
+    """Condition counterpart of ``register_parented_action``."""
+    register_condition(name, condition_type, schema)(_build_parented)
+
+
 Action = cg.esphome_ns.class_("Action")
 Trigger = cg.esphome_ns.class_("Trigger")
 ACTION_REGISTRY = Registry()
@@ -534,44 +629,20 @@ async def lambda_action_to_code(
     return new_lambda_pvariable(action_id, lambda_, StatelessLambdaAction, template_arg)
 
 
-@register_action(
+register_simple_action(
     "component.update",
     UpdateComponentAction,
-    maybe_simple_id(
-        {
-            cv.Required(CONF_ID): cv.use_id(cg.PollingComponent),
-        }
-    ),
+    maybe_simple_id({cv.Required(CONF_ID): cv.use_id(cg.PollingComponent)}),
     synchronous=True,
 )
-async def component_update_action_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
-    comp = await cg.get_variable(config[CONF_ID])
-    return cg.new_Pvariable(action_id, template_arg, comp)
 
 
-@register_action(
+register_simple_action(
     "component.suspend",
     SuspendComponentAction,
-    maybe_simple_id(
-        {
-            cv.Required(CONF_ID): cv.use_id(cg.PollingComponent),
-        }
-    ),
+    maybe_simple_id({cv.Required(CONF_ID): cv.use_id(cg.PollingComponent)}),
     synchronous=True,
 )
-async def component_suspend_action_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
-    comp = await cg.get_variable(config[CONF_ID])
-    return cg.new_Pvariable(action_id, template_arg, comp)
 
 
 @register_action(

esphome/build_gen/espidf.py

@@ -90,9 +90,10 @@ def get_project_cmakelists(
     """
     idf_target = variant_to_idf_target(get_esp32_variant())
 
-    # esp_idf_size 2.x (bundled with IDF >=6.0) made NG the default and
-    # removed the --ng flag; on 1.x (IDF 5.5) --ng is required to get
-    # --format=raw because the legacy mode doesn't support it.
+    # esp_idf_size 2.x (IDF >=6.0) made NG the default and removed --ng;
+    # 1.x (IDF 5.5) needs --ng for --format=json2. 1.x json2 also lacks
+    # total_size, hence the ELF fallback in espidf/size_summary.py; both
+    # go away together when 1.x support is dropped.
     size_ng_flag = "--ng" if idf_version() < cv.Version(6, 0, 0) else ""
 
     # Project-wide compile options: -D defines and -W warning flags (skip
@@ -211,10 +212,12 @@ include($ENV{{IDF_PATH}}/tools/cmake/project.cmake)
 
 project({CORE.name})
 
-# Emit raw JSON size data for ESPHome to read post-build.
+# Emit per-memory-type JSON size data for ESPHome to read post-build.
+# json2 stays small; raw dumps every symbol (~2s on a large map) and
+# this command runs inside the link edge, blocking everything downstream.
 add_custom_command(
     TARGET ${{CMAKE_PROJECT_NAME}}.elf POST_BUILD
-    COMMAND ${{PYTHON}} -m esp_idf_size {size_ng_flag} --format=raw
+    COMMAND ${{PYTHON}} -m esp_idf_size {size_ng_flag} --format=json2
             -o ${{CMAKE_BINARY_DIR}}/esp_idf_size.json
             ${{CMAKE_PROJECT_NAME}}.map
     WORKING_DIRECTORY ${{CMAKE_BINARY_DIR}}

esphome/component_aliases.py

@@ -6,5 +6,6 @@ See the component-alias section of esphome/loader.py.
 
 # alias -> (canonical component, removal version or None)
 COMPONENT_ALIASES: dict[str, tuple[str, str | None]] = {
+    "esp32_improv": ("improv_ble", "2027.4.0"),
     "rp2040": ("rp2", "2027.7.0"),
 }

esphome/components/adc/adc_sensor.h

@@ -94,7 +94,7 @@ class ADCSensor final : public sensor::Sensor, public PollingComponent, public v
   ///   - SamplingMode::MIN: Use the lowest sample value
   ///   - SamplingMode::MAX: Use the highest sample value
   /// @param sampling_mode The desired sampling mode to use for aggregating ADC samples.
-  void set_sampling_mode(SamplingMode sampling_mode);
+  void set_sampling_mode(SamplingMode sampling_mode) { this->sampling_mode_ = sampling_mode; }
 
   /// Perform a single ADC sampling operation and return the measured value.
   /// This function handles raw readings, calibration, and averaging as needed.

esphome/components/adc/adc_sensor_common.cpp

@@ -76,6 +76,4 @@ void ADCSensor::set_sample_count(uint8_t sample_count) {
   }
 }
 
-void ADCSensor::set_sampling_mode(SamplingMode sampling_mode) { this->sampling_mode_ = sampling_mode; }
-
 }  // namespace esphome::adc

esphome/components/alarm_control_panel/alarm_control_panel.h

@@ -138,11 +138,11 @@ class AlarmControlPanel : public EntityBase {
   // in order to store last panel state in flash
   ESPPreferenceObject pref_;
   // current state
-  AlarmControlPanelState current_state_;
+  AlarmControlPanelState current_state_{ACP_STATE_DISARMED};
   // the desired (or previous) state
-  AlarmControlPanelState desired_state_;
+  AlarmControlPanelState desired_state_{ACP_STATE_DISARMED};
   // last time the state was updated
-  uint32_t last_update_;
+  uint32_t last_update_{0};
   // the call control function
   virtual void control(const AlarmControlPanelCall &call) = 0;
   // state callback - passes the new state to listeners

esphome/components/api/__init__.py

@@ -136,6 +136,12 @@ CONF_LISTEN_BACKLOG = "listen_backlog"
 CONF_MAX_SEND_QUEUE = "max_send_queue"
 CONF_STATE_SUBSCRIPTION_ONLY = "state_subscription_only"
 
+# Schema defaults that also match the C++ initializers in api_server.h; codegen
+# skips the setter when the config equals them.
+DEFAULT_PORT = 6053
+DEFAULT_REBOOT_TIMEOUT = "15min"
+DEFAULT_BATCH_DELAY = "100ms"
+
 
 def _register_provisioning_source(config: ConfigType) -> ConfigType:
     """Register the API as a provisioning source when encryption is enabled.
@@ -292,7 +298,7 @@ CONFIG_SCHEMA = cv.All(
     cv.Schema(
         {
             cv.GenerateID(): cv.declare_id(APIServer),
-            cv.Optional(CONF_PORT, default=6053): cv.port,
+            cv.Optional(CONF_PORT, default=DEFAULT_PORT): cv.port,
             # Removed in 2026.1.0 - kept to provide helpful error message
             cv.Optional(CONF_PASSWORD): cv.invalid(
                 "The 'password' option has been removed in ESPHome 2026.1.0.\n"
@@ -305,14 +311,14 @@ CONFIG_SCHEMA = cv.All(
                 "Or visit https://esphome.io/components/api/#configuration-variables"
             ),
             cv.Optional(
-                CONF_REBOOT_TIMEOUT, default="15min"
+                CONF_REBOOT_TIMEOUT, default=DEFAULT_REBOOT_TIMEOUT
             ): cv.positive_time_period_milliseconds,
             cv.Exclusive(
                 CONF_SERVICES, group_of_exclusion=CONF_ACTIONS
             ): ACTIONS_SCHEMA,
             cv.Exclusive(CONF_ACTIONS, group_of_exclusion=CONF_ACTIONS): ACTIONS_SCHEMA,
             cv.Optional(CONF_ENCRYPTION): encryption_schema,
-            cv.Optional(CONF_BATCH_DELAY, default="100ms"): cv.All(
+            cv.Optional(CONF_BATCH_DELAY, default=DEFAULT_BATCH_DELAY): cv.All(
                 cv.positive_time_period_milliseconds,
                 cv.Range(max=cv.TimePeriod(milliseconds=65535)),
             ),
@@ -350,10 +356,9 @@ CONFIG_SCHEMA = cv.All(
                 ln882x=5,  # Moderate RAM
                 nrf52=4,  # ~256KB RAM, BSD sockets, Thread (single HA controller)
             ): cv.int_range(min=1, max=20),
-            # Maximum queued send buffers per connection before dropping connection
-            # Each buffer uses ~8-12 bytes overhead plus actual message size
+            # Max queued messages per connection, and 2 KB of backlog per slot up
+            # to 64 KB (a lone message is exempt), before the connection is dropped
             # Platform defaults based on available RAM and typical message rates:
-            # CONF_MAX_SEND_QUEUE defaults are power of 2 for efficient modulo
             cv.SplitDefault(
                 CONF_MAX_SEND_QUEUE,
                 esp8266=4,  # Limited RAM, need to fail fast
@@ -463,9 +468,15 @@ async def to_code(config: ConfigType) -> None:
     # Request a log listener slot for API log streaming
     request_log_listener()
 
-    cg.add(var.set_port(config[CONF_PORT]))
-    cg.add(var.set_reboot_timeout(config[CONF_REBOOT_TIMEOUT]))
-    cg.add(var.set_batch_delay(config[CONF_BATCH_DELAY]))
+    # Skip the setters when the config matches the C++ initializers (DEFAULT_*).
+    if (port := config[CONF_PORT]) != DEFAULT_PORT:
+        cg.add(var.set_port(port))
+    if (reboot_timeout := config[CONF_REBOOT_TIMEOUT]) != cv.time_period(
+        DEFAULT_REBOOT_TIMEOUT
+    ):
+        cg.add(var.set_reboot_timeout(reboot_timeout))
+    if (batch_delay := config[CONF_BATCH_DELAY]) != cv.time_period(DEFAULT_BATCH_DELAY):
+        cg.add(var.set_batch_delay(batch_delay))
     if CONF_LISTEN_BACKLOG in config:
         cg.add(var.set_listen_backlog(config[CONF_LISTEN_BACKLOG]))
     cg.add_define("MAX_API_CONNECTIONS", config[CONF_MAX_CONNECTIONS])

esphome/components/api/api_buffer.cpp

@@ -1,20 +1,37 @@
 #include "api_buffer.h"
-#include <new>
+#ifdef ESPHOME_DEBUG_API
+#include "esphome/core/log.h"
+#endif
 
 namespace esphome::api {
 
+#ifdef ESPHOME_DEBUG_API
+void APIBuffer::debug_check_drop_(size_t drop) const {
+  if (drop > this->size_) {
+    ESP_LOGE("api.buffer", "drop_front: drop=%zu size=%u", drop, this->size_);
+    abort();
+  }
+}
+#endif
+
 bool APIBuffer::grow_(size_t n) {
-  // nothrow (no zero-fill) so OOM is reportable; plain new aborts instead
-  // (NEW_OOM_ABORT on ESP8266 Arduino, exception stub on ESP-IDF).
-  // RAMAllocator is no fit here: unique_ptr needs delete[]-compatible memory.
-  std::unique_ptr<uint8_t[]> new_data(new (std::nothrow) uint8_t[n]);
-  if (new_data == nullptr)
+  if (n > MAX_SIZE)
     return false;
-  if (this->size_)
-    std::memcpy(new_data.get(), this->data_.get(), this->size_);
-  this->data_ = std::move(new_data);
+  // realloc extends in place when it can, avoiding the copy
+  uint8_t *grown = RAMAllocator<uint8_t>().reallocate(this->data_.get(), n);
+  if (grown == nullptr)
+    return false;
+  (void) this->data_.release();  // realloc already freed or reused the old block
+  this->data_.reset(grown);
   this->capacity_ = n;
   return true;
 }
 
+uint8_t *APIBuffer::append(size_t n) {
+  const size_t old_size = this->size_;
+  if (!this->resize(old_size + n))
+    return nullptr;
+  return this->data_.get() + old_size;
+}
+
 }  // namespace esphome::api

esphome/components/api/api_buffer.h

@@ -25,6 +25,7 @@ namespace esphome::api {
 /// writes in debug builds.
 class APIBuffer {
  public:
+  static constexpr size_t MAX_SIZE = UINT16_MAX;  // API frames carry 16 bit lengths
   void clear() { this->size_ = 0; }
   /// Returns false if allocation fails; the buffer is left unchanged.
   [[nodiscard]] inline bool reserve(size_t n) ESPHOME_ALWAYS_INLINE { return n <= this->capacity_ || this->grow_(n); }
@@ -36,9 +37,19 @@ class APIBuffer {
   [[nodiscard]] inline bool reserve_and_resize(size_t reserve_size, size_t new_size) ESPHOME_ALWAYS_INLINE {
     if (!this->reserve(std::max(reserve_size, new_size)))
       return false;
-    this->size_ = new_size;
+    this->size_ = static_cast<uint16_t>(new_size);
     return true;
   }
+  /// Grow by n bytes; returns the new bytes, or nullptr on allocation failure.
+  [[nodiscard]] uint8_t *append(size_t n);
+  /// Drop the first `drop` bytes, sliding the rest down. Precondition: drop <= size().
+  void drop_front(size_t drop) {
+#ifdef ESPHOME_DEBUG_API
+    this->debug_check_drop_(drop);
+#endif
+    this->size_ -= drop;
+    std::memmove(this->data_.get(), this->data_.get() + drop, this->size_);
+  }
   uint8_t *data() { return this->data_.get(); }
   const uint8_t *data() const { return this->data_.get(); }
   size_t size() const { return this->size_; }
@@ -55,9 +66,14 @@ class APIBuffer {
 
  protected:
   bool grow_(size_t n);
-  std::unique_ptr<uint8_t[]> data_;
-  size_t size_{0};
-  size_t capacity_{0};
+#ifdef ESPHOME_DEBUG_API
+  void debug_check_drop_(size_t drop) const;
+#endif
+  // RAMAllocator: PSRAM when available, and it reports failure where
+  // new (std::nothrow) still aborts on ESP-IDF without exceptions
+  RAMUniquePtr<uint8_t[]> data_;
+  uint16_t size_{0};
+  uint16_t capacity_{0};
 };
 
 }  // namespace esphome::api

esphome/components/api/api_connection.cpp

@@ -364,7 +364,10 @@ void APIConnection::check_keepalive_(uint32_t now) {
     ESP_LOGVV(TAG, "Sending keepalive PING");
     PingRequest req;
     this->flags_.sent_ping = this->send_message(req);
-    if (!this->flags_.sent_ping) {
+    if (this->flags_.sent_ping) {
+      // Quiet for a keepalive period and the ping is on its way: a one-off stall's storage can go
+      this->helper_->release_overflow_buffer();
+    } else {
       // If we can't send the ping request directly (tx_buffer full),
       // schedule it at the front of the batch so it will be sent with priority
       ESP_LOGW(TAG, "Buffer full, ping queued");
@@ -717,12 +720,7 @@ uint16_t APIConnection::try_send_switch_info(EntityBase *entity, APIConnection *
 }
 void APIConnection::on_switch_command_request(const SwitchCommandRequest &msg) {
   ENTITY_COMMAND_GET(switch_::Switch, a_switch, switch)
-
-  if (msg.state) {
-    a_switch->turn_on();
-  } else {
-    a_switch->turn_off();
-  }
+  a_switch->control(msg.state);
 }
 #endif
 

esphome/components/api/api_frame_helper.cpp

@@ -171,7 +171,7 @@ APIError APIFrameHelper::write_raw_iov_(const struct iovec *iov, int iovcnt, uin
     return APIError::OK;
 
   // Queue unsent data into overflow buffer
-  if (!this->overflow_buf_.enqueue_iov(iov, iovcnt, total_write_len, static_cast<uint16_t>(sent))) {
+  if (!this->overflow_buf_.enqueue_iov(iov, iovcnt, total_write_len, sent)) {
     HELPER_LOG("Overflow buffer full or out of memory, dropping connection");
     this->state_ = State::FAILED;
     return APIError::SOCKET_WRITE_FAILED;

esphome/components/api/api_frame_helper.h

@@ -219,7 +219,10 @@ class APIFrameHelper {
     if (this->rx_buf_len_ == 0) {
       this->rx_buf_.release();
     }
+    this->release_overflow_buffer();
   }
+  // Free the send backlog storage once it has drained
+  void release_overflow_buffer() { this->overflow_buf_.release(); }
 
  protected:
   // Drain backlogged overflow data to the socket and handle errors.

esphome/components/api/api_frame_helper_noise.cpp

@@ -67,15 +67,15 @@ APIError APINoiseFrameHelper::init() {
   }
 
   // init prologue
-  size_t old_size = prologue_.size();
-  if (!prologue_.resize(old_size + PROLOGUE_INIT_LEN)) [[unlikely]] {
+  uint8_t *dst = prologue_.append(PROLOGUE_INIT_LEN);
+  if (dst == nullptr) [[unlikely]] {
     state_ = State::FAILED;
     return APIError::OUT_OF_MEMORY;
   }
 #ifdef USE_ESP8266
-  memcpy_P(prologue_.data() + old_size, PROLOGUE_INIT, PROLOGUE_INIT_LEN);
+  memcpy_P(dst, PROLOGUE_INIT, PROLOGUE_INIT_LEN);
 #else
-  std::memcpy(prologue_.data() + old_size, PROLOGUE_INIT, PROLOGUE_INIT_LEN);
+  std::memcpy(dst, PROLOGUE_INIT, PROLOGUE_INIT_LEN);
 #endif
 
   state_ = State::CLIENT_HELLO;
@@ -272,17 +272,17 @@ APIError APINoiseFrameHelper::state_action_client_hello_() {
     return handle_handshake_frame_error_(aerr);
   }
   // ignore contents, may be used in future for flags
-  // Resize for: existing prologue + 2 size bytes + frame data
-  size_t old_size = this->prologue_.size();
+  // Append 2 size bytes + frame data to the prologue
   size_t rx_size = this->rx_buf_.size();
-  if (!this->prologue_.resize(old_size + 2 + rx_size)) [[unlikely]] {
+  uint8_t *dst = this->prologue_.append(2 + rx_size);
+  if (dst == nullptr) [[unlikely]] {
     state_ = State::FAILED;
     return APIError::OUT_OF_MEMORY;
   }
-  this->prologue_[old_size] = (uint8_t) (rx_size >> 8);
-  this->prologue_[old_size + 1] = (uint8_t) rx_size;
+  dst[0] = (uint8_t) (rx_size >> 8);
+  dst[1] = (uint8_t) rx_size;
   if (rx_size > 0) {
-    std::memcpy(this->prologue_.data() + old_size + 2, this->rx_buf_.data(), rx_size);
+    std::memcpy(dst + 2, this->rx_buf_.data(), rx_size);
   }
 
   state_ = State::SERVER_HELLO;

esphome/components/api/api_overflow_buffer.cpp

@@ -1,98 +1,91 @@
 #include "api_overflow_buffer.h"
 #ifdef USE_API
 #include <cstring>
-#include <new>
 
 namespace esphome::api {
 
-APIOverflowBuffer::~APIOverflowBuffer() {
-  for (auto *entry : this->queue_) {
-    if (entry != nullptr)
-      Entry::destroy(entry);
-  }
-}
-
 ssize_t APIOverflowBuffer::try_drain(socket::Socket *socket) {
-  // socket->write() can re-enter this function: a log message emitted from an
-  // lwip callback during the write goes out over the API and lands back in the
-  // frame helper's write/drain path. If a nested drain ran here it would send
-  // and free the entry the outer drain is still holding, causing a double free.
-  // Report "no progress" instead; the outer drain keeps draining, and the
-  // nested send is enqueued behind the existing backlog.
+  // Nested call from inside socket->write(); see draining_
   if (this->draining_)
     return 0;
 
