[ci] Soft-deprecate str_sprintf/str_snprintf to prevent hidden heap allocations

esphome/components/esp32_hosted/update/esp32_hosted_update.cpp

@@ -69,10 +69,7 @@ void Esp32HostedUpdate::setup() {
   // Get coprocessor version
   esp_hosted_coprocessor_fwver_t ver_info;
   if (esp_hosted_get_coprocessor_fwversion(&ver_info) == ESP_OK) {
-    // 16 bytes: "255.255.255" (11 chars) + null + safety margin
-    char buf[16];
-    snprintf(buf, sizeof(buf), "%d.%d.%d", ver_info.major1, ver_info.minor1, ver_info.patch1);
-    this->update_info_.current_version = buf;
+    this->update_info_.current_version = str_sprintf("%d.%d.%d", ver_info.major1, ver_info.minor1, ver_info.patch1);
   } else {
     this->update_info_.current_version = "unknown";
   }

esphome/core/helpers.h

@@ -563,9 +563,11 @@ inline uint32_t fnv1_hash_object_id(const char *str, size_t len) {
 }
 
 /// snprintf-like function returning std::string of maximum length \p len (excluding null terminator).
+/// @warning Allocates heap memory. Use snprintf() with a stack buffer instead.
 std::string __attribute__((format(printf, 1, 3))) str_snprintf(const char *fmt, size_t len, ...);
 
 /// sprintf-like function returning std::string.
+/// @warning Allocates heap memory. Use snprintf() with a stack buffer instead.
 std::string __attribute__((format(printf, 1, 2))) str_sprintf(const char *fmt, ...);
 
 /// Concatenate a name with a separator and suffix using an efficient stack-based approach.

script/ci-custom.py

@@ -690,6 +690,8 @@ HEAP_ALLOCATING_HELPERS = {
     "str_truncate": "removal (function is unused)",
     "str_upper_case": "removal (function is unused)",
     "str_snake_case": "removal (function is unused)",
+    "str_sprintf": "snprintf() with a stack buffer",
+    "str_snprintf": "snprintf() with a stack buffer",
 }
 
 
@@ -706,7 +708,9 @@ HEAP_ALLOCATING_HELPERS = {
     r"get_mac_address(?!_)|"
     r"str_truncate|"
     r"str_upper_case|"
-    r"str_snake_case"
+    r"str_snake_case|"
+    r"str_sprintf|"
+    r"str_snprintf"
     r")\s*\(" + CPP_RE_EOL,
     include=cpp_include,
     exclude=[