Merge branch 'dev' into dep_sprintf

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

esphome/__main__.py

@@ -1,5 +1,6 @@
 # PYTHON_ARGCOMPLETE_OK
 import argparse
+from collections.abc import Callable
 from datetime import datetime
 import functools
 import getpass
@@ -936,11 +937,21 @@ def command_dashboard(args: ArgsProtocol) -> int | None:
     return dashboard.start_dashboard(args)
 
 
-def command_update_all(args: ArgsProtocol) -> int | None:
+def run_multiple_configs(
+    files: list, command_builder: Callable[[str], list[str]]
+) -> int:
+    """Run a command for each configuration file in a subprocess.
+
+    Args:
+        files: List of configuration files to process.
+        command_builder: Callable that takes a file path and returns a command list.
+
+    Returns:
+        Number of failed files.
+    """
     import click
 
     success = {}
-    files = list_yaml_files(args.configuration)
     twidth = 60
 
     def print_bar(middle_text):
@@ -950,17 +961,19 @@ def command_update_all(args: ArgsProtocol) -> int | None:
         safe_print(f"{half_line}{middle_text}{half_line}")
 
     for f in files:
-        safe_print(f"Updating {color(AnsiFore.CYAN, str(f))}")
+        f_path = Path(f) if not isinstance(f, Path) else f
+
+        if any(f_path.name == x for x in SECRETS_FILES):
+            _LOGGER.warning("Skipping secrets file %s", f_path)
+            continue
+
+        safe_print(f"Processing {color(AnsiFore.CYAN, str(f))}")
         safe_print("-" * twidth)
         safe_print()
-        if CORE.dashboard:
-            rc = run_external_process(
-                "esphome", "--dashboard", "run", f, "--no-logs", "--device", "OTA"
-            )
-        else:
-            rc = run_external_process(
-                "esphome", "run", f, "--no-logs", "--device", "OTA"
-            )
+
+        cmd = command_builder(f)
+        rc = run_external_process(*cmd)
+
         if rc == 0:
             print_bar(f"[{color(AnsiFore.BOLD_GREEN, 'SUCCESS')}] {str(f)}")
             success[f] = True
@@ -975,6 +988,8 @@ def command_update_all(args: ArgsProtocol) -> int | None:
     print_bar(f"[{color(AnsiFore.BOLD_WHITE, 'SUMMARY')}]")
     failed = 0
     for f in files:
+        if f not in success:
+            continue  # Skipped file
         if success[f]:
             safe_print(f"  - {str(f)}: {color(AnsiFore.GREEN, 'SUCCESS')}")
         else:
@@ -983,6 +998,17 @@ def command_update_all(args: ArgsProtocol) -> int | None:
     return failed
 
 
+def command_update_all(args: ArgsProtocol) -> int | None:
+    files = list_yaml_files(args.configuration)
+
+    def build_command(f):
+        if CORE.dashboard:
+            return ["esphome", "--dashboard", "run", f, "--no-logs", "--device", "OTA"]
+        return ["esphome", "run", f, "--no-logs", "--device", "OTA"]
+
+    return run_multiple_configs(files, build_command)
+
+
 def command_idedata(args: ArgsProtocol, config: ConfigType) -> int:
     import json
 
@@ -1533,38 +1559,48 @@ def run_esphome(argv):
 
     _LOGGER.info("ESPHome %s", const.__version__)
 
-    for conf_path in args.configuration:
-        conf_path = Path(conf_path)
-        if any(conf_path.name == x for x in SECRETS_FILES):
-            _LOGGER.warning("Skipping secrets file %s", conf_path)
-            continue
+    # Multiple configurations: use subprocesses to avoid state leakage
+    # between compilations (e.g., LVGL touchscreen state in module globals)
+    if len(args.configuration) > 1:
+        # Build command by reusing argv, replacing all configs with single file
+        # argv[0] is the program path, skip it since we prefix with "esphome"
+        def build_command(f):
+            return (
+                ["esphome"]
+                + [arg for arg in argv[1:] if arg not in args.configuration]
+                + [str(f)]
+            )
 