-  // RAII so the flag is cleared on every return path
   struct DrainGuard {
-    explicit DrainGuard(bool &flag) : flag_(flag) { flag_ = true; }
-    ~DrainGuard() { this->flag_ = false; }
-    bool &flag_;
-  } guard(this->draining_);
+    APIOverflowBuffer &owner;
+    ~DrainGuard() { this->owner.draining_ = false; }
+  } guard{*this};
+  this->draining_ = true;
 
   while (this->count_ > 0) {
-    Entry *front = this->queue_[this->head_];
+    uint8_t *msg = this->buf_.data() + this->head_;
+    size_t len = msg[0] | (msg[1] << 8);
 
-    ssize_t sent = socket->write(front->current_data(), front->remaining());
-
-    if (sent <= 0) {
-      // -1 = error (caller checks errno for EWOULDBLOCK vs hard error)
-      // 0 = nothing sent (treat as no progress)
+    ssize_t sent = socket->write(msg + LEN_PREFIX, len);
+    if (sent <= 0)
+      return sent;
+    if (static_cast<size_t>(sent) < len) {
+      // Step past the sent bytes and rewrite the prefix there; it lands on bytes already sent
+      this->head_ += sent;
+      len -= sent;
+      msg += sent;
+      msg[0] = len;
+      msg[1] = len >> 8;
       return sent;
     }
-
-    if (static_cast<uint16_t>(sent) < front->remaining()) {
-      // Partially sent, update offset and stop
-      front->offset += static_cast<uint16_t>(sent);
-      return sent;
-    }
-
-    // Entry fully sent — unlink it before freeing so a freed pointer is never
-    // reachable from the queue
-    this->queue_[this->head_] = nullptr;
-    this->head_ = (this->head_ + 1) % API_MAX_SEND_QUEUE;
+    this->head_ += LEN_PREFIX + len;
     this->count_--;
-    Entry::destroy(front);
   }
 
-  return 0;  // All drained
+  this->head_ = 0;
+  if (this->release_when_drained_) {
+    this->release_when_drained_ = false;
+    this->buf_.release();
+  } else {
+    this->buf_.clear();
+  }
+  return 0;
 }
 
-bool APIOverflowBuffer::enqueue_iov(const struct iovec *iov, int iovcnt, uint16_t total_len, uint16_t skip) {
+bool APIOverflowBuffer::enqueue_iov(const struct iovec *iov, int iovcnt, size_t total_len, size_t skip) {
   if (this->count_ >= API_MAX_SEND_QUEUE)
     return false;
 
-  uint16_t buffer_size = total_len - skip;
-  // nothrow: a failed allocation returns nullptr so the connection is dropped
-  // cleanly instead of plain new's crash or abort on OOM
-  // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
-  auto *data = new (std::nothrow) uint8_t[buffer_size];
-  if (data == nullptr)
-    return false;
-  // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
-  auto *entry = new (std::nothrow) Entry{data, buffer_size, 0};
-  if (entry == nullptr) {
-    delete[] data;
+  const size_t new_len = total_len - skip;
+  const size_t new_bytes = LEN_PREFIX + new_len;
+  const size_t live = this->buf_.size() - this->head_;
+  // A lone message is only bound by the buffer; refusing it would just drop the connection
+  if (live + new_bytes > (this->count_ > 0 ? MAX_BYTES : MAX_LONE_BYTES))
     return false;
+
+  if (this->buf_.size() + new_bytes > this->buf_.capacity()) {
+    // Storage would move under an outer drain's write()
+    if (this->draining_)
+      return false;
+    if (this->head_ > 0) {
+      // Reclaim the sent prefix before growing
+      this->buf_.drop_front(this->head_);
+      this->head_ = 0;
+    }
+    if (!this->buf_.reserve(reserve_for(live + new_bytes)))
+      return false;
   }
 
-  uint16_t to_skip = skip;
-  uint16_t write_pos = 0;
-
-  for (int i = 0; i < iovcnt; i++) {
-    if (to_skip >= iov[i].iov_len) {
-      to_skip -= static_cast<uint16_t>(iov[i].iov_len);
+  uint8_t *dst = this->buf_.append(new_bytes);
+  if (dst == nullptr)
+    return false;
+  dst[0] = new_len;
+  dst[1] = new_len >> 8;
+  dst += LEN_PREFIX;
+  for (const struct iovec *end = iov + iovcnt; iov != end; iov++) {
+    if (skip >= iov->iov_len) {
+      skip -= iov->iov_len;
     } else {
-      const uint8_t *src = reinterpret_cast<uint8_t *>(iov[i].iov_base) + to_skip;
-      uint16_t len = static_cast<uint16_t>(iov[i].iov_len) - to_skip;
-      std::memcpy(entry->data + write_pos, src, len);
-      write_pos += len;
-      to_skip = 0;
+      const size_t len = iov->iov_len - skip;
+      std::memcpy(dst, static_cast<const uint8_t *>(iov->iov_base) + skip, len);
+      dst += len;
+      skip = 0;
     }
   }
 
-  // Publish only after the copy completes so a half-built entry is never reachable
-  this->queue_[this->tail_] = entry;
-  this->tail_ = (this->tail_ + 1) % API_MAX_SEND_QUEUE;
   this->count_++;
   return true;
 }

esphome/components/api/api_overflow_buffer.h

@@ -1,5 +1,6 @@
 #pragma once
-#include <array>
+#include <algorithm>
+#include <cstddef>
 #include <cstdint>
 #include <sys/types.h>
 
@@ -8,71 +9,57 @@
 
 #include "esphome/components/socket/headers.h"
 #include "esphome/components/socket/socket.h"
-#include "esphome/core/helpers.h"
+#include "api_buffer.h"
 
 namespace esphome::api {
 
-/// Circular queue of heap-allocated byte buffers used as a TCP send backlog.
-///
-/// Under normal operation this buffer is **never used** — data goes straight
-/// from the frame helper to the socket.  It only fills when the LWIP TCP
-/// send buffer is full (slow client, congested network, heavy logging).
-/// The queue drains automatically on subsequent write/loop calls once the
-/// socket becomes writable again.
-///
-/// Capacity is compile-time-fixed via API_MAX_SEND_QUEUE (set from Python
-/// config).  If the queue fills completely the connection is marked failed.
+/// TCP send backlog, only used when the socket send buffer is full.
+/// One contiguous buffer per connection, allocated on the first stall and
+/// kept at its high-water mark so a lossy link does not churn the heap.
+/// Messages are stored as a 2 byte length prefix plus payload.
+/// API_MAX_SEND_QUEUE bounds queued messages and, at 2 KB per slot, queued
+/// bytes; exceeding either fails the connection.
 class APIOverflowBuffer {
  public:
-  /// A single heap-allocated send-backlog entry.
-  /// Lifetime is manually managed — see destroy().
-  struct Entry {
-    uint8_t *data;
-    uint16_t size;    // Total size of the buffer
-    uint16_t offset;  // Current send offset within the buffer
-
-    uint16_t remaining() const { return this->size - this->offset; }
-    const uint8_t *current_data() const { return this->data + this->offset; }
-
-    /// Free this entry and its data buffer.
-    static ESPHOME_ALWAYS_INLINE void destroy(Entry *entry) {
-      delete[] entry->data;
-      delete entry;  // NOLINT(cppcoreguidelines-owning-memory)
-    }
-  };
-
-  ~APIOverflowBuffer();
-
   /// True when no backlogged data is waiting.
   bool empty() const { return this->count_ == 0; }
 
-  /// True when the queue has no room for another entry.
-  bool full() const { return this->count_ >= API_MAX_SEND_QUEUE; }
-
-  /// Number of entries currently queued.
-  uint8_t count() const { return this->count_; }
-
-  /// Try to drain queued data to the socket.
-  /// Returns bytes-written > 0 on success/partial, 0 if all drained or no progress,
-  /// -1 on error (caller must check errno to distinguish EWOULDBLOCK from hard errors).
-  /// Callers only need to act on -1; 0 and positive values both mean "no error".
-  /// Frees entries as they are fully sent.
+  /// Drain queued messages to the socket.
+  /// Returns bytes written, 0 for a re-entrant call, -1 on error (check errno
+  /// for EWOULDBLOCK); callers only need to act on -1.
   ssize_t try_drain(socket::Socket *socket);
 
-  /// Enqueue unsent IOV data into the backlog.
-  /// Copies iov data starting at byte offset `skip` into a new entry.
-  /// Returns false if the queue is full or allocation fails (caller should fail the connection).
-  bool enqueue_iov(const struct iovec *iov, int iovcnt, uint16_t total_len, uint16_t skip);
+  /// Queue iov data from byte offset `skip` as one message.
+  /// Returns false when a limit is hit, allocation fails, or storage would move
+  /// during a drain; the caller should fail the connection.
+  bool enqueue_iov(const struct iovec *iov, int iovcnt, size_t total_len, size_t skip);
+
+  /// Free the retained storage, now if empty, otherwise once it has drained.
+  void release() {
+    if (this->count_ == 0) {
+      this->buf_.release();
+    } else {
+      this->release_when_drained_ = true;
+    }
+  }
 
  protected:
-  std::array<Entry *, API_MAX_SEND_QUEUE> queue_{};
-  uint8_t head_{0};
-  uint8_t tail_{0};
+  static constexpr size_t LEN_PREFIX = 2;
+  static constexpr size_t BYTES_PER_SLOT = 2048;
+  // Reserve in 256 byte steps so a creeping high-water mark settles quickly
+  static constexpr size_t GROW_QUANTUM = 256;
+  // Lone message ceiling, rounded down so reserve_for() never exceeds the buffer limit
+  static constexpr size_t MAX_LONE_BYTES = APIBuffer::MAX_SIZE & ~(GROW_QUANTUM - 1);
+  static constexpr size_t MAX_BYTES = std::min(API_MAX_SEND_QUEUE * BYTES_PER_SLOT, MAX_LONE_BYTES);
+  static constexpr size_t reserve_for(size_t want) { return (want + GROW_QUANTUM - 1) & ~(GROW_QUANTUM - 1); }
+
+  APIBuffer buf_;
+  uint16_t head_{0};  // offset of the front message's length prefix; bytes before it are sent
   uint8_t count_{0};
-  // Guards against re-entrant drains: socket->write() can re-enter the API
-  // send path (e.g. a log message emitted from an lwip callback), and a nested
-  // drain would free the entry the outer drain is still holding.
-  bool draining_{false};
+  // socket->write() can re-enter the send path (log from an lwip callback):
+  // a nested drain makes no progress and a nested enqueue never moves storage
+  bool draining_ : 1 {false};
+  bool release_when_drained_ : 1 {false};
 };
 
 }  // namespace esphome::api

esphome/components/api/api_server.cpp

@@ -29,6 +29,29 @@ static const char *const TAG = "api";
 // APIServer
 APIServer *global_api_server = nullptr;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
 
+#ifdef USE_API_NOISE
+static constexpr uint32_t NOISE_PSK_PREF_HASH = 88491486UL;
+#endif
+
+#if defined(USE_API_NOISE) && defined(USE_OTA_ENCRYPTION_PROVISIONED)
+bool load_saved_noise_psk(noise::psk_t &out) {
+  SavedNoisePsk saved;
+#ifdef USE_PREFERENCE_KEY_LOOKUP
+  const bool loaded =
+      global_preferences->load_from_key(NOISE_PSK_PREF_HASH, reinterpret_cast<uint8_t *>(&saved), sizeof(saved));
+#else
+  // Slot backends need the reservation walk; it only lands on the record when the reservations before
+  // it match a normal boot, otherwise the type checked checksum fails the load
+  const bool loaded = global_preferences->make_preference<SavedNoisePsk>(NOISE_PSK_PREF_HASH, true).load(&saved);
+#endif
+  // The all-zeros record means no key
+  if (!loaded || noise::NoiseContext::is_all_zeros(saved.psk))
+    return false;
+  out = saved.psk;
+  return true;
+}
+#endif
+
 APIServer::APIServer() { global_api_server = this; }
 
 void APIServer::socket_failed_(const LogString *msg) {
@@ -43,8 +66,7 @@ void APIServer::setup() {
 #ifdef USE_API_NOISE
   // Always reserve the slot: flash preferences are positional on esp8266, so
   // a yaml key build must keep the layout of a runtime key build
-  uint32_t hash = 88491486UL;
-  this->noise_pref_ = global_preferences->make_preference<SavedNoisePsk>(hash, true);
+  this->noise_pref_ = global_preferences->make_preference<SavedNoisePsk>(NOISE_PSK_PREF_HASH, true);
 #ifndef USE_API_NOISE_PSK_FROM_YAML
   // A cleared record loads fine but holds no key
   if (this->load_and_apply_noise_psk_() && this->noise_ctx_.has_psk()) {

esphome/components/api/api_server.h

@@ -43,6 +43,11 @@ struct SavedNoisePsk {
   noise::psk_t psk;
 } PACKED;  // NOLINT
 #endif
+#if defined(USE_API_NOISE) && defined(USE_OTA_ENCRYPTION_PROVISIONED)
+/// One-shot read of the provisioned key for a boot without an api server (safe mode); false when
+/// there is no key
+bool load_saved_noise_psk(noise::psk_t &out);
+#endif
 
 class APIServer final : public Component,
                         public Controller
@@ -314,7 +319,7 @@ class APIServer final : public Component,
 #endif
 
   // 4-byte aligned types
-  uint32_t reboot_timeout_{300000};
+  uint32_t reboot_timeout_{900000};  // Keep in sync with DEFAULT_REBOOT_TIMEOUT in __init__.py
   uint32_t last_connected_{0};
 
   // Slots [0, api_connection_count_) are populated; trailing slots are always nullptr.
@@ -351,8 +356,8 @@ class APIServer final : public Component,
 #endif
 
   // Group smaller types together
-  uint16_t port_{6053};
-  uint16_t batch_delay_{100};
+  uint16_t port_{6053};        // Keep in sync with DEFAULT_PORT in __init__.py
+  uint16_t batch_delay_{100};  // Keep in sync with DEFAULT_BATCH_DELAY in __init__.py
   // Connection limits - these defaults will be overridden by config values
   // from cv.SplitDefault in __init__.py which sets platform-specific defaults.
   uint8_t listen_backlog_{4};

esphome/components/at581x/__init__.py

@@ -181,11 +181,11 @@ async def at581x_settings_to_code(
     await cg.register_parented(var, config[CONF_ID])
 
     # Radar configuration
-    if frontend_reset := config.get(CONF_HW_FRONTEND_RESET):
+    if (frontend_reset := config.get(CONF_HW_FRONTEND_RESET)) is not None:
         template_ = await cg.templatable(frontend_reset, args, cg.int8)
         cg.add(var.set_hw_frontend_reset(template_))
 
-    if freq := config.get(CONF_FREQUENCY):
+    if (freq := config.get(CONF_FREQUENCY)) is not None:
         if not cg.is_template(freq):
             freq = int(freq / 1000000)
         template_ = await cg.templatable(freq, args, cg.int_)
@@ -195,19 +195,19 @@ async def at581x_settings_to_code(
         template_ = await cg.templatable(sens_dist, args, cg.int_)
         cg.add(var.set_sensing_distance(template_))
 
-    if selfcheck := config.get(CONF_POWERON_SELFCHECK_TIME):
+    if (selfcheck := config.get(CONF_POWERON_SELFCHECK_TIME)) is not None:
         template_ = await cg.templatable(selfcheck, args, cg.int_)
         cg.add(var.set_poweron_selfcheck_time(template_))
 
-    if protect := config.get(CONF_PROTECT_TIME):
+    if (protect := config.get(CONF_PROTECT_TIME)) is not None:
         template_ = await cg.templatable(protect, args, cg.int_)
         cg.add(var.set_protect_time(template_))
 
-    if trig_base := config.get(CONF_TRIGGER_BASE):
+    if (trig_base := config.get(CONF_TRIGGER_BASE)) is not None:
         template_ = await cg.templatable(trig_base, args, cg.int_)
         cg.add(var.set_trigger_base(template_))
 
-    if trig_keep := config.get(CONF_TRIGGER_KEEP):
+    if (trig_keep := config.get(CONF_TRIGGER_KEEP)) is not None:
         template_ = await cg.templatable(trig_keep, args, cg.int_)
         cg.add(var.set_trigger_keep(template_))
 
@@ -215,7 +215,7 @@ async def at581x_settings_to_code(
         template_ = await cg.templatable(stage_gain, args, cg.int_)
         cg.add(var.set_stage_gain(template_))
 
-    if power := config.get(CONF_POWER_CONSUMPTION):
+    if (power := config.get(CONF_POWER_CONSUMPTION)) is not None:
         if not cg.is_template(power):
             power = int(power * 1000000)
         template_ = await cg.templatable(power, args, cg.int_)

esphome/components/audio/__init__.py

@@ -339,10 +339,7 @@ async def to_code(config: ConfigType) -> None:
     # HTTPS streams verify the server against the root certificate bundle
     require_certificate_bundle()
 
-    add_idf_component(
-        name="esphome/esp-audio-libs",
-        ref="3.2.1",
-    )
+    add_idf_component(name="esphome/esp-audio-libs", ref="4.0.1")
 
     data = _get_data()
 

esphome/components/bang_bang/bang_bang_climate.cpp

@@ -203,16 +203,10 @@ void BangBangClimate::set_away_config(const BangBangClimateTargetTempConfig &awa
   this->away_config_ = away_config;
 }
 
-void BangBangClimate::set_sensor(sensor::Sensor *sensor) { this->sensor_ = sensor; }
-void BangBangClimate::set_humidity_sensor(sensor::Sensor *humidity_sensor) { this->humidity_sensor_ = humidity_sensor; }
-
 Trigger<> *BangBangClimate::get_idle_trigger() { return &this->idle_trigger_; }
 Trigger<> *BangBangClimate::get_cool_trigger() { return &this->cool_trigger_; }
 Trigger<> *BangBangClimate::get_heat_trigger() { return &this->heat_trigger_; }
 
-void BangBangClimate::set_supports_cool(bool supports_cool) { this->supports_cool_ = supports_cool; }
-void BangBangClimate::set_supports_heat(bool supports_heat) { this->supports_heat_ = supports_heat; }
-
 void BangBangClimate::dump_config() {
   LOG_CLIMATE("", "Bang Bang Climate", this);
   ESP_LOGCONFIG(TAG,

esphome/components/bang_bang/bang_bang_climate.h

@@ -22,10 +22,10 @@ class BangBangClimate final : public climate::Climate, public Component {
   void setup() override;
   void dump_config() override;
 
-  void set_sensor(sensor::Sensor *sensor);
-  void set_humidity_sensor(sensor::Sensor *humidity_sensor);
-  void set_supports_cool(bool supports_cool);
-  void set_supports_heat(bool supports_heat);
+  void set_sensor(sensor::Sensor *sensor) { this->sensor_ = sensor; }
+  void set_humidity_sensor(sensor::Sensor *humidity_sensor) { this->humidity_sensor_ = humidity_sensor; }
+  void set_supports_cool(bool supports_cool) { this->supports_cool_ = supports_cool; }
+  void set_supports_heat(bool supports_heat) { this->supports_heat_ = supports_heat; }
   void set_normal_config(const BangBangClimateTargetTempConfig &normal_config);
   void set_away_config(const BangBangClimateTargetTempConfig &away_config);
 

esphome/components/binary/light/binary_light_output.h

@@ -17,11 +17,7 @@ class BinaryLightOutput final : public light::LightOutput {
   void write_state(light::LightState *state) override {
     bool binary;
     state->current_values_as_binary(&binary);
-    if (binary) {
-      this->output_->turn_on();
-    } else {
-      this->output_->turn_off();
-    }
+    this->output_->set_state(binary);
   }
 
  protected:

esphome/components/binary_sensor/__init__.py

@@ -39,6 +39,7 @@ from esphome.const import (
     DEVICE_CLASS_EMPTY,
     DEVICE_CLASS_GARAGE_DOOR,
     DEVICE_CLASS_GAS,
+    DEVICE_CLASS_GLASS_BREAK,
     DEVICE_CLASS_HEAT,
     DEVICE_CLASS_LIGHT,
     DEVICE_CLASS_LOCK,
@@ -81,6 +82,7 @@ DEVICE_CLASSES = [
     DEVICE_CLASS_EMPTY,
     DEVICE_CLASS_GARAGE_DOOR,
     DEVICE_CLASS_GAS,
+    DEVICE_CLASS_GLASS_BREAK,
     DEVICE_CLASS_HEAT,
     DEVICE_CLASS_LIGHT,
     DEVICE_CLASS_LOCK,
@@ -452,7 +454,9 @@ _BINARY_SENSOR_SCHEMA = (
             cv.Optional(
                 CONF_DEVICE_CLASS, visibility=cv.Visibility.ADVANCED
             ): validate_device_class,
-            cv.Optional(CONF_FILTERS): validate_filters,
+            cv.Optional(
+                CONF_FILTERS, visibility=cv.Visibility.ADVANCED
+            ): validate_filters,
             cv.Optional(CONF_ON_PRESS): automation.validate_automation({}),
             cv.Optional(CONF_ON_RELEASE): automation.validate_automation({}),
             cv.Optional(CONF_ON_CLICK): cv.All(

esphome/components/binary_sensor/binary_sensor.h

@@ -32,7 +32,8 @@ void log_binary_sensor(const char *tag, const char *prefix, const char *type, Bi
  */
 class BinarySensor : public StatefulEntityBase<bool> {
  public:
-  explicit BinarySensor() = default;
+  // User provided, not "= default": `new(p) BinarySensor()` would zero-fill .bss that is already zero.
+  explicit BinarySensor() {}
 
   const bool &get_state() const override { return this->state; }
   void set_trigger_on_initial_state(bool value) { this->trigger_on_initial_state_ = value; }

esphome/components/binary_sensor/filter.h

@@ -53,6 +53,9 @@ class DelayedOnOffFilter final : public Filter {
 
 class DelayedOnFilter : public Filter {
  public:
+  // User provided, not "= default": `new(p) DelayedOnFilter()` would zero-fill .bss that is already zero.
+  DelayedOnFilter() {}
+
   optional<bool> new_value(bool value) override;
 
   template<typename T> void set_delay(T delay) { this->delay_ = delay; }
@@ -63,6 +66,9 @@ class DelayedOnFilter : public Filter {
 
 class DelayedOffFilter : public Filter {
  public:
+  // User provided, not "= default": `new(p) DelayedOffFilter()` would zero-fill .bss that is already zero.
+  DelayedOffFilter() {}
+
   optional<bool> new_value(bool value) override;
 
   template<typename T> void set_delay(T delay) { this->delay_ = delay; }
@@ -143,6 +149,8 @@ class StatelessLambdaFilter : public Filter {
 
 class SettleFilter : public Filter {
  public:
+  // User provided, not "= default": `new(p) SettleFilter()` would zero-fill .bss that is already zero.
+  SettleFilter() {}
   optional<bool> new_value(bool value) override;
 
   template<typename T> void set_delay(T delay) { this->delay_ = delay; }

esphome/components/bk72xx_ble/__init__.py

@@ -23,7 +23,7 @@ public ble_api.h.
 import logging
 
 import esphome.codegen as cg
-from esphome.components import libretiny
+from esphome.components import libretiny, wifi
 from esphome.components.libretiny.const import (
     FAMILY_BK7231N,
     FAMILY_BK7231Q,
@@ -84,6 +84,15 @@ def _final_validate(config: ConfigType) -> None:
     # which run on a BLE 4.2 board. The hard error is raised at codegen.
     if msg := _unsupported_family_message(libretiny.get_libretiny_family()):
         _LOGGER.warning("%s (this configuration cannot compile)", msg)
+    # Any wifi power_save_mode other than NONE also arms the Beken SDK's MCU
+    # sleep. With the BLE controller running, that sleep never wakes up once the
+    # station is stopped (adapter restart after failed roams, wifi.disable): the
+    # device is dead until a power cycle (esphome#18592). Keep power save off
+    # until LibreTiny ships the SDK-side fix (libretiny-eu/libretiny#414).
+    wifi.force_power_save_off(
+        "with BLE running, the Beken SDK's MCU sleep halts the device once the "
+        "station is stopped (https://github.com/esphome/esphome/issues/18592)"
+    )
 
 
 FINAL_VALIDATE_SCHEMA = _final_validate

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.cpp

@@ -45,15 +45,7 @@ void BluedroidGattClient::setup() {
 
 void BluedroidGattClient::loop() {
   if (!esp32_ble::global_ble->is_active()) {
-    // Stack down: no CLOSE_EVT will come. Settle a live link so the consumer
-    // frees its slot, then re-register the app on the next enable.
-    auto down_st = this->state();
-    if (down_st != ClientState::IDLE && down_st != ClientState::INIT) {
-      this->release_services();
-      this->set_idle_();
-      this->listener_->on_connection_state(false, 0, ble_device_base::GATT_ERR_NOT_CONNECTED);
-    }
-    this->set_state(ClientState::INIT);
+    // ble_before_disabled_event_handler() settles the slot.
     return;
   }
   auto st = this->state();
@@ -65,7 +57,7 @@ void BluedroidGattClient::loop() {
       ESP_LOGE(TAG, "gattc app register failed: app_id=%d code=%d", this->app_id, ret);
       this->mark_failed();
     }
-    // Do not wait for REG_EVT; a dropped event must not wedge the slot.
+    // Do not wait for REG_EVT; connect() rejects until it lands.
     this->set_idle_();
   } else if (st == ClientState::DISCONNECTING || this->disconnect_pending()) {
     // The one teardown safety net: a lost CLOSE_EVT, or a scheduled
@@ -78,8 +70,8 @@ void BluedroidGattClient::loop() {
       this->listener_->on_connection_state(false, 0, ESP_GATT_CONN_TIMEOUT);
     }
   } else {
-    // The loop stays on while a link exists (stack-down watch, pre-started
-    // search flush); it settles only back at IDLE.
+    // The loop stays on while a link exists (pre-started search flush); it
+    // settles only back at IDLE.
     this->deliver_pending_search_();
     if (this->state() == ClientState::IDLE) {
       this->disable_loop();
@@ -87,6 +79,22 @@ void BluedroidGattClient::loop() {
   }
 }
 
+// Stack down: no CLOSE_EVT will come. Settle a live link so the consumer
+// frees its slot, then register the app again on the next enable.
+void BluedroidGattClient::ble_before_disabled_event_handler() {
+  auto st = this->state();
+  if (st != ClientState::IDLE && st != ClientState::INIT) {
+    this->release_services();
+    this->set_idle_();
+    this->listener_->on_connection_state(false, 0, ble_device_base::GATT_ERR_NOT_CONNECTED);
+  }
+  // The interface belongs to the torn-down stack.
+  this->gattc_if_ = ESP_GATT_IF_NONE;
+  this->set_state(ClientState::INIT);
+  // An idle slot runs no loop; the INIT branch must run to register again.
+  this->enable_loop();
+}
+
 void BluedroidGattClient::dump_config() {
   ESP_LOGCONFIG(TAG, "Bluedroid GATT client %d", this->connection_index_);
   if (this->is_failed()) {
@@ -97,6 +105,11 @@ void BluedroidGattClient::dump_config() {
 // ---- contract ops ----
 
 int BluedroidGattClient::connect(uint64_t address, uint8_t addr_type) {
+  if (this->gattc_if_ == ESP_GATT_IF_NONE) {
+    // Bluedroid drops an open on an unknown interface without any event.
+    ESP_LOGW(TAG, "[%d] Connect rejected, GATT app not registered", this->connection_index_);
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  }
   // Only from idle: clobbering DISCONNECTING would open a new link the
   // stale CLOSE_EVT then tears down.
   if (this->state() != ClientState::IDLE) {

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.h

@@ -31,6 +31,9 @@ class BluetoothConnection;
 // void disconnect() cannot overload with an int-returning twin.
 class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public Component {
  public:
+  // User provided, not "= default": `new(p) BluedroidGattClient()` would zero-fill .bss that is already zero.
+  BluedroidGattClient() {}
+
   static constexpr uint16_t UNSET_CONN_ID = 0xFFFF;
 
   // Lifecycle of one connection attempt's service search.
@@ -56,6 +59,7 @@ class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public
   void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) override;
   void connect() override;
   void disconnect() override;
+  void ble_before_disabled_event_handler() override;
   bool wants_parsed_advertisements() override { return false; }
   void on_scan_end() override {}
   bool parse_device(const ble_device_base::ESPBTDevice &device) override { return false; }

esphome/components/bluetooth_connection/bluetooth_connection_hub.h

@@ -37,6 +37,9 @@ enum class PendingAck : uint8_t {
 
 class BluetoothConnection final : public ble_device_base::GattClientListener {
  public:
+  // User provided, not "= default": `new(p) BluetoothConnection()` would zero-fill .bss that is already zero.
+  BluetoothConnection() {}
+
   /// Wire the platform backend. Called from codegen before setup.
   void set_backend(ble_device_base::BLEGattConnection *backend) {
     this->backend_ = backend;

esphome/components/bluetooth_connection/bluetooth_connection_rp2.cpp

@@ -626,7 +626,7 @@ void RP2GattClient::handle_connected_(uint8_t status, uint16_t con_handle) {
   // explicit kick the MTU would only be exchanged on the first GATT query,
   // which never happens on a V3_WITH_CACHE connection.
   // Both registration calls above return void (BTstack 075a078, arduino-pico
-  // 6.0.0); failures surface as a missing GATT_EVENT_MTU and are reclaimed by
+  // 6.1.0); failures surface as a missing GATT_EVENT_MTU and are reclaimed by
   // the connect timeout in loop().
   gatt_client_send_mtu_negotiation(&RP2GattClient::gatt_packet_handler, this->con_handle_);
 }

esphome/components/bluetooth_proxy/__init__.py

@@ -395,6 +395,17 @@ async def _to_code_ble_hub(config: ConfigType) -> None:
     await _connections_to_code(var, config)
 
 
+def enable_advertisement_filter() -> None:
+    """Compile the advertisement filter hook into bluetooth_proxy.
+
+    Called by external filtering components from to_code(). The define behind
+    this is an implementation detail; do not emit it directly.
+
+    Public API for external components. Do not remove.
+    """
+    cg.add_define("USE_BLUETOOTH_PROXY_ADVERTISEMENT_FILTER")
+
+
 async def to_code(config: ConfigType) -> None:
     if CORE.is_esp32:
         await _to_code_esp32(config)

esphome/components/bluetooth_proxy/bluetooth_proxy.cpp

@@ -94,6 +94,15 @@ void BluetoothProxy::on_raw_advertisement_(const ble_device_base::RawAdvertiseme
   if (!api::global_api_server->is_connected() || this->api_connection_ == nullptr)
     return;
 
+#ifdef USE_BLUETOOTH_PROXY_ADVERTISEMENT_FILTER
+  // Ask the filter before the packet is queued, so a dropped advertisement never
+  // reaches the batch or the network.
+  if (this->advertisement_filter_.is_set() && !this->advertisement_filter_.should_forward(raw)) {
+    ESP_LOGVV(TAG, "Filtered packet from %012" PRIX64, raw.address);
+    return;
+  }
+#endif
+
   auto &adv = this->response_.advertisements[this->response_.advertisements_len];
   adv.address = raw.address;
   adv.rssi = raw.rssi;
@@ -184,6 +193,9 @@ void BluetoothProxy::dump_config() {
                 "  Adapter MAC: %s",
                 scan_mode, mac_out);
 #endif
+#ifdef USE_BLUETOOTH_PROXY_ADVERTISEMENT_FILTER
+  ESP_LOGCONFIG(TAG, "  Advertisement filter: %s", YESNO(this->advertisement_filter_.is_set()));
+#endif
 }
 
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS

esphome/components/bluetooth_proxy/bluetooth_proxy.h

@@ -97,6 +97,29 @@ static_assert(pending_reply_round_trips(0xABCD112233445566ULL, 0x000011223344556
 static_assert(PendingReply{}.empty());
 #endif
 
+#ifdef USE_BLUETOOTH_PROXY_ADVERTISEMENT_FILTER
+/// Predicate slot letting an external component drop advertisements before they
+/// are queued for the API. Same shape as
+/// ble_device_base::RawAdvertisementCallback. Runs on the advertisement hot
+/// path, so it must be cheap and must not block.
+///
+/// Usage:
+///   proxy->set_advertisement_filter({this, [](void *self, const ble_device_base::RawAdvertisement &adv) {
+///     return static_cast<MyFilter *>(self)->should_forward(adv);
+///   }});
+///
+/// Returning false drops the advertisement. Not called at all while the API is
+/// disconnected, which matters to a stateful filter. Compiled in only when an
+/// external component calls bluetooth_proxy.enable_advertisement_filter().
+struct AdvertisementFilter {
+  void *instance{nullptr};
+  bool (*fn)(void *instance, const ble_device_base::RawAdvertisement &adv){nullptr};
+  /// A default-constructed slot is "no filter"; the proxy guards on this.
+  bool is_set() const { return this->fn != nullptr; }
+  bool should_forward(const ble_device_base::RawAdvertisement &adv) const { return this->fn(this->instance, adv); }
+};
+#endif  // USE_BLUETOOTH_PROXY_ADVERTISEMENT_FILTER
+
 class BluetoothProxy final : public Component {
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
   // Allow the connection to update connections_free_response_
@@ -162,6 +185,11 @@ class BluetoothProxy final : public Component {
   void set_active(bool active) { this->active_ = active; }
   bool has_active() { return this->active_; }
 
+#ifdef USE_BLUETOOTH_PROXY_ADVERTISEMENT_FILTER
+  /// One subscriber; a later call replaces an earlier one.
+  void set_advertisement_filter(AdvertisementFilter filter) { this->advertisement_filter_ = filter; }
+#endif
+
   uint32_t get_legacy_version() const {
     if (!this->active_) {
       return LEGACY_PASSIVE_ONLY_VERSION;
@@ -330,6 +358,10 @@ class BluetoothProxy final : public Component {
   // start on an even word, closing two alignment holes.
   uint32_t last_advertisement_flush_time_{0};
 
+#ifdef USE_BLUETOOTH_PROXY_ADVERTISEMENT_FILTER
+  AdvertisementFilter advertisement_filter_{};
+#endif
+
   // BLE advertisement batching
   api::BluetoothLERawAdvertisementsResponse response_;
 

esphome/components/bme280_base/bme280_base.cpp

@@ -341,7 +341,6 @@ void BME280Component::set_pressure_oversampling(BME280Oversampling pressure_over
 void BME280Component::set_humidity_oversampling(BME280Oversampling humidity_over_sampling) {
   this->humidity_oversampling_ = humidity_over_sampling;
 }
-void BME280Component::set_iir_filter(BME280IIRFilter iir_filter) { this->iir_filter_ = iir_filter; }
 uint8_t BME280Component::read_u8_(uint8_t a_register) {
   uint8_t data = 0;
   this->read_byte(a_register, &data);

esphome/components/bme280_base/bme280_base.h

@@ -69,7 +69,7 @@ class BME280Component : public PollingComponent {
   /// Set the oversampling value for the humidity sensor. Default is 16x.
   void set_humidity_oversampling(BME280Oversampling humidity_over_sampling);
   /// Set the IIR Filter used to increase accuracy, defaults to no IIR Filter.
-  void set_iir_filter(BME280IIRFilter iir_filter);
+  void set_iir_filter(BME280IIRFilter iir_filter) { this->iir_filter_ = iir_filter; }
 
   // ========== INTERNAL METHODS ==========
   // (In most use cases you won't need these)

esphome/components/bme680/bme680.cpp

@@ -503,7 +503,6 @@ void BME680Component::set_pressure_oversampling(BME680Oversampling pressure_over
 void BME680Component::set_humidity_oversampling(BME680Oversampling humidity_oversampling) {
   this->humidity_oversampling_ = humidity_oversampling;
 }
-void BME680Component::set_iir_filter(BME680IIRFilter iir_filter) { this->iir_filter_ = iir_filter; }
 void BME680Component::set_heater(uint16_t heater_temperature, uint16_t heater_duration) {
   this->heater_temperature_ = heater_temperature;
   this->heater_duration_ = heater_duration;

esphome/components/bme680/bme680.h

@@ -74,7 +74,7 @@ class BME680Component final : public PollingComponent, public i2c::I2CDevice {
   /// Set the humidity oversampling value. Defaults to 16X.
   void set_humidity_oversampling(BME680Oversampling humidity_oversampling);
   /// Set the IIR Filter value. Defaults to no IIR Filter.
-  void set_iir_filter(BME680IIRFilter iir_filter);
+  void set_iir_filter(BME680IIRFilter iir_filter) { this->iir_filter_ = iir_filter; }
 
   void set_temperature_sensor(sensor::Sensor *temperature_sensor) { temperature_sensor_ = temperature_sensor; }
   void set_pressure_sensor(sensor::Sensor *pressure_sensor) { pressure_sensor_ = pressure_sensor; }

esphome/components/bmp280_base/bmp280_base.cpp

@@ -254,7 +254,6 @@ void BMP280Component::set_temperature_oversampling(BMP280Oversampling temperatur
 void BMP280Component::set_pressure_oversampling(BMP280Oversampling pressure_over_sampling) {
   this->pressure_oversampling_ = pressure_over_sampling;
 }
-void BMP280Component::set_iir_filter(BMP280IIRFilter iir_filter) { this->iir_filter_ = iir_filter; }
 uint8_t BMP280Component::read_u8_(uint8_t a_register) {
   uint8_t data = 0;
   this->bmp_read_byte(a_register, &data);

esphome/components/bmp280_base/bmp280_base.h

@@ -59,7 +59,7 @@ class BMP280Component : public PollingComponent {
   /// Set the oversampling value for the pressure sensor. Default is 16x.
   void set_pressure_oversampling(BMP280Oversampling pressure_over_sampling);
   /// Set the IIR Filter used to increase accuracy, defaults to no IIR Filter.
-  void set_iir_filter(BMP280IIRFilter iir_filter);
+  void set_iir_filter(BMP280IIRFilter iir_filter) { this->iir_filter_ = iir_filter; }
 
   void setup() override;
   void dump_config() override;

esphome/components/bridge/__init__.py

@@ -0,0 +1,4 @@
+CODEOWNERS = ["@kbx81"]
+DOMAIN = "bridge"
+
+IS_PLATFORM_COMPONENT = True

esphome/components/cdc_acm_uart/__init__.py

@@ -0,0 +1 @@
+CODEOWNERS = ["@kbx81"]

esphome/components/cdc_acm_uart/bridge/__init__.py

@@ -0,0 +1,114 @@
+from esphome import pins
+import esphome.codegen as cg
+from esphome.components import esp32, uart, usb_cdc_acm
+from esphome.components.bridge import DOMAIN as BRIDGE_DOMAIN
+from esphome.components.esp32 import VARIANT_ESP32P4, VARIANT_ESP32S2, VARIANT_ESP32S3
+import esphome.config_validation as cv
+from esphome.const import CONF_DEBUG, CONF_ID, CONF_UART_ID
+import esphome.final_validate as fv
+from esphome.types import ConfigType
+
+CODEOWNERS = ["@kbx81"]
+DEPENDENCIES = ["tinyusb", "uart", "usb_cdc_acm"]
+
+CONF_DTR_PIN = "dtr_pin"
+CONF_RTS_PIN = "rts_pin"
+CONF_USB_CDC_ACM_ID = "usb_cdc_acm_id"
+
+cdc_acm_uart_ns = cg.esphome_ns.namespace("cdc_acm_uart")
+CDCACMUARTBridge = cdc_acm_uart_ns.class_("CDCACMUARTBridge", cg.Component)
+
+CONFIG_SCHEMA = cv.All(
+    cv.Schema(
+        {
+            cv.GenerateID(): cv.declare_id(CDCACMUARTBridge),
+            cv.Required(CONF_UART_ID): cv.use_id(uart.IDFUARTComponent),
+            cv.Required(CONF_USB_CDC_ACM_ID): cv.use_id(usb_cdc_acm.USBCDCACMInstance),
+            cv.Optional(CONF_DTR_PIN): pins.gpio_output_pin_schema,
+            cv.Optional(CONF_RTS_PIN): pins.gpio_output_pin_schema,
+        }
+    ).extend(cv.COMPONENT_SCHEMA),
+    # Narrower than usb_cdc_acm's variant list on purpose: S31/H4 untested on
+    # hardware; extend once verified.
+    esp32.only_on_variant(
+        supported=[VARIANT_ESP32P4, VARIANT_ESP32S2, VARIANT_ESP32S3],
+    ),
+)
+
+
+def _subtree_references_uart(node: object, uart_id: str) -> bool:
+    """Return True if any dict in the subtree has a uart_id entry naming this bus."""
+    if isinstance(node, dict):
+        return any(
+            (key == CONF_UART_ID and str(value) == uart_id)
+            or _subtree_references_uart(value, uart_id)
+            for key, value in node.items()
+        )
+    if isinstance(node, list):
+        return any(_subtree_references_uart(item, uart_id) for item in node)
+    return False
+
+
+def _reject_debug(uart_conf: ConfigType) -> ConfigType:
+    # The worker tasks use the IDF driver directly, so the uart debugger never sees
+    # bridge traffic and its dummy_receiver would drain RX bytes on the main loop.
+    if CONF_DEBUG in uart_conf:
+        raise cv.Invalid(
+            "A bridged UART cannot use 'debug'; the bridge bypasses the UART "
+            "component's read/write path.",
+            [CONF_DEBUG],
+        )
+    return uart_conf
+
+
+def _final_validate(config: ConfigType) -> ConfigType:
+    full_config = fv.full_config.get()
+    # Bridges of any platform must own their interfaces exclusively; shared ring
+    # buffers and overwritten callbacks would corrupt both streams silently. The
+    # seen-set is keyed on the bridge domain so future platforms share it.
+    # Other components bind either interface through the same uart_id key (the CDC
+    # instance is itself a uart::UARTComponent) and would race the worker tasks.
+    # Bare `id:` references (a uart.write action) cannot be distinguished; not caught.
+    data = full_config.data.setdefault(BRIDGE_DOMAIN, {})
+    for conf_key, label in (
+        (CONF_UART_ID, "UART"),
+        (CONF_USB_CDC_ACM_ID, "USB CDC-ACM interface"),
+    ):
+        owned_id = str(config[conf_key])
+        used = data.setdefault(conf_key, set())
+        if owned_id in used:
+            raise cv.Invalid(
+                f"The {label} '{owned_id}' is already bridged by another 'bridge' "
+                f"instance; each bridge requires its own {label}.",
+                [conf_key],
+            )
+        used.add(owned_id)
+        for domain, domain_conf in full_config.items():
+            if domain == BRIDGE_DOMAIN:
+                continue
+            if _subtree_references_uart(domain_conf, owned_id):
+                raise cv.Invalid(
+                    f"The {label} '{owned_id}' is also used by '{domain}'; a bridge "
+                    f"requires exclusive use of its {label}.",
+                    [conf_key],
+                )
+
+    fv.id_declaration_match_schema(_reject_debug)(config[CONF_UART_ID])
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = _final_validate
+
+
+async def to_code(config: ConfigType) -> None:
+    uart_component = await cg.get_variable(config[CONF_UART_ID])
+    usb_cdc = await cg.get_variable(config[CONF_USB_CDC_ACM_ID])
+    var = cg.new_Pvariable(config[CONF_ID], uart_component, usb_cdc)
+    await cg.register_component(var, config)
+
+    if dtr_pin_config := config.get(CONF_DTR_PIN):
+        dtr_pin = await cg.gpio_pin_expression(dtr_pin_config)
+        cg.add(var.set_dtr_pin(dtr_pin))
+    if rts_pin_config := config.get(CONF_RTS_PIN):
+        rts_pin = await cg.gpio_pin_expression(rts_pin_config)
+        cg.add(var.set_rts_pin(rts_pin))

esphome/components/cdc_acm_uart/bridge/cdc_acm_uart_bridge.cpp

@@ -0,0 +1,468 @@
+#if defined(USE_ESP32_VARIANT_ESP32P4) || defined(USE_ESP32_VARIANT_ESP32S2) || defined(USE_ESP32_VARIANT_ESP32S3)
+#include "cdc_acm_uart_bridge.h"
+#include "esphome/core/application.h"
+#include "esphome/core/hal.h"
+#include "esphome/core/log.h"
+
+#include <algorithm>
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include "freertos/ringbuf.h"
+#include "driver/uart.h"
+#include "soc/soc_caps.h"
+
+namespace esphome::cdc_acm_uart {
+
+static const char *const TAG = "cdc_acm_uart";
+
+static constexpr size_t UART_TASK_STACK_SIZE = 4096;
+static constexpr size_t RINGBUF_RETRY_CHUNK_SIZE = 64;
+static constexpr uint32_t LOG_THROTTLE_MS = 1000;
+static constexpr uint32_t UART_RELOAD_SETTLE_MS = 20;
+// Above the default priority but below the USB/Wi-Fi system tasks.
+static constexpr UBaseType_t TASK_PRIORITY = 4;
+
+static bool should_log_now(uint32_t *last_ms, uint32_t interval_ms) {
+  uint32_t now = millis();
+  if ((now - *last_ms) >= interval_ms) {
+    *last_ms = now;
+    return true;
+  }
+  return false;
+}
+
+static bool ringbuf_send_with_retry(RingbufHandle_t ringbuf, const uint8_t *data, size_t len, uint32_t *log_ms) {
+  if (len == 0) {
+    return true;
+  }
+
+  if (xRingbufferSend(ringbuf, data, len, pdMS_TO_TICKS(1)) == pdTRUE) {
+    return true;
+  }
+
+  size_t offset = 0;
+  while (offset < len) {
+    size_t chunk = std::min(RINGBUF_RETRY_CHUNK_SIZE, len - offset);
+    if (xRingbufferSend(ringbuf, data + offset, chunk, pdMS_TO_TICKS(1)) != pdTRUE) {
+      if (should_log_now(log_ms, LOG_THROTTLE_MS)) {
+        ESP_LOGW(TAG, "USB TX buffer full; some data is lost");
+      }
+      return false;
+    }
+    offset += chunk;
+  }
+  return true;
+}
+
+void CDCACMUARTBridge::setup() {
+  // Line state starts deasserted (no host yet); active-low DTR#/RTS# wiring is
+  // handled by configuring the pins inverted, so deasserted idles HIGH.
+  if (this->dtr_pin_ != nullptr) {
+    this->dtr_pin_->setup();
+    this->dtr_pin_->digital_write(false);
+  }
+
+  if (this->rts_pin_ != nullptr) {
+    this->rts_pin_->setup();
+    this->rts_pin_->digital_write(false);
+  }
+
+  // A failed UART never assigned its port number, so the worker tasks would run
+  // against an indeterminate port.
+  if (this->uart_parent_->is_failed()) {
+    ESP_LOGE(TAG, "UART parent failed; aborting");
+    this->mark_failed();
+    return;
+  }
+
+  this->configured_baud_rate_ = this->uart_parent_->get_baud_rate();
+  this->configured_parity_ = this->uart_parent_->get_parity();
+  this->configured_stop_bits_ = this->uart_parent_->get_stop_bits();
+  this->configured_data_bits_ = this->uart_parent_->get_data_bits();
+
+  // usb_cdc_acm sets up first (priority IO > HARDWARE). Any interface failing marks
+  // the hub failed, and a failed hub no longer runs loop(), so line coding and line
+  // state events would never reach this bridge even if its own interface is healthy.
+  if (this->usb_cdc_parent_->get_parent()->is_failed()) {
+    ESP_LOGE(TAG, "USB CDC ACM failed; aborting");
+    this->mark_failed();
+    return;
+  }
+
+  // Per-instance task names (keyed on the CDC interface number) keep task dumps
+  // unambiguous with multiple bridges.
+  char tx_task_name[] = "cdc_uart_tx_0";
+  char rx_task_name[] = "cdc_uart_rx_0";
+  const char itf_char = format_hex_char(this->usb_cdc_parent_->get_itf());
+  tx_task_name[sizeof(tx_task_name) - 2] = itf_char;
+  rx_task_name[sizeof(rx_task_name) - 2] = itf_char;
+
+  xTaskCreate(uart_tx_task_fn, tx_task_name, UART_TASK_STACK_SIZE, this, TASK_PRIORITY, &this->uart_tx_task_handle_);
+  if (this->uart_tx_task_handle_ == nullptr) {
+    ESP_LOGE(TAG, "Failed to create UART TX task");
+    this->mark_failed();
+    return;
+  }
+
+  xTaskCreate(uart_rx_task_fn, rx_task_name, UART_TASK_STACK_SIZE, this, TASK_PRIORITY, &this->uart_rx_task_handle_);
+  if (this->uart_rx_task_handle_ == nullptr) {
+    ESP_LOGE(TAG, "Failed to create UART RX task");
+    vTaskDelete(this->uart_tx_task_handle_);
+    this->uart_tx_task_handle_ = nullptr;
+    this->mark_failed();
+    return;
+  }
+
+  // Only register callbacks once both tasks exist, so a failed setup never drives
+  // DTR/RTS from a dead bridge.
+  this->usb_cdc_parent_->set_line_state_callback([this](bool dtr, bool rts) { this->set_line_state(dtr, rts); });
+  this->usb_cdc_parent_->set_line_coding_callback([this](uint32_t, uint8_t, uint8_t, uint8_t) {
+    this->host_coding_seen_ = true;
+    // Another component owns the UART's framing while paused; resume() re-syncs.
+    if (this->paused_ == 0) {
+      this->set_line_coding();
+    }
+  });
+
+  // Release the workers only now: until here a failed setup may still delete the TX
+  // task, which is safe only while it is parked and owns nothing in the driver.
+  xTaskNotifyGive(this->uart_tx_task_handle_);
+  xTaskNotifyGive(this->uart_rx_task_handle_);
+
+  // loop() only services line-coding reloads; stay off the main loop until one is
+  // scheduled.
+  this->disable_loop();
+}
+
+void CDCACMUARTBridge::dump_config() {
+  ESP_LOGCONFIG(TAG,
+                "CDC-ACM UART Bridge:\n"
+                "  UART Bus: %u\n"
+                "  USB CDC Interface: %u",
+                this->uart_parent_->get_hw_serial_number(), this->usb_cdc_parent_->get_itf());
+  LOG_PIN("  DTR Pin: ", this->dtr_pin_);
+  LOG_PIN("  RTS Pin: ", this->rts_pin_);
+}
+
+void CDCACMUARTBridge::on_shutdown() {
+  // The UART (BUS) shuts down after this component (HARDWARE) and deletes its driver,
+  // freeing the ring buffer and mutexes the worker tasks block on. Suspending the
+  // tasks unlinks them from those objects first.
+  if (this->uart_rx_task_handle_ != nullptr) {
+    vTaskSuspend(this->uart_rx_task_handle_);
+  }
+  if (this->uart_tx_task_handle_ != nullptr) {
+    vTaskSuspend(this->uart_tx_task_handle_);
+  }
+}
+
+void CDCACMUARTBridge::loop() {
+  switch (this->state_) {
+    case MainState::MAIN_STATE_RELOAD_PENDING:
+      if ((App.get_loop_component_start_time() - this->reload_requested_at_) < UART_RELOAD_SETTLE_MS) {
+        return;
+      }
+      // Deliberately not gated on tx_idle_(): a host that re-codes the line mid-stream
+      // wants the new framing now, and its own in-flight bytes are its concern.
+      // apply_settings_live() rewrites the framing registers without reinstalling the
+      // driver, so the worker tasks blocked inside it are undisturbed.
+      this->uart_parent_->apply_settings_live();
+      this->state_ = MainState::MAIN_STATE_RUNNING;
+      break;
+    case MainState::MAIN_STATE_PAUSING:
+    case MainState::MAIN_STATE_RESUMING:
+      // Let a host write that was in flight drain, FIFO included, before a reload
+      // flushes the FIFOs and truncates it.
+      if (!this->tx_idle_()) {
+        return;
+      }
+      if (this->state_ == MainState::MAIN_STATE_PAUSING) {
+        this->restore_configured_framing_();
+        this->state_ = MainState::MAIN_STATE_PAUSED;
+      } else {
+        this->finish_resume_();
+      }
+      break;
+    default:
+      break;
+  }
+  this->disable_loop();
+}
+
+void CDCACMUARTBridge::set_line_coding() {
+  if (!this->sync_host_framing_()) {
+    return;
+  }
+  // Coalesce rapid line-coding updates from the host.
+  this->reload_requested_at_ = App.get_loop_component_start_time();
+  this->state_ = MainState::MAIN_STATE_RELOAD_PENDING;
+  // Main-loop context (via USBCDCACMInstance::process_events_).
+  this->enable_loop();
+}
+
+bool CDCACMUARTBridge::sync_host_framing_() {
+  // usb_cdc_acm has already translated the wire coding onto the CDC instance (main
+  // loop); mirror it here so the framing translation has a single source of truth.
+  bool changed = false;
+
+  // Reject 0 (the CDC B0/hang-up encoding; older IDF revisions divide by the rate)
+  // and rates above the SoC ceiling. Anything in between is the driver's call,
+  // matching what a YAML-configured UART accepts.
+  const uint32_t baud = this->usb_cdc_parent_->get_baud_rate();
+  if (baud == 0 || baud > SOC_UART_BITRATE_MAX) {
+    ESP_LOGW(TAG, "Ignoring unsupported baud rate %" PRIu32 " from host; keeping %" PRIu32, baud,
+             this->uart_parent_->get_baud_rate());
+  } else if (this->uart_parent_->get_baud_rate() != baud) {
+    this->uart_parent_->set_baud_rate(baud);
+    changed = true;
+  }
+
+  const uint8_t stop_bits = this->usb_cdc_parent_->get_stop_bits();
+  if (this->uart_parent_->get_stop_bits() != stop_bits) {
+    this->uart_parent_->set_stop_bits(stop_bits);
+    changed = true;
+  }
+
+  const auto parity = this->usb_cdc_parent_->get_parity();
+  if (this->uart_parent_->get_parity() != parity) {
+    this->uart_parent_->set_parity(parity);
+    changed = true;
+  }
+
+  // USB CDC permits data-bit counts the UART cannot represent (up to 16).
+  const uint8_t data_bits = this->usb_cdc_parent_->get_data_bits();
+  if (data_bits < 5 || data_bits > 8) {
+    ESP_LOGW(TAG, "Ignoring unsupported data bits %u from host; keeping %u", data_bits,
+             this->uart_parent_->get_data_bits());
+  } else if (this->uart_parent_->get_data_bits() != data_bits) {
+    this->uart_parent_->set_data_bits(data_bits);
+    changed = true;
+  }
+
+  if (changed) {
+    ESP_LOGV(TAG, "Line coding: baud=%" PRIu32 ", data_bits=%u, stop_bits=%u, parity=%u",
+             this->uart_parent_->get_baud_rate(), this->uart_parent_->get_data_bits(),
+             this->uart_parent_->get_stop_bits(), static_cast<uint8_t>(this->uart_parent_->get_parity()));
+  }
+  return changed;
+}
+
+void CDCACMUARTBridge::pause() {
+  if (this->state_ == MainState::MAIN_STATE_PAUSING || this->state_ == MainState::MAIN_STATE_PAUSED) {
+    return;
+  }
+  this->paused_ = 1;
+  // A null RX task means setup() has not completed (or failed): nothing to stop, and
+  // the framing snapshot does not exist yet. Should setup() run later, the RX task
+  // starts parked.
+  if (this->uart_rx_task_handle_ == nullptr) {
+    this->state_ = MainState::MAIN_STATE_PAUSED;
+    return;
+  }
+  // Drops a coalesced host reload or a pending resume; loop() restores the framing
+  // once any host write in flight has drained.
+  this->state_ = MainState::MAIN_STATE_PAUSING;
+  this->enable_loop();
+}
+
+void CDCACMUARTBridge::resume() {
+  if (this->state_ != MainState::MAIN_STATE_PAUSING && this->state_ != MainState::MAIN_STATE_PAUSED) {
+    return;
+  }
+  if (this->uart_rx_task_handle_ == nullptr) {
+    this->paused_ = 0;
+    this->state_ = MainState::MAIN_STATE_RUNNING;
+    return;
+  }
+  // A restore still waiting on the TX side is moot: the host's framing is kept.
+  if (!this->tx_idle_()) {
+    this->state_ = MainState::MAIN_STATE_RESUMING;
+    this->enable_loop();
+    return;
+  }
+  this->finish_resume_();
+  this->disable_loop();
+}
+
+void CDCACMUARTBridge::finish_resume_() {
+  // Take the bus back at a known framing before either task runs again: the host's
+  // if it ever sent one, else the YAML framing (the other owner may have changed it).
+  if (this->host_coding_seen_) {
+    this->sync_host_framing_();
+    this->uart_parent_->apply_settings_live();
+  } else {
+    this->restore_configured_framing_();
+  }
+  this->paused_ = 0;
+  this->state_ = MainState::MAIN_STATE_RUNNING;
+  this->drive_line_state_();
+  xTaskNotifyGive(this->uart_rx_task_handle_);
+}
+
+bool CDCACMUARTBridge::tx_idle_() {
+  const auto uart_num = static_cast<uart_port_t>(this->uart_parent_->get_hw_serial_number());
+  return this->tx_busy_ == 0 && uart_wait_tx_done(uart_num, 0) == ESP_OK;
+}
+
+void CDCACMUARTBridge::restore_configured_framing_() {
+  // Always applied: the cached settings can lead the hardware by a pending reload,
+  // so they are no proof of what is live.
+  this->uart_parent_->set_baud_rate(this->configured_baud_rate_);
+  this->uart_parent_->set_parity(this->configured_parity_);
+  this->uart_parent_->set_stop_bits(this->configured_stop_bits_);
+  this->uart_parent_->set_data_bits(this->configured_data_bits_);
+  this->uart_parent_->apply_settings_live();
+}
+
+void CDCACMUARTBridge::set_line_state(bool dtr, bool rts) {
+  ESP_LOGV(TAG, "Line state: DTR=%d, RTS=%d", dtr, rts);
+  this->host_dtr_ = dtr;
+  this->host_rts_ = rts;
+  // Frozen while paused: a host opening the port must not reset a peer that another
+  // component is talking to.
+  if (this->paused_ == 0) {
+    this->drive_line_state_();
+  }
+}
+
+void CDCACMUARTBridge::drive_line_state_() {
+  if (this->dtr_pin_ != nullptr) {
+    this->dtr_pin_->digital_write(this->host_dtr_);
+  }
+  if (this->rts_pin_ != nullptr) {
+    this->rts_pin_->digital_write(this->host_rts_);
+  }
+}
+
+void CDCACMUARTBridge::uart_rx_task_fn(void *arg) {
+  auto *bridge = static_cast<CDCACMUARTBridge *>(arg);
+  bridge->uart_rx_task_();
+}
+
+void CDCACMUARTBridge::uart_tx_task_fn(void *arg) {
+  auto *bridge = static_cast<CDCACMUARTBridge *>(arg);
+  bridge->uart_tx_task_();
+}
+
+void CDCACMUARTBridge::uart_rx_task_() {
+  TaskHandle_t usb_tx_handle = this->usb_cdc_parent_->get_tx_task_handle();
+  RingbufHandle_t usb_tx_ringbuf = this->usb_cdc_parent_->get_tx_ringbuf();
+  uart_port_t uart_num = static_cast<uart_port_t>(this->uart_parent_->get_hw_serial_number());
+  // Back-dated so a problem within the first LOG_THROTTLE_MS of uptime still logs.
+  uint32_t tx_full_log_ms = millis() - LOG_THROTTLE_MS;
+  uint32_t err_log_ms = millis() - LOG_THROTTLE_MS;
+
+  uint8_t *data = this->uart_rx_buffer_.data();
+  const size_t buf_size = this->uart_rx_buffer_.size();
+
+  // Released by setup() once both tasks exist.
+  ulTaskNotifyTake(pdTRUE, portMAX_DELAY);
+
+  while (true) {
+    if (this->paused_ != 0) {
+      // Parked until resume() notifies; nothing is read, so the other owner sees
+      // every byte.
+      this->rx_parked_ = 1;
+      ulTaskNotifyTake(pdTRUE, portMAX_DELAY);
+      this->rx_parked_ = 0;
+      continue;
+    }
+
+    // Block until at least one byte is available from UART.
+    int total_rx_size = uart_read_bytes(uart_num, data, 1, pdMS_TO_TICKS(UART_RX_WAIT_MS));
+    if (total_rx_size < 0) {
+      if (should_log_now(&err_log_ms, LOG_THROTTLE_MS)) {
+        ESP_LOGE(TAG, "UART read failed: %d", total_rx_size);
+      }
+      vTaskDelay(pdMS_TO_TICKS(10));
+      continue;
+    }
+    if (total_rx_size == 0) {
+      continue;
+    }
+    // pause() landed during the read: don't forward a byte to a host that is gone.
+    if (this->paused_ != 0) {
+      continue;
+    }
+
+    // Drain the currently buffered burst without waiting.
+    while (true) {
+      int rx_data_size = uart_read_bytes(uart_num, data + total_rx_size, buf_size - total_rx_size, 0);
+      if (rx_data_size < 0) {
+        if (should_log_now(&err_log_ms, LOG_THROTTLE_MS)) {
+          ESP_LOGE(TAG, "UART read failed: %d", rx_data_size);
+        }
+        break;
+      }
+      if (rx_data_size == 0) {
+        break;
+      }
+      ESP_LOGV(TAG, "UART RX: %d bytes", rx_data_size);
+      total_rx_size += rx_data_size;
+      if (total_rx_size >= (int) buf_size) {
+        break;
+      }
+    }
+
+    ringbuf_send_with_retry(usb_tx_ringbuf, data, total_rx_size, &tx_full_log_ms);
+
+    ESP_LOGV(TAG, "UART RX: waking up USB TX task");
+    xTaskNotifyGive(usb_tx_handle);
+  }
+}
+
+void CDCACMUARTBridge::uart_tx_task_() {
+  RingbufHandle_t usb_rx_ringbuf = this->usb_cdc_parent_->get_rx_ringbuf();
+  uart_port_t uart_num = static_cast<uart_port_t>(this->uart_parent_->get_hw_serial_number());
+  uint8_t *data_to_uart = this->uart_tx_buffer_.data();
+  const size_t buf_size = this->uart_tx_buffer_.size();
+  size_t rx_size;
+  // Back-dated so a problem within the first LOG_THROTTLE_MS of uptime still logs.
+  uint32_t err_log_ms = millis() - LOG_THROTTLE_MS;
+  uint32_t drop_log_ms = millis() - LOG_THROTTLE_MS;
+
+  // Released by setup() once both tasks exist.
+  ulTaskNotifyTake(pdTRUE, portMAX_DELAY);
+
+  while (true) {
+    ESP_LOGV(TAG, "Waiting for data to send to UART");
+    esp_err_t ret = usb_cdc_acm::ringbuf_read_bytes(usb_rx_ringbuf, data_to_uart, buf_size, &rx_size, portMAX_DELAY);
+
+    if (ret != ESP_OK) {
+      if (should_log_now(&err_log_ms, LOG_THROTTLE_MS)) {
+        ESP_LOGE(TAG, "USB RX RingBuf read failed");
+      }
+      // Yield: this task runs above the main loop, so a persistent failure must not
+      // become a tight loop.
+      vTaskDelay(pdMS_TO_TICKS(10));
+      continue;
+    }
+
+    // Another component owns the UART; host bytes must not interleave with its traffic.
+    // tx_busy_ goes up before the check so is_paused() cannot miss a write in flight.
+    this->tx_busy_ = 1;
+    if (this->paused_ != 0) {
+      this->tx_busy_ = 0;
+      if (should_log_now(&drop_log_ms, LOG_THROTTLE_MS)) {
+        ESP_LOGW(TAG, "Paused; dropping %zu bytes from host", rx_size);
+      }
+      continue;
+    }
+
+    ESP_LOGV(TAG, "Sending %zu bytes to UART", rx_size);
+    // Signed: uart_write_bytes() returns -1 on error.
+    int xfer_size = uart_write_bytes(uart_num, data_to_uart, rx_size);
+    this->tx_busy_ = 0;
+
+    if (xfer_size < 0) {
+      if (should_log_now(&err_log_ms, LOG_THROTTLE_MS)) {
+        ESP_LOGE(TAG, "UART write failed: %d", xfer_size);
+      }
+    } else if (static_cast<size_t>(xfer_size) != rx_size) {
+      ESP_LOGW(TAG, "UART write incomplete (%d/%zu bytes)", xfer_size, rx_size);
+    }
+  }
+}
+
+}  // namespace esphome::cdc_acm_uart
+#endif

esphome/components/cdc_acm_uart/bridge/cdc_acm_uart_bridge.h

@@ -0,0 +1,118 @@
+#pragma once
+#if defined(USE_ESP32_VARIANT_ESP32P4) || defined(USE_ESP32_VARIANT_ESP32S2) || defined(USE_ESP32_VARIANT_ESP32S3)
+#include "esphome/components/uart/uart_component_esp_idf.h"
+#include "esphome/components/usb_cdc_acm/usb_cdc_acm.h"
+#include "esphome/core/component.h"
+
+#include <array>
+#include <atomic>
+#include "sdkconfig.h"
+
+namespace esphome::cdc_acm_uart {
+
+class CDCACMUARTBridge final : public Component {
+ public:
+  // Upper bound on the RX task's blocking read, so pause() takes effect without
+  // aborting the read. Arriving bytes still unblock it immediately.
+  static constexpr uint32_t UART_RX_WAIT_MS = 250;
+
+  CDCACMUARTBridge(uart::IDFUARTComponent *uart_parent, usb_cdc_acm::USBCDCACMInstance *usb_cdc_parent)
+      : uart_parent_(uart_parent), usb_cdc_parent_(usb_cdc_parent) {}
+
+  void setup() override;
+  void loop() override;
+  void dump_config() override;
+  void on_shutdown() override;
+  float get_setup_priority() const override { return setup_priority::HARDWARE; }
+
+  void set_dtr_pin(GPIOPin *dtr_pin) { this->dtr_pin_ = dtr_pin; }
+  void set_rts_pin(GPIOPin *rts_pin) { this->rts_pin_ = rts_pin; }
+
+  void set_line_coding();
+  void set_line_state(bool dtr, bool rts);
+  uart::IDFUARTComponent *get_uart_parent() const { return this->uart_parent_; }
+
+  /**
+   * Stop forwarding in both directions and hand the UART back to its configured
+   * framing, so another component may use the bus. Main-loop only. The RX task parks
+   * within UART_RX_WAIT_MS (a byte it was already reading is discarded). A host write
+   * already in flight is allowed to drain first, which at low baud rates can take
+   * seconds; the framing is restored only after that, so poll is_paused() rather than
+   * waiting a fixed interval. Host bytes not yet written to the UART are discarded.
+   * The DTR/RTS outputs hold their state while paused and follow the host again on
+   * resume().
+   */
+  void pause();
+  /**
+   * Re-apply the host's line coding and line state, then resume forwarding. Main-loop
+   * only. Deferred until any host write still draining has finished, so the reload
+   * never truncates it.
+   */
+  void resume();
+  /// True once both worker tasks are off the bus and the configured framing is restored.
+  /// With no RX task (setup() failed or has not run) there is nothing to wait for.
+  bool is_paused() const {
+    return this->state_ == MainState::MAIN_STATE_PAUSED &&
+           (this->uart_rx_task_handle_ == nullptr || this->rx_parked_ != 0);
+  }
+
+ protected:
+  static void uart_rx_task_fn(void *arg);
+  static void uart_tx_task_fn(void *arg);
+  void uart_rx_task_();
+  void uart_tx_task_();
+  void restore_configured_framing_();
+  // True when the TX task has no write in flight and the UART TX FIFO has drained.
+  bool tx_idle_();
+  void finish_resume_();
+  void drive_line_state_();
+  // Copy the host's line coding onto the UART settings; true if anything changed.
+  bool sync_host_framing_();
+
+  TaskHandle_t uart_rx_task_handle_{nullptr};
+  TaskHandle_t uart_tx_task_handle_{nullptr};
+
+  GPIOPin *dtr_pin_{nullptr};
+  GPIOPin *rts_pin_{nullptr};
+
+  uint32_t reload_requested_at_{0};
+
+  // Worker staging, each sized to the CDC ring buffer it feeds or drains.
+  std::array<uint8_t, CONFIG_TINYUSB_CDC_TX_BUFSIZE> uart_rx_buffer_{};
+  std::array<uint8_t, CONFIG_TINYUSB_CDC_RX_BUFSIZE> uart_tx_buffer_{};
+
+  uart::IDFUARTComponent *uart_parent_;
+  usb_cdc_acm::USBCDCACMInstance *usb_cdc_parent_;
+
+  // YAML framing, captured at setup; the host's line coding overwrites the UART's
+  // settings, so pause() needs the original to restore.
+  uint32_t configured_baud_rate_{0};
+  uart::UARTParityOptions configured_parity_{uart::UART_CONFIG_PARITY_NONE};
+  uint8_t configured_stop_bits_{0};
+  uint8_t configured_data_bits_{0};
+
+  // Written on the main loop, read by both worker tasks. uint8_t rather than bool:
+  // GCC on Xtensa emits an out-of-line call for atomic<bool>.
+  std::atomic<uint8_t> paused_{0};
+  // Raised by the RX task while parked and by the TX task around each UART write, so
+  // the pause hand-off knows when the bus is actually free.
+  std::atomic<uint8_t> rx_parked_{0};
+  std::atomic<uint8_t> tx_busy_{0};
+  // Main-loop state; paused_ mirrors it for the worker tasks.
+  enum class MainState : uint8_t {
+    MAIN_STATE_RUNNING,
+    MAIN_STATE_RELOAD_PENDING,  // host line coding debounced, forwarding continues
+    MAIN_STATE_PAUSING,         // waiting for TX idle to restore the configured framing
+    MAIN_STATE_PAUSED,
+    MAIN_STATE_RESUMING,  // resume() requested while a host write still drains
+  };
+  MainState state_{MainState::MAIN_STATE_RUNNING};
+  // Host line state, recorded even while paused so resume() can re-drive the pins.
+  bool host_dtr_{false};
+  bool host_rts_{false};
+  // True once the host has sent any line coding; resume() then re-syncs to it.
+  bool host_coding_seen_{false};
+};
+
+}  // namespace esphome::cdc_acm_uart
+#endif

esphome/components/copy/switch/copy_switch.cpp

@@ -13,12 +13,6 @@ void CopySwitch::setup() {
 
 void CopySwitch::dump_config() { LOG_SWITCH("", "Copy Switch", this); }
 
-void CopySwitch::write_state(bool state) {
-  if (state) {
-    source_->turn_on();
-  } else {
-    source_->turn_off();
-  }
-}
+void CopySwitch::write_state(bool state) { this->source_->control(state); }
 
 }  // namespace esphome::copy

esphome/components/display/display.cpp

@@ -3,6 +3,7 @@
 #include <utility>
 #include <numbers>
 #include "display_color_utils.h"
+#include "esphome/core/application.h"
 #include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
@@ -770,10 +771,12 @@ Rect Display::get_clipping() const {
 
 void Display::clear_clipping_() { this->clipping_rectangle_.clear(); }
 
+void Display::feed_wdt_pixel_slow_() { App.feed_wdt(); }
+
 bool Display::clip(int x, int y) {
   if (x < 0 || x >= this->get_width() || y < 0 || y >= this->get_height())
     return false;
-  if (!this->get_clipping().inside(x, y))
+  if (this->is_point_clipped(x, y))
     return false;
   return true;
 }

esphome/components/display/display.h

@@ -758,6 +758,13 @@ class Display : public PollingComponent {
 
   bool is_clipping() const { return !this->clipping_rectangle_.empty(); }
 
+  /// Whether (x, y) falls outside the active clipping rectangle. Tests the
+  /// stack top in place: get_clipping() is out of line and returns the Rect
+  /// by value, which per pixel drawing cannot afford.
+  bool ESPHOME_ALWAYS_INLINE is_point_clipped(int x, int y) const {
+    return this->is_clipping() && !this->clipping_rectangle_.back().inside(x, y);
+  }
+
   /** Check if pixel is within region of display.
    */
   bool clip(int x, int y);
@@ -774,6 +781,17 @@ class Display : public PollingComponent {
   void do_update_();
   void clear_clipping_();
 
+  /// Watchdog feed for per pixel loops. App.feed_wdt() is already rate
+  /// limited, but every call reads the clock; only every 256th pixel makes
+  /// that call, so the real feeds are unchanged and a pixel costs a counter.
+  /// At 20 us per pixel on the slowest e-paper path that is about 5 ms
+  /// between clock reads.
+  void ESPHOME_ALWAYS_INLINE feed_wdt_per_pixel_() {
+    if (++this->wdt_pixel_counter_ == 0)
+      this->feed_wdt_pixel_slow_();
+  }
+  void feed_wdt_pixel_slow_();
+
   virtual int get_height_internal() = 0;
   virtual int get_width_internal() = 0;
 
@@ -793,6 +811,7 @@ class Display : public PollingComponent {
   std::vector<DisplayOnPageChangeTrigger *> on_page_change_triggers_;
   bool auto_clear_enabled_{true};
   std::vector<Rect> clipping_rectangle_;
+  uint8_t wdt_pixel_counter_{0};
   bool show_test_card_{false};
 };
 

esphome/components/display/display_buffer.cpp

@@ -2,7 +2,6 @@
 
 #include <utility>
 
-#include "esphome/core/application.h"
 #include "esphome/core/log.h"
 
 namespace esphome::display {
@@ -44,7 +43,7 @@ int DisplayBuffer::get_height() {
 }
 
 void HOT DisplayBuffer::draw_pixel_at(int x, int y, Color color) {
-  if (!this->get_clipping().inside(x, y))
+  if (this->is_point_clipped(x, y))
     return;  // NOLINT
 
   switch (this->rotation_) {
@@ -64,7 +63,7 @@ void HOT DisplayBuffer::draw_pixel_at(int x, int y, Color color) {
       break;
   }
   this->draw_absolute_pixel_internal(x, y, color);
-  App.feed_wdt();
+  this->feed_wdt_per_pixel_();
 }
 
 }  // namespace esphome::display

esphome/components/display/rect.cpp

@@ -63,16 +63,6 @@ bool Rect::equal(Rect rect) const {
   return (rect.x == this->x) && (rect.w == this->w) && (rect.y == this->y) && (rect.h == this->h);
 }
 
-bool Rect::inside(int16_t test_x, int16_t test_y, bool absolute) const {  // NOLINT
-  if (!this->is_set()) {
-    return true;
-  }
-  if (absolute) {
-    return test_x >= this->x && test_x < this->x2() && test_y >= this->y && test_y < this->y2();
-  }
-  return test_x >= 0 && test_x < this->w && test_y >= 0 && test_y < this->h;
-}
-
 bool Rect::inside(Rect rect) const {
   if (!this->is_set() || !rect.is_set()) {
     return true;

esphome/components/display/rect.h

@@ -26,7 +26,15 @@ class Rect {
   void shrink(Rect rect);
 
   bool inside(Rect rect) const;
-  bool inside(int16_t test_x, int16_t test_y, bool absolute = true) const;
+  bool ESPHOME_ALWAYS_INLINE inside(int16_t test_x, int16_t test_y, bool absolute = true) const {
+    if (!this->is_set()) {
+      return true;
+    }
+    if (absolute) {
+      return test_x >= this->x && test_x < this->x2() && test_y >= this->y && test_y < this->y2();
+    }
+    return test_x >= 0 && test_x < this->w && test_y >= 0 && test_y < this->h;
+  }
   bool equal(Rect rect) const;
   void info(const std::string &prefix = "rect info:");
 };

esphome/components/epaper_spi/epaper_spi.cpp

@@ -299,7 +299,7 @@ bool EPaperBase::initialise(bool partial) {
  * @return false if the coordinates are out of bounds
  */
 bool EPaperBase::rotate_coordinates_(int &x, int &y) {
-  if (!this->get_clipping().inside(x, y))
+  if (this->is_point_clipped(x, y))
     return false;
   if (this->effective_transform_ & SWAP_XY)
     std::swap(x, y);

esphome/components/esp32/__init__.py

@@ -111,6 +111,7 @@ CONF_ENGINEERING_SAMPLE = "engineering_sample"
 CONF_INCLUDE_BUILTIN_IDF_COMPONENTS = "include_builtin_idf_components"
 CONF_ENABLE_LWIP_ASSERT = "enable_lwip_assert"
 CONF_EXECUTE_FROM_PSRAM = "execute_from_psram"
+CONF_FLASH_CHIP = "flash_chip"
 CONF_KEY_ID = "key_id"
 CONF_MINIMUM_CHIP_REVISION = "minimum_chip_revision"
 CONF_NVS_ENCRYPTION = "nvs_encryption"
@@ -261,7 +262,7 @@ DEFAULT_EXCLUDED_IDF_COMPONENTS = (
     "esp_lcd",  # LCD controller drivers - only needed by display component
     "esp_local_ctrl",  # Local control over HTTPS/BLE - ESPHome has native API
     "esp_phy",  # RF PHY - re-included by internal_temperature on the original ESP32; esp_wifi/bt/ieee802154 pull it back
-    "esp_wifi",  # WiFi stack - re-included by request_wifi(), espnow; bt pulls it back for BLE builds
+    "esp_wifi",  # WiFi stack - re-included by request_wifi(), espnow, esp32_hosted; bt pulls it back for BLE builds
     "espcoredump",  # Core dump support - ESPHome has its own debug component
     "fatfs",  # FAT filesystem - ESPHome doesn't use filesystem storage
     "ieee802154",  # 802.15.4 radio - IDF openthread and the Zigbee libs pull it back
@@ -464,6 +465,20 @@ ESP32_CHIP_REVISIONS = {
     "3.1": "CONFIG_ESP32_REV_MIN_3_1",
 }
 
+# Flash vendor drivers ESP-IDF can link; each costs IRAM plus a 124 B table in DRAM
+# and only the one matching the flash ID is ever used
+ESP32_FLASH_CHIPS = {
+    "gd": "CONFIG_SPI_FLASH_SUPPORT_GD_CHIP",
+    "issi": "CONFIG_SPI_FLASH_SUPPORT_ISSI_CHIP",
+    "mxic": "CONFIG_SPI_FLASH_SUPPORT_MXIC_CHIP",
+    "winbond": "CONFIG_SPI_FLASH_SUPPORT_WINBOND_CHIP",
+    "boya": "CONFIG_SPI_FLASH_SUPPORT_BOYA_CHIP",
+    "th": "CONFIG_SPI_FLASH_SUPPORT_TH_CHIP",
+    "mxic_opi": "CONFIG_SPI_FLASH_SUPPORT_MXIC_OPI_CHIP",
+}
+FLASH_CHIP_GENERIC = "generic"
+FLASH_CHIP_OPI = "mxic_opi"  # the octal driver, ESP32-S3 only
+
 # Socket limit configuration for ESP-IDF
 # ESP-IDF CONFIG_LWIP_MAX_SOCKETS has range 1-253, default 10
 DEFAULT_MAX_SOCKETS = 10  # ESP-IDF default
@@ -1519,6 +1534,13 @@ def final_validate(config) -> None:
                 path=[CONF_FRAMEWORK, CONF_ADVANCED, CONF_MINIMUM_CHIP_REVISION],
             )
         )
+    if config[CONF_VARIANT] != VARIANT_ESP32S3 and config.get(CONF_FLASH_MODE) == "opi":
+        errs.append(
+            cv.Invalid(
+                f"'{CONF_FLASH_MODE}: opi' is only supported on {VARIANT_ESP32S3}",
+                path=[CONF_FLASH_MODE],
+            )
+        )
     if config[CONF_VARIANT] != VARIANT_ESP32 and advanced[CONF_SRAM1_AS_IRAM]:
         errs.append(
             cv.Invalid(
@@ -1526,6 +1548,25 @@ def final_validate(config) -> None:
                 path=[CONF_FRAMEWORK, CONF_ADVANCED, CONF_SRAM1_AS_IRAM],
             )
         )
+    if (flash_chip := advanced.get(CONF_FLASH_CHIP)) is not None:
+        opi = flash_chip == FLASH_CHIP_OPI
+        if opi and config[CONF_VARIANT] != VARIANT_ESP32S3:
+            errs.append(
+                cv.Invalid(
+                    f"'{CONF_FLASH_CHIP}: {flash_chip}' is only supported on {VARIANT_ESP32S3}",
+                    path=[CONF_FRAMEWORK, CONF_ADVANCED, CONF_FLASH_CHIP],
+                )
+            )
+        elif opi != (config.get(CONF_FLASH_MODE) == "opi"):
+            errs.append(
+                cv.Invalid(
+                    f"'{CONF_FLASH_CHIP}: {flash_chip}' requires '{CONF_FLASH_MODE}: opi'"
+                    if opi
+                    else f"'{CONF_FLASH_CHIP}: {flash_chip}' does not match "
+                    f"'{CONF_FLASH_MODE}: opi'; octal flash uses {FLASH_CHIP_OPI}",
+                    path=[CONF_FRAMEWORK, CONF_ADVANCED, CONF_FLASH_CHIP],
+                )
+            )
     if (
         config[CONF_VARIANT] != VARIANT_ESP32P4
         and config.get(CONF_ENGINEERING_SAMPLE) is not None
@@ -1964,6 +2005,9 @@ FRAMEWORK_SCHEMA = cv.Schema(
                     *ESP32_CHIP_REVISIONS, string=True
                 ),
                 cv.Optional(CONF_SRAM1_AS_IRAM, default=False): cv.boolean,
+                cv.Optional(CONF_FLASH_CHIP): cv.one_of(
+                    FLASH_CHIP_GENERIC, *ESP32_FLASH_CHIPS, lower=True
+                ),
                 # DHCP server is needed for WiFi AP mode. When WiFi component is used,
                 # it will handle disabling DHCP server when AP is not configured.
                 # Default to false (disabled) when WiFi is not used.
@@ -2609,6 +2653,13 @@ async def to_code(config):
     # NVS finds stored preferences by key, so preference key migration is possible
     cg.add_define("USE_PREFERENCE_KEY_LOOKUP")
     cg.add_build_flag("-Wl,-z,noexecstack")
+    # assert(), HAL_ASSERT and ESP_ERROR_CHECK bake __FILE__ into rodata, and
+    # IDF's noflash placement puts the flash driver's copies in DRAM. The
+    # basename keeps the panic output useful at a fraction of the size.
+    # __FILE_NAME__ is a GCC 12 builtin; IDF 5.0 still ships GCC 11.2.
+    if idf_version() >= cv.Version(5, 1, 0):
+        cg.add_build_flag("-D__FILE__=__FILE_NAME__")
+        cg.add_build_flag("-Wno-builtin-macro-redefined")
     # Deferred so KEY_COMPONENTS is fully populated -- see the coroutine.
     CORE.add_job(_finalize_arduino_aware_flags)
     cg.add_define("ESPHOME_BOARD", config[CONF_BOARD])
@@ -2725,6 +2776,8 @@ async def to_code(config):
         add_idf_sdkconfig_option(
             f"CONFIG_ESPTOOLPY_FLASHMODE_{flash_mode.upper()}", True
         )
+        # the opi mode choice only exists once octal flash is enabled
+        add_idf_sdkconfig_option("CONFIG_ESPTOOLPY_OCT_FLASH", flash_mode == "opi")
     if flash_frequency := config.get(CONF_FLASH_FREQUENCY):
         add_idf_sdkconfig_option(
             f"CONFIG_ESPTOOLPY_FLASHFREQ_{flash_frequency[:-3]}M", True
@@ -2739,6 +2792,11 @@ async def to_code(config):
             config.get(CONF_ENGINEERING_SAMPLE, False),
         )
 
+    # ESP32-C2 defaults to the ROM's newlib "nano" printf, which does not
+    # understand %zu or %lld and crashes on any %s that follows one.
+    if variant == VARIANT_ESP32C2:
+        add_idf_sdkconfig_option("CONFIG_LIBC_NEWLIB_NANO_FORMAT", False)
+
     # Set minimum chip revision for ESP32 variant
     # Setting this to 3.0 or higher reduces flash size by excluding workaround code,
     # and for PSRAM users saves significant IRAM by keeping C library functions in ROM.
@@ -2749,6 +2807,11 @@ async def to_code(config):
                 add_idf_sdkconfig_option(flag, rev == min_rev)
             cg.add_define("USE_ESP32_MIN_CHIP_REVISION_SET")
 
+    # Keep only the flash vendor driver the board needs; the boot log names it
+    if (flash_chip := conf[CONF_ADVANCED].get(CONF_FLASH_CHIP)) is not None:
+        for chip, flag in ESP32_FLASH_CHIPS.items():
+            add_idf_sdkconfig_option(flag, chip == flash_chip)
+
     # Use SRAM1 region as IRAM on ESP32 (original) variant
     # This provides an additional 40KB of IRAM by using SRAM1 memory that was previously
     # reserved for bootloader DRAM. Requires a bootloader from ESP-IDF v5.1 or later.

esphome/components/esp32/crash_handler.cpp

@@ -173,7 +173,10 @@ static const char *const TAG = "esp32.crash";
 // NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables)
 static uint32_t s_current_build_time = static_cast<uint32_t>(ESPHOME_BUILD_TIME);
 
-void crash_handler_read_and_clear() {
+// Validate the NOINIT record. Runs on every has_data() call; re-running is
+// harmless and the magic is left alone so the record survives an OTA
+// rollback reboot, crash_handler_clear() drops it once an API client has it.
+static void read_crash_data() {
   if (s_raw_crash_data.magic == CRASH_MAGIC && s_raw_crash_data.version == CRASH_DATA_VERSION) {
     s_crash_data_valid = true;
     // Clamp counts to prevent out-of-bounds reads from corrupt .noinit data
@@ -194,11 +197,12 @@ void crash_handler_read_and_clear() {
       s_raw_crash_data.other_reg_frame_count = s_raw_crash_data.other_backtrace_count;
 #endif
   }
-  // Don't clear magic here — crash data must survive OTA rollback reboots.
-  // Magic is cleared by crash_handler_clear() after an API client receives the data.
 }
 
-bool crash_handler_has_data() { return s_crash_data_valid; }
+bool crash_handler_has_data() {
+  read_crash_data();
+  return s_crash_data_valid;
+}
 
 void crash_handler_clear() {
   // Only clear the magic so data doesn't survive the next reboot.
@@ -426,7 +430,7 @@ static void log_foreign_addresses() {
 // crashes again during boot, and allowing the CLI's process_stacktrace to match
 // and decode each address individually.
 void crash_handler_log() {
-  if (!s_crash_data_valid)
+  if (!crash_handler_has_data())
     return;
 
   ESP_LOGE(TAG, "*** CRASH DETECTED ON PREVIOUS BOOT ***");

esphome/components/esp32/crash_handler.h

@@ -4,11 +4,6 @@
 
 namespace esphome::esp32 {
 
-/// Read and validate crash data from NOINIT memory.
-/// Does not clear the magic marker — call crash_handler_clear() after
-/// the data has been delivered to an API client so it survives OTA rollback reboots.
-void crash_handler_read_and_clear();
-
 /// Log crash data if a crash was detected on previous boot.
 void crash_handler_log();
 
@@ -16,7 +11,7 @@ void crash_handler_log();
 /// Call after the data has been delivered to an API client.
 void crash_handler_clear();
 
-/// Returns true if crash data was found this boot.
+/// Returns true if crash data was found this boot, reading it first if needed.
 bool crash_handler_has_data();
 
 }  // namespace esphome::esp32

esphome/components/esp32/hal.cpp

@@ -1,9 +1,6 @@
 #ifdef USE_ESP32
 
-// defines.h must come before crash_handler.h so USE_ESP32_CRASH_HANDLER is set
-// before crash_handler.h's #ifdef-guarded namespace block is parsed.
 #include "esphome/core/defines.h"
-#include "crash_handler.h"
 #include "esphome/core/hal.h"
 
 #include <esp_clk_tree.h>
@@ -45,11 +42,6 @@ void arch_restart() {
 }
 
 void arch_init() {
-#ifdef USE_ESP32_CRASH_HANDLER
-  // Read crash data from previous boot before anything else
-  esp32::crash_handler_read_and_clear();
-#endif
-
   // Enable the task watchdog only on the loop task (from which we're currently running)
   esp_task_wdt_add(nullptr);
 

esphome/components/esp32_ble/ble.cpp

@@ -83,18 +83,23 @@ void ESP32BLE::setup() {
   }
 }
 
-void ESP32BLE::enable() {
-  if (this->state_ != BLE_COMPONENT_STATE_DISABLED)
-    return;
-
-  this->state_ = BLE_COMPONENT_STATE_ENABLE;
-}
-
-void ESP32BLE::disable() {
-  if (this->state_ == BLE_COMPONENT_STATE_DISABLED)
-    return;
-
-  this->state_ = BLE_COMPONENT_STATE_DISABLE;
+// Queue the transition for loop(). A pending transition the other way is
+// cancelled instead, since nothing was torn down or brought up yet; any other
+// state is already there or on its way.
+void ESP32BLE::request_state_(bool enable) {
+  if (enable) {
+    if (this->state_ == BLE_COMPONENT_STATE_DISABLED) {
+      this->state_ = BLE_COMPONENT_STATE_ENABLE;
+    } else if (this->state_ == BLE_COMPONENT_STATE_DISABLE) {
+      this->state_ = BLE_COMPONENT_STATE_ACTIVE;
+    }
+  } else {
+    if (this->state_ == BLE_COMPONENT_STATE_ACTIVE) {
+      this->state_ = BLE_COMPONENT_STATE_DISABLE;
+    } else if (this->state_ == BLE_COMPONENT_STATE_ENABLE) {
+      this->state_ = BLE_COMPONENT_STATE_DISABLED;
+    }
+  }
 }
 
 #ifdef USE_ESP32_BLE_ADVERTISING
@@ -580,7 +585,11 @@ void ESP32BLE::loop_handle_state_transition_not_active_() {
       this->mark_failed();
       return;
     }
-    this->state_ = BLE_COMPONENT_STATE_DISABLED;
+    this->drain_ble_events_();
+    // A status callback may have asked for BLE back; the stack is down now, so
+    // that request becomes a bring-up.
+    this->state_ =
+        this->state_ == BLE_COMPONENT_STATE_ACTIVE ? BLE_COMPONENT_STATE_ENABLE : BLE_COMPONENT_STATE_DISABLED;
   } else if (this->state_ == BLE_COMPONENT_STATE_ENABLE) {
     ESP_LOGD(TAG, "Enabling");
     this->state_ = BLE_COMPONENT_STATE_OFF;

esphome/components/esp32_ble/ble.h

@@ -102,8 +102,8 @@ class ESP32BLE final : public Component {
   }
   uint32_t get_advertising_cycle_time() const { return this->advertising_cycle_time_; }
 
-  void enable();
-  void disable();
+  void enable() { this->request_state_(true); }
+  void disable() { this->request_state_(false); }
   ESPHOME_ALWAYS_INLINE bool is_active() { return this->state_ == BLE_COMPONENT_STATE_ACTIVE; }
   void setup() override;
   void loop() override;
@@ -176,6 +176,15 @@ class ESP32BLE final : public Component {
 
   bool ble_setup_();
   bool ble_dismantle_();
+  void request_state_(bool enable);
+  // Drop what the old stack queued; the next stack reuses the same interface ids.
+  void drain_ble_events_() {
+    BLEEvent *ble_event;
+    while ((ble_event = this->ble_events_.pop()) != nullptr) {
+      this->ble_event_pool_.release(ble_event);
+    }
+    this->ble_events_.get_and_reset_dropped_count();
+  }
   bool ble_pre_setup_();
 #ifdef USE_ESP32_BLE_ADVERTISING
   void advertising_init_();

esphome/components/esp32_ble_client/ble_client_base.cpp

@@ -42,7 +42,7 @@ void BLEClientBase::set_state(espbt::ClientState st) {
 
 void BLEClientBase::loop() {
   if (!esp32_ble::global_ble->is_active()) {
-    this->set_state(espbt::ClientState::INIT);
+    // ble_before_disabled_event_handler() resets the client.
     return;
   }
   if (this->state() == espbt::ClientState::INIT) {
@@ -72,6 +72,21 @@ void BLEClientBase::loop() {
 
 float BLEClientBase::get_setup_priority() const { return setup_priority::AFTER_BLUETOOTH; }
 
+void BLEClientBase::ble_before_disabled_event_handler() {
+  auto st = this->state();
+  if (st != espbt::ClientState::IDLE && st != espbt::ClientState::INIT) {
+    // No CLOSE_EVT will come: free the services and settle the link.
+    this->release_services();
+    this->set_idle_();
+    this->on_disconnect_complete(ESP_GATT_CONN_TERMINATE_LOCAL_HOST);
+  }
+  // The interface belongs to the torn-down stack.
+  this->gattc_if_ = ESP_GATT_IF_NONE;
+  this->set_state(espbt::ClientState::INIT);
+  // An idle client runs no loop; the INIT branch must run to register again.
+  this->enable_loop();
+}
+
 void BLEClientBase::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "  Address: %s\n"
@@ -93,6 +108,10 @@ bool BLEClientBase::parse_device(const espbt::ESPBTDevice &device) {
     return false;
   if (this->state() != espbt::ClientState::IDLE)
     return false;
+  // Not registered on this stack yet; promoting now would stop the scan for a
+  // connect that connect() rejects anyway.
+  if (this->gattc_if_ == ESP_GATT_IF_NONE)
+    return false;
 
   this->log_event_("Found device");
   if (ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_DEBUG)
@@ -117,6 +136,15 @@ void BLEClientBase::connect() {
              this->connection_index_, this->address_str_);
     return;
   }
+  if (this->gattc_if_ == ESP_GATT_IF_NONE) {
+    // Bluedroid drops an open on an unknown interface without any event.
+    this->log_warning_("Connect rejected, GATT app not registered");
+    // INIT stays so loop() still registers; only a promoted client goes back.
+    if (this->state() == espbt::ClientState::DISCOVERED) {
+      this->set_state(espbt::ClientState::IDLE);
+    }
+    return;
+  }
   ESP_LOGI(TAG, "[%d] [%s] 0x%02x Connecting", this->connection_index_, this->address_str_, this->remote_addr_type_);
   this->paired_ = false;
   // A registration whose event never arrived must not block this connection's release.
@@ -199,7 +227,10 @@ void BLEClientBase::release_services() {
 #ifndef CONFIG_BT_GATTC_CACHE_NVS_FLASH
   // Only the cache clean makes the stack's database unsafe to walk.
   this->services_released_ = true;
-  esp_ble_gattc_cache_clean(this->remote_bda_);
+  // A stack on its way down frees its own cache.
+  if (esp32_ble::global_ble->is_active()) {
+    esp_ble_gattc_cache_clean(this->remote_bda_);
+  }
 #endif
 }
 

esphome/components/esp32_ble_client/ble_client_base.h

@@ -41,6 +41,7 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
   void connect() override;
   esp_err_t pair();
   void disconnect() override;
+  void ble_before_disabled_event_handler() override;
   void unconditional_disconnect();
   void release_services();
 
@@ -114,7 +115,7 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
 #endif
 
   // Group 3: 4-byte types
-  int gattc_if_;
+  int gattc_if_{ESP_GATT_IF_NONE};
   esp_gatt_status_t status_{ESP_GATT_OK};
 
   // Group 4: Arrays
@@ -139,7 +140,7 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
   uint8_t pending_notify_regs_{0};
   bool auto_connect_{false};
   bool paired_{false};
-  // Set only when release_services() cleans the stack's GATT cache, which no API may then walk
+  // Set by release_services() on RAM-cache builds; the stack's GATT database must not be walked after it
   bool services_released_{false};
   // 8 bytes used, no padding
 
@@ -155,10 +156,11 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
   void log_connection_params_(const char *param_type);
   void handle_connection_result_(esp_err_t ret);
   /// Hook called once a connection has been fully torn down (after release_services() and
-  /// set_idle_()), from both the CLOSE_EVT handler and the DISCONNECTING safety timeout.
+  /// set_idle_()): CLOSE_EVT, the DISCONNECTING safety timeout, or the BLE stack going down.
   /// Subclasses with extra per-connection accounting (e.g. bluetooth_proxy slot state)
-  /// override this to release that state. `reason` is the controller reason code, or
-  /// ESP_GATT_CONN_TIMEOUT for the safety-timeout path.
+  /// override this to release that state. `reason` is the controller reason code,
+  /// ESP_GATT_CONN_TIMEOUT for the safety timeout, or ESP_GATT_CONN_TERMINATE_LOCAL_HOST
+  /// for the stack going down.
   virtual void on_disconnect_complete(esp_err_t reason) {}
   /// Transition to IDLE and reset conn_id — call when the connection is fully dead.
   void set_idle_() {

esphome/components/esp32_ble_server/__init__.py

@@ -597,7 +597,7 @@ async def to_code(config):
     cg.add(parent.advertising_set_appearance(config[CONF_APPEARANCE]))
     cg.add(var.set_max_clients(config[CONF_MAX_CLIENTS]))
     # Only advertise for the server itself when the configuration gives clients something to
-    # find. A server that is auto-loaded purely to host a runtime service (esp32_improv) stays
+    # find. A server that is auto-loaded purely to host a runtime service (improv_ble) stays
     # silent until that service asks for advertising.
     cg.add(
         var.set_advertising_required(

esphome/components/esp32_ble_server/ble_server.h

@@ -40,7 +40,7 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
 
   /** Whether this server needs the device to advertise so clients can find and connect to it.
    *
-   * False for a server that only hosts services created at runtime (e.g. esp32_improv), which
+   * False for a server that only hosts services created at runtime (e.g. improv_ble), which
    * request advertising themselves for as long as they need it.
    */
   void set_advertising_required(bool required) { this->advertising_required_ = required; }

esphome/components/esp32_ble_tracker/esp32_ble_tracker.cpp

@@ -62,6 +62,11 @@ void ESP32BLETracker::on_ota_global_state(ota::OTAState state, float progress, u
     for (auto *client : this->clients_) {
       client->disconnect();
     }
+#ifdef USE_ESP32_BLE_SOFTWARE_COEXISTENCE
+    // The OTA transfer blocks the main loop, so the revert in loop() cannot run. No
+    // active-connection gate here: every client was just told to disconnect.
+    this->update_coex_preference_(false);
+#endif
 #endif
   } else if ((state == ota::OTA_ERROR || state == ota::OTA_ABORT) && this->scan_continuous_before_ota_) {
     this->scan_continuous_before_ota_ = false;
@@ -74,11 +79,11 @@ void ESP32BLETracker::on_ota_global_state(ota::OTAState state, float progress, u
 
 void ESP32BLETracker::loop() {
   if (!this->parent_->is_active()) {
-    this->ble_was_disabled_ = true;
     return;
-  } else if (this->ble_was_disabled_) {
+  }
+  if (this->ble_was_disabled_) {
     this->ble_was_disabled_ = false;
-    // If the BLE stack was disabled, we need to start the scan again.
+    // First start after boot or after the stack came back.
     if (this->scan_continuous_) {
       this->start_scan();
     }
@@ -218,7 +223,27 @@ void ESP32BLETracker::stop_scan() {
   this->stop_scan_();
 }
 
-void ESP32BLETracker::ble_before_disabled_event_handler() { this->stop_scan_(); }
+void ESP32BLETracker::ble_before_disabled_event_handler() {
+  // Tell the controller to stop; a scan still starting has nothing to stop yet.
+  if (this->scanner_state_ == ScannerState::RUNNING || this->scanner_state_ == ScannerState::FAILED) {
+    this->stop_scan_();
+  }
+#ifdef ESPHOME_ESP32_BLE_TRACKER_CLIENT_COUNT
+  for (auto *client : this->clients_) {
+    client->ble_before_disabled_event_handler();
+  }
+  this->skip_next_scan_end_ = false;
+#endif
+  // The stop above never completes (stack torn down, events dropped); settle
+  // here so start_scan_() sees IDLE once the stack is back.
+  if (this->scanner_state_ != ScannerState::IDLE) {
+    this->cleanup_scan_state_(true);
+  }
+  // A failure latched by the old stack must not be handled against the next.
+  this->scan_start_failed_ = ESP_BT_STATUS_SUCCESS;
+  this->scan_set_param_failed_ = ESP_BT_STATUS_SUCCESS;
+  this->ble_was_disabled_ = true;
+}
 
 bool ESP32BLETracker::stop_scan_() {
   if (this->scanner_state_ != ScannerState::RUNNING && this->scanner_state_ != ScannerState::FAILED) {

esphome/components/esp32_ble_tracker/esp32_ble_tracker.h

@@ -113,6 +113,9 @@ class ESPBTClient : public ESPBTDeviceListener {
   virtual void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) = 0;
   virtual void connect() = 0;
   virtual void disconnect() = 0;
+  /// Called right before the BLE stack is dismantled. Nothing in flight will
+  /// complete, and the GATT app must register again once the stack is back.
+  virtual void ble_before_disabled_event_handler() {}
   bool disconnect_pending() const { return this->want_disconnect_; }
   void cancel_pending_disconnect() { this->want_disconnect_ = false; }
 
@@ -132,7 +135,7 @@ class ESPBTClient : public ESPBTDeviceListener {
   void set_tracker_state_version(uint8_t *version) { this->tracker_state_version_ = version; }
 
   // Memory optimized layout
-  uint8_t app_id;  // App IDs are small integers assigned sequentially
+  uint8_t app_id{0};  // App IDs are small integers assigned sequentially
 
  protected:
   /// Set state without IDLE handling - use for direct state transitions.

esphome/components/esp32_camera/esp32_camera.cpp

@@ -433,25 +433,10 @@ void ESP32Camera::set_pixel_format(ESP32CameraPixelFormat format) {
   }
 }
 void ESP32Camera::set_jpeg_quality(uint8_t quality) { this->config_.jpeg_quality = quality; }
-void ESP32Camera::set_vertical_flip(bool vertical_flip) { this->vertical_flip_ = vertical_flip; }
-void ESP32Camera::set_horizontal_mirror(bool horizontal_mirror) { this->horizontal_mirror_ = horizontal_mirror; }
-void ESP32Camera::set_contrast(int contrast) { this->contrast_ = contrast; }
-void ESP32Camera::set_brightness(int brightness) { this->brightness_ = brightness; }
-void ESP32Camera::set_saturation(int saturation) { this->saturation_ = saturation; }
-void ESP32Camera::set_special_effect(ESP32SpecialEffect effect) { this->special_effect_ = effect; }
 /* set exposure parameters */
-void ESP32Camera::set_aec_mode(ESP32GainControlMode mode) { this->aec_mode_ = mode; }
-void ESP32Camera::set_aec2(bool aec2) { this->aec2_ = aec2; }
-void ESP32Camera::set_ae_level(int ae_level) { this->ae_level_ = ae_level; }
-void ESP32Camera::set_aec_value(uint32_t aec_value) { this->aec_value_ = aec_value; }
 /* set gains parameters */
-void ESP32Camera::set_agc_mode(ESP32GainControlMode mode) { this->agc_mode_ = mode; }
-void ESP32Camera::set_agc_value(uint8_t agc_value) { this->agc_value_ = agc_value; }
-void ESP32Camera::set_agc_gain_ceiling(ESP32AgcGainCeiling gain_ceiling) { this->agc_gain_ceiling_ = gain_ceiling; }
 /* set white balance */
-void ESP32Camera::set_wb_mode(ESP32WhiteBalanceMode mode) { this->wb_mode_ = mode; }
 /* set test mode */
-void ESP32Camera::set_test_pattern(bool test_pattern) { this->test_pattern_ = test_pattern; }
 /* set fps */
 void ESP32Camera::set_max_update_interval(uint32_t max_update_interval) {
   this->max_update_interval_ = max_update_interval;

esphome/components/esp32_camera/esp32_camera.h

@@ -140,25 +140,25 @@ class ESP32Camera final : public camera::Camera {
   void set_pixel_format(ESP32CameraPixelFormat format);
   void set_frame_size(ESP32CameraFrameSize size);
   void set_jpeg_quality(uint8_t quality);
-  void set_vertical_flip(bool vertical_flip);
-  void set_horizontal_mirror(bool horizontal_mirror);
-  void set_contrast(int contrast);
-  void set_brightness(int brightness);
-  void set_saturation(int saturation);
-  void set_special_effect(ESP32SpecialEffect effect);
+  void set_vertical_flip(bool vertical_flip) { this->vertical_flip_ = vertical_flip; }
+  void set_horizontal_mirror(bool horizontal_mirror) { this->horizontal_mirror_ = horizontal_mirror; }
+  void set_contrast(int contrast) { this->contrast_ = contrast; }
+  void set_brightness(int brightness) { this->brightness_ = brightness; }
+  void set_saturation(int saturation) { this->saturation_ = saturation; }
+  void set_special_effect(ESP32SpecialEffect effect) { this->special_effect_ = effect; }
   /* -- exposure */
-  void set_aec_mode(ESP32GainControlMode mode);
-  void set_aec2(bool aec2);
-  void set_ae_level(int ae_level);
-  void set_aec_value(uint32_t aec_value);
+  void set_aec_mode(ESP32GainControlMode mode) { this->aec_mode_ = mode; }
+  void set_aec2(bool aec2) { this->aec2_ = aec2; }
+  void set_ae_level(int ae_level) { this->ae_level_ = ae_level; }
+  void set_aec_value(uint32_t aec_value) { this->aec_value_ = aec_value; }
   /* -- gains */
-  void set_agc_mode(ESP32GainControlMode mode);
-  void set_agc_value(uint8_t agc_value);
-  void set_agc_gain_ceiling(ESP32AgcGainCeiling gain_ceiling);
+  void set_agc_mode(ESP32GainControlMode mode) { this->agc_mode_ = mode; }
+  void set_agc_value(uint8_t agc_value) { this->agc_value_ = agc_value; }
+  void set_agc_gain_ceiling(ESP32AgcGainCeiling gain_ceiling) { this->agc_gain_ceiling_ = gain_ceiling; }
   /* -- white balance */
-  void set_wb_mode(ESP32WhiteBalanceMode mode);
+  void set_wb_mode(ESP32WhiteBalanceMode mode) { this->wb_mode_ = mode; }
   /* -- test */
-  void set_test_pattern(bool test_pattern);
+  void set_test_pattern(bool test_pattern) { this->test_pattern_ = test_pattern; }
   /* -- framerates */
   void set_max_update_interval(uint32_t max_update_interval);
   void set_idle_update_interval(uint32_t idle_update_interval);

esphome/components/esp32_hosted/__init__.py

@@ -290,6 +290,8 @@ async def to_code(config: ConfigType) -> None:
     # symbols are simply unused and never register a callback at runtime.
     if esp32.get_esp32_variant() == esp32.VARIANT_ESP32P4:
         add_define("USE_ESP_NOW_HOSTED")
+        # esp_now_hosted.cpp includes esp_now.h, which esp_wifi provides
+        esp32.include_builtin_idf_component("esp_wifi")
         # esp-hosted's CustomRpc ("peer data transfer") path — off by default.
         esp32.add_idf_sdkconfig_option(
             "CONFIG_ESP_HOSTED_ENABLE_PEER_DATA_TRANSFER", True

esphome/components/esp32_hosted/update/esp32_hosted_update.cpp

@@ -169,7 +169,7 @@ void Esp32HostedUpdate::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "  Mode: HTTP\n"
                 "  Source URL: %s",
-                this->source_url_.c_str());
+                this->source_url_);
 #else
   ESP_LOGCONFIG(TAG,
                 "  Mode: Embedded\n"
@@ -215,7 +215,7 @@ bool Esp32HostedUpdate::fetch_manifest_() {
 
   auto container = this->http_request_parent_->get(this->source_url_);
   if (container == nullptr || container->status_code != 200) {
-    ESP_LOGE(TAG, "Failed to fetch manifest from %s", this->source_url_.c_str());
+    ESP_LOGE(TAG, "Failed to fetch manifest from %s", this->source_url_);
     this->status_set_error(LOG_STR("Failed to fetch manifest"));
     return false;
   }

esphome/components/esp32_hosted/update/esp32_hosted_update.h

@@ -25,7 +25,7 @@ class Esp32HostedUpdate final : public update::UpdateEntity, public PollingCompo
 
 #ifdef USE_ESP32_HOSTED_HTTP_UPDATE
   // HTTP mode setters
-  void set_source_url(const std::string &url) { this->source_url_ = url; }
+  void set_source_url(const char *url) { this->source_url_ = url; }
   void set_http_request_parent(http_request::HttpRequestComponent *parent) { this->http_request_parent_ = parent; }
 #else
   // Embedded mode setters
@@ -38,7 +38,7 @@ class Esp32HostedUpdate final : public update::UpdateEntity, public PollingCompo
 #ifdef USE_ESP32_HOSTED_HTTP_UPDATE
   // HTTP mode members
   http_request::HttpRequestComponent *http_request_parent_{nullptr};
-  std::string source_url_;
+  const char *source_url_{nullptr};  // literal from codegen
   std::string firmware_url_;
 
   // HTTP mode helpers

esphome/components/esp8266/__init__.py

@@ -363,14 +363,6 @@ async def to_code(config: ConfigType) -> None:
     if config.get(CONF_ENABLE_SERIAL1):
         enable_serial1()
 
-    # Arduino 2 has a non-standards conformant new that returns a nullptr instead of failing when
-    # out of memory and exceptions are disabled. Since Arduino 2.6.0, this flag can be used to make
-    # new abort instead. Use it so that OOM fails early (on allocation) instead of on dereference of
-    # a NULL pointer (so the stacktrace makes more sense), and for consistency with Arduino 3,
-    # which always aborts if exceptions are disabled.
-    # For cases where nullptrs can be handled, use nothrow: `new (std::nothrow) T;`
-    cg.add_build_flag("-DNEW_OOM_ABORT")
-
     # Force-include inline std::__throw_* overrides so GCC dead-strips the unused
     # libstdc++ error message strings (e.g. "basic_string::_M_create") from DRAM.
     # See throw_stubs.h for details. Must be prepended before <string>, so this

esphome/components/esp8266_pwm/esp8266_pwm.h

@@ -11,6 +11,9 @@ namespace esphome::esp8266_pwm {
 
 class ESP8266PWM final : public output::FloatOutput, public Component {
  public:
+  // User provided, not "= default": `new(p) ESP8266PWM()` would zero-fill .bss that is already zero.
+  ESP8266PWM() {}
+
   void set_pin(InternalGPIOPin *pin) { pin_ = pin; }
   void set_frequency(float frequency) { this->frequency_ = frequency; }
   /// Dynamically update frequency
@@ -28,8 +31,8 @@ class ESP8266PWM final : public output::FloatOutput, public Component {
  protected:
   void write_state(float state) override;
 
-  InternalGPIOPin *pin_;
-  float frequency_{1000.0};
+  InternalGPIOPin *pin_{nullptr};
+  float frequency_{1000.0};  // Keep in sync with DEFAULT_FREQUENCY in output.py
   /// Cache last output level for dynamic frequency updating
   float last_output_{0.0};
 };

esphome/components/esp8266_pwm/output.py

@@ -22,6 +22,10 @@ ESP8266PWM = esp8266_pwm_ns.class_("ESP8266PWM", output.FloatOutput, cg.Componen
 SetFrequencyAction = esp8266_pwm_ns.class_("SetFrequencyAction", automation.Action)
 validate_frequency = cv.All(cv.frequency, cv.float_range(min=1.0e-6))
 
+# Schema default that also matches the C++ initializer in esp8266_pwm.h; codegen
+# skips the setter when the config equals it.
+DEFAULT_FREQUENCY = 1000.0
+
 CONFIG_SCHEMA = cv.All(
     output.FLOAT_OUTPUT_SCHEMA.extend(
         {
@@ -29,7 +33,7 @@ CONFIG_SCHEMA = cv.All(
             cv.Required(CONF_PIN): cv.All(
                 pins.internal_gpio_output_pin_schema, valid_pwm_pin
             ),
-            cv.Optional(CONF_FREQUENCY, default="1kHz"): validate_frequency,
+            cv.Optional(CONF_FREQUENCY, default=DEFAULT_FREQUENCY): validate_frequency,
         }
     ).extend(cv.COMPONENT_SCHEMA),
     cv.require_framework_version(
@@ -48,7 +52,9 @@ async def to_code(config: ConfigType) -> None:
     pin = await cg.gpio_pin_expression(config[CONF_PIN])
     cg.add(var.set_pin(pin))
 
-    cg.add(var.set_frequency(config[CONF_FREQUENCY]))
+    # Skip the setter when the config matches the C++ initializer (DEFAULT_FREQUENCY).
+    if (frequency := config[CONF_FREQUENCY]) != DEFAULT_FREQUENCY:
+        cg.add(var.set_frequency(frequency))
 
 
 @automation.register_action(

esphome/components/esphome/ota/__init__.py

@@ -166,9 +166,17 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
                 CONF_PASSWORD,
             )
     # web_server and prometheus keep the shared listener up; the captive
-    # portal's copy only exists on the fallback AP and is the recovery path
+    # portal's copy only exists on the fallback AP and is the recovery path.
+    # web_server `ota: false` gates /update behind the captive portal on
+    # every listener
+    web_server_conf = full_conf.get(CONF_WEB_SERVER)
+    plaintext_update_reachable = (
+        web_server_conf.get(CONF_OTA) is not False
+        if web_server_conf is not None
+        else "prometheus" in full_conf
+    )
     if (
-        (CONF_WEB_SERVER in full_conf or "prometheus" in full_conf)
+        plaintext_update_reachable
         and any(conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf)
         and any(
             CONF_ENCRYPTION in conf
@@ -308,20 +316,16 @@ async def to_code(config: ConfigType) -> None:
     # One key per device: an api encryption block supplies it (static or
     # runtime) and offers; the ota block only adds the requirement
     api_conf = CORE.config.get(CONF_API) or {}
-    encryption_conf = config.get(CONF_ENCRYPTION)
-    own_key = None
-    if encryption_conf is not None and static_encryption_key(api_conf) is None:
-        own_key = encryption_conf[CONF_KEY]
-    if own_key is not None:
+    if key := static_encryption_key(config) or static_encryption_key(api_conf):
+        # Build time key: the ota keeps its own pointer so safe mode, which
+        # has no api server, still has it
         cg.add_define("USE_OTA_ENCRYPTION")
-        cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], own_key)))
+        cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], key)))
     elif CONF_ENCRYPTION in api_conf:
+        # Runtime key: found in the api server, or in preferences in safe mode
         cg.add_define("USE_OTA_ENCRYPTION")
-        cg.add_define("USE_OTA_ENCRYPTION_FROM_API")
-        if static_encryption_key(api_conf) is None:
-            # The key arrives at runtime, so the offer has to look for it
-            cg.add_define("USE_OTA_ENCRYPTION_PROVISIONED")
-    if encryption_conf is not None:
+        cg.add_define("USE_OTA_ENCRYPTION_PROVISIONED")
+    if CONF_ENCRYPTION in config:
         cg.add_define("USE_OTA_ENCRYPTION_REQUIRED")
 
     # Build flag so lwip_fast_select.c (a .c file that can't include defines.h) sees it.

esphome/components/esphome/ota/ota_esphome.cpp

@@ -1,5 +1,5 @@
 #include "ota_esphome.h"
-#ifdef USE_OTA_ENCRYPTION_FROM_API
+#ifdef USE_OTA_ENCRYPTION_PROVISIONED
 #include "esphome/components/api/api_server.h"
 #endif
 #ifdef USE_OTA
@@ -32,11 +32,13 @@ static const char *const TAG = "esphome.ota";
 
 #ifdef USE_OTA_ENCRYPTION
 const noise::NoiseContext &ESPHomeOTAComponent::noise_context_() const {
-#ifdef USE_OTA_ENCRYPTION_FROM_API
-  return api::global_api_server->get_noise_ctx();
-#else
-  return this->noise_ctx_;
+#ifdef USE_OTA_ENCRYPTION_PROVISIONED
+  // The api server holds the live key; safe mode never constructs it, and then
+  // noise_ctx_ holds the saved key setup() found, if any
+  if (api::global_api_server != nullptr)
+    return api::global_api_server->get_noise_ctx();
 #endif
+  return this->noise_ctx_;
 }
 #endif
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
@@ -58,6 +60,16 @@ extern "C" void esphome_wake_ota_component_any_context() {
 }
 
 void ESPHomeOTAComponent::setup() {
+#ifdef USE_OTA_ENCRYPTION_PROVISIONED
+  // Safe mode never constructs the api server, so read the key it saved
+  noise::psk_t psk;
+  if (api::global_api_server == nullptr && api::load_saved_noise_psk(psk)) {
+    this->saved_psk_ = RAMAllocator<noise::psk_t>().make_unique(psk);
+    if (this->saved_psk_ != nullptr) {
+      this->noise_ctx_.set_psk(this->saved_psk_->data());
+    }
+  }
+#endif
   this->server_ = socket::socket_ip_loop_monitored(SOCK_STREAM, 0).release();  // monitored for incoming connections
   if (this->server_ == nullptr) {
     this->server_failed_(LOG_STR("creation"));
@@ -842,7 +854,14 @@ bool ESPHomeOTAComponent::handle_auth_send_() {
     const size_t hex_size = hasher.get_size() * 2;
     const size_t nonce_len = hasher.get_size() / 4;
     const size_t auth_buf_size = 1 + 3 * hex_size;
-    this->auth_buf_ = std::make_unique<uint8_t[]>(auth_buf_size);
+    // Internal RAM first: 128 of these bytes go straight into the hardware SHA engine
+    this->auth_buf_ =
+        RAMAllocator<uint8_t>(RAMAllocator<uint8_t>::PREFER_INTERNAL).make_unique_array_for_overwrite(auth_buf_size);
+    if (!this->auth_buf_) {
+      this->log_auth_warning_(LOG_STR("No memory"));
+      this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_UNKNOWN);
+      return false;
+    }
     this->auth_buf_pos_ = 0;
 
     char *buf = reinterpret_cast<char *>(this->auth_buf_.get() + 1);

esphome/components/esphome/ota/ota_esphome.h

@@ -44,7 +44,7 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   }
 #endif  // USE_OTA_PASSWORD
 
-#if defined(USE_OTA_ENCRYPTION) && !defined(USE_OTA_ENCRYPTION_FROM_API)
+#ifdef USE_OTA_ENCRYPTION
   /// psk points at 32 bytes that live in flash for the life of the program
   void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
 #endif
@@ -86,7 +86,8 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
     bool writing{false};    // a produced handshake frame is still being flushed
     uint8_t frame_buf[noise::FRAME_HEADER_SIZE + 1 + noise::MAX_HANDSHAKE_SIZE];
   };
-  // The api server's live context when the api has encryption, else our own
+  // The api server's live context when it exists, otherwise our own (a build
+  // time key, or the saved key loaded in safe mode)
   const noise::NoiseContext &noise_context_() const;
   bool noise_start_session_(uint8_t server_feature_flags);
   bool handle_noise_handshake_();
@@ -145,13 +146,15 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
 
 #ifdef USE_OTA_PASSWORD
   std::string password_;
-  std::unique_ptr<uint8_t[]> auth_buf_;
+  RAMUniquePtr<uint8_t[]> auth_buf_;
 #endif  // USE_OTA_PASSWORD
 #ifdef USE_OTA_ENCRYPTION
-#ifndef USE_OTA_ENCRYPTION_FROM_API
   noise::NoiseContext noise_ctx_;
+#ifdef USE_OTA_ENCRYPTION_PROVISIONED
+  // Backs noise_ctx_ in safe mode, where no api server holds the saved key
+  RAMUniquePtr<noise::psk_t> saved_psk_;
 #endif
-  std::unique_ptr<NoiseSession> noise_;
+  RAMUniquePtr<NoiseSession> noise_;
 #endif  // USE_OTA_ENCRYPTION
 
   socket::ListenSocket *server_{nullptr};

esphome/components/esphome/ota/ota_esphome_noise.cpp

@@ -7,7 +7,6 @@
 #include "esphome/core/log.h"
 
 #include <cstring>
-#include <new>
 
 #ifdef USE_ESP8266
 #include <pgmspace.h>
@@ -43,9 +42,8 @@ ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
 bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
   // A provisioned key cleared between the offer and here is not guarded: the
   // session runs on the zero key load_psk fills in and fails the client's MAC.
-  // Default-init: the frame buffer is written before it is read
-  // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
-  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession);
+  // Default placement, PSRAM first where present: the session only lives for one upload
+  this->noise_ = RAMAllocator<NoiseSession>().make_unique();
   static constexpr size_t PROLOGUE_ACK_LEN = 2;  // OTA_RESPONSE_OK + version
   static constexpr size_t PROLOGUE_CLIENT_FEATURES_LEN = 1;
   static constexpr size_t PROLOGUE_FEATURE_ACK_LEN = 2;  // OTA_RESPONSE_FEATURE_FLAGS + server flags

esphome/components/ethernet/__init__.py

@@ -420,7 +420,9 @@ def _validate(config: ConfigType) -> ConfigType:
 BASE_SCHEMA = cv.Schema(
     {
         cv.GenerateID(): cv.declare_id(EthernetComponent),
-        cv.Optional(CONF_MANUAL_IP): MANUAL_IP_SCHEMA,
+        cv.Optional(
+            CONF_MANUAL_IP, visibility=cv.Visibility.ADVANCED
+        ): MANUAL_IP_SCHEMA,
         cv.Optional(CONF_DOMAIN, default=".local"): cv.domain_name,
         cv.Optional(CONF_USE_ADDRESS): cv.string_strict,
         cv.Optional(CONF_MAC_ADDRESS): cv.mac_address,

esphome/components/ethernet/w5500_custom_spi.cpp

@@ -6,17 +6,21 @@
 #include <freertos/FreeRTOS.h>
 #include <freertos/semphr.h>
 #include <cstring>
-#include <new>
 
 namespace esphome::ethernet {
 
 namespace {
 
-// Per-device context returned by init() and handed back to read/write/deinit.
+// Context returned by init() and handed back to read/write/deinit. There is one W5500 per device, so a
+// single static instance replaces a heap allocation that could fail. It is always clear when init() runs:
+// esp_eth_mac_new_w5500() calls deinit() on every failure after init() succeeded, and nothing else
+// uninstalls the driver
 struct W5500CustomSpiContext {
   spi_device_handle_t handle;
   SemaphoreHandle_t lock;
 };
+// NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables) - intentional mutable state
+W5500CustomSpiContext w5500_context{};
 
 // Transfers up to the ESP32 SPI hardware FIFO size (64 bytes) stay on the polling path; larger
 // transfers (the frame payloads) use the blocking, DMA-backed transmit.
@@ -25,23 +29,20 @@ constexpr uint32_t W5500_SPI_LOCK_TIMEOUT_MS = 50;
 
 void *w5500_custom_spi_init(const void *spi_config) {
   const auto *config = static_cast<const eth_w5500_config_t *>(spi_config);
-  auto *ctx = new (std::nothrow) W5500CustomSpiContext{};
-  if (ctx == nullptr) {
-    return nullptr;
-  }
+  auto *ctx = &w5500_context;
   // The W5500 SPI frame carries the 16-bit address in the command phase and the 8-bit control
   // byte in the address phase; mirror what the stock driver configures.
   spi_device_interface_config_t devcfg = *config->spi_devcfg;
   devcfg.command_bits = 16;
   devcfg.address_bits = 8;
   if (spi_bus_add_device(config->spi_host_id, &devcfg, &ctx->handle) != ESP_OK) {
-    delete ctx;
+    ctx->handle = nullptr;
     return nullptr;
   }
   ctx->lock = xSemaphoreCreateMutex();
   if (ctx->lock == nullptr) {
     spi_bus_remove_device(ctx->handle);
-    delete ctx;
+    ctx->handle = nullptr;
     return nullptr;
   }
   return ctx;
@@ -51,7 +52,7 @@ esp_err_t w5500_custom_spi_deinit(void *spi_ctx) {
   auto *ctx = static_cast<W5500CustomSpiContext *>(spi_ctx);
   spi_bus_remove_device(ctx->handle);
   vSemaphoreDelete(ctx->lock);
-  delete ctx;
+  *ctx = {};
   return ESP_OK;
 }
 

esphome/components/ethernet_info/ethernet_info_text_sensor.h

@@ -13,6 +13,9 @@ class IPAddressEthernetInfo final : public Component,
                                     public text_sensor::TextSensor,
                                     public ethernet::EthernetIPStateListener {
  public:
+  // User provided, not "= default": `new(p) IPAddressEthernetInfo()` would zero-fill .bss that is already zero.
+  IPAddressEthernetInfo() {}
+
   void setup() override;
   void dump_config() override;
   void add_ip_sensors(uint8_t index, text_sensor::TextSensor *s) { this->ip_sensors_[index] = s; }

esphome/components/fan/fan.h

@@ -183,7 +183,7 @@ class Fan : public EntityBase {
 
   LazyCallbackManager<void()> state_callback_{};
   ESPPreferenceObject rtc_;
-  FanRestoreMode restore_mode_;
+  FanRestoreMode restore_mode_{FanRestoreMode::NO_RESTORE};
 
  private:
   /// Lazy-allocate preset modes vector (never freed — entity lives forever).

esphome/components/file/image.py

@@ -42,7 +42,7 @@ from esphome.const import (
     CONF_TYPE,
     CONF_URL,
 )
-from esphome.core import CORE, HexInt
+from esphome.core import HexInt
 from esphome.cpp_generator import MockObj, MockObjClass
 from esphome.external_files import RemoteFile
 from esphome.types import ConfigType
@@ -76,16 +76,18 @@ def compute_local_image_path(value: str | ConfigType) -> Path:
     return external_files.compute_local_file_path(DOMAIN, url)
 
 
-def local_path(value: str | ConfigType) -> str:
-    value = value[CONF_PATH] if isinstance(value, dict) else value
-    return str(CORE.relative_config_path(value))
+def local_path(value: Path | ConfigType) -> Path:
+    # cv.file_ has already resolved the path against the config dir.
+    return value[CONF_PATH] if isinstance(value, dict) else value
 
 
-def download_file(url: str, path: Path) -> str:
+def download_file(url: str, path: Path) -> Path:
     # The shared NETWORK_TIMEOUT applies; a per-caller timeout would be
     # silently ignored on a per-run memo hit anyway (memos key by path).
     external_files.download_content(url, path)
-    return str(path)
+    # Keep the Path: config-hash normalizes Path values under the data dir,
+    # which a str would dump verbatim and break the CLI/add-on comparison.
+    return path
 
 
 def _gh_svg_url_path(mdi_id: str, source: str) -> tuple[str, Path]:
@@ -93,13 +95,13 @@ def _gh_svg_url_path(mdi_id: str, source: str) -> tuple[str, Path]:
     return MDI_SOURCES[source] + mdi_id + ".svg", base_dir / f"{mdi_id}.svg"
 
 
-def download_gh_svg(value: str | ConfigType, source: str) -> str:
+def download_gh_svg(value: str | ConfigType, source: str) -> Path:
     mdi_id = value[CONF_ICON] if isinstance(value, dict) else value
     url, path = _gh_svg_url_path(mdi_id, source)
     return download_file(url, path)
 
 
-def download_image(value: str | ConfigType) -> str:
+def download_image(value: str | ConfigType) -> Path:
     value = value[CONF_URL] if isinstance(value, dict) else value
     return download_file(value, compute_local_image_path(value))
 
@@ -147,7 +149,7 @@ def _extract_entry_ref(entry: ConfigType) -> RemoteFile | None:
 PREFETCH_FILES = external_files.single_stage_prefetch(_extract_entry_ref)
 
 
-def validate_file_shorthand(value: Any) -> str:
+def validate_file_shorthand(value: Any) -> Path:
     value = cv.string_strict(value)
     if (remote := _parse_remote_shorthand(value)) is not None:
         return download_file(remote.url, remote.path)
@@ -165,7 +167,7 @@ LOCAL_SCHEMA = cv.All(
 
 
 def mdi_schema(source: str) -> cv.All:
-    def validate_mdi(value: ConfigType) -> str:
+    def validate_mdi(value: ConfigType) -> Path:
         return download_gh_svg(value, source)
 
     return cv.All(

esphome/components/gpio/binary_sensor/gpio_binary_sensor.h

@@ -47,6 +47,9 @@ class GPIOBinarySensorStore {
 
 class GPIOBinarySensor final : public binary_sensor::BinarySensor, public Component {
  public:
+  // User provided, not "= default": `new(p) GPIOBinarySensor()` would zero-fill .bss that is already zero.
+  GPIOBinarySensor() {}
+
   // No destructor needed: ESPHome components are created at boot and live forever.
   // Interrupts are only detached on reboot when memory is cleared anyway.
 
@@ -70,7 +73,7 @@ class GPIOBinarySensor final : public binary_sensor::BinarySensor, public Compon
   void loop() override;
 
  protected:
-  GPIOPin *pin_;
+  GPIOPin *pin_{nullptr};
   GPIOBinarySensorStore store_;
 };