-        CORE.config_path = conf_path
-        CORE.dashboard = args.dashboard
+        return run_multiple_configs(args.configuration, build_command)
 
-        # For logs command, skip updating external components
-        skip_external = args.command == "logs"
-        config = read_config(
-            dict(args.substitution) if args.substitution else {},
-            skip_external_update=skip_external,
-        )
-        if config is None:
-            return 2
-        CORE.config = config
+    # Single configuration
+    conf_path = Path(args.configuration[0])
+    if any(conf_path.name == x for x in SECRETS_FILES):
+        _LOGGER.warning("Skipping secrets file %s", conf_path)
+        return 0
 
-        if args.command not in POST_CONFIG_ACTIONS:
-            safe_print(f"Unknown command {args.command}")
+    CORE.config_path = conf_path
+    CORE.dashboard = args.dashboard
 
-        try:
-            rc = POST_CONFIG_ACTIONS[args.command](args, config)
-        except EsphomeError as e:
-            _LOGGER.error(e, exc_info=args.verbose)
-            return 1
-        if rc != 0:
-            return rc
+    # For logs command, skip updating external components
+    skip_external = args.command == "logs"
+    config = read_config(
+        dict(args.substitution) if args.substitution else {},
+        skip_external_update=skip_external,
+    )
+    if config is None:
+        return 2
+    CORE.config = config
 
-        CORE.reset()
-    return 0
+    if args.command not in POST_CONFIG_ACTIONS:
+        safe_print(f"Unknown command {args.command}")
+        return 1
+
+    try:
+        return POST_CONFIG_ACTIONS[args.command](args, config)
+    except EsphomeError as e:
+        _LOGGER.error(e, exc_info=args.verbose)
+        return 1
 
 
 def main():

esphome/codegen.py

@@ -69,6 +69,7 @@ from esphome.cpp_types import (  # noqa: F401
     JsonObjectConst,
     Parented,
     PollingComponent,
+    StringRef,
     arduino_json_ns,
     bool_,
     const_char_ptr,

esphome/components/am43/am43_base.cpp

@@ -1,21 +1,12 @@
 #include "am43_base.h"
+#include "esphome/core/helpers.h"
 #include <cstring>
-#include <cstdio>
 
 namespace esphome {
 namespace am43 {
 
 const uint8_t START_PACKET[5] = {0x00, 0xff, 0x00, 0x00, 0x9a};
 
-std::string pkt_to_hex(const uint8_t *data, uint16_t len) {
-  char buf[64];
-  memset(buf, 0, 64);
-  for (int i = 0; i < len; i++)
-    sprintf(&buf[i * 2], "%02x", data[i]);
-  std::string ret = buf;
-  return ret;
-}
-
 Am43Packet *Am43Encoder::get_battery_level_request() {
   uint8_t data = 0x1;
   return this->encode_(0xA2, &data, 1);
@@ -73,7 +64,9 @@ Am43Packet *Am43Encoder::encode_(uint8_t command, uint8_t *data, uint8_t length)
   memcpy(&this->packet_.data[7], data, length);
   this->packet_.length = length + 7;
   this->checksum_();
-  ESP_LOGV("am43", "ENC(%d): 0x%s", packet_.length, pkt_to_hex(packet_.data, packet_.length).c_str());
+  char hex_buf[format_hex_size(sizeof(this->packet_.data))];
+  ESP_LOGV("am43", "ENC(%d): 0x%s", this->packet_.length,
+           format_hex_to(hex_buf, this->packet_.data, this->packet_.length));
   return &this->packet_;
 }
 
@@ -88,7 +81,8 @@ void Am43Decoder::decode(const uint8_t *data, uint16_t length) {
   this->has_set_state_response_ = false;
   this->has_position_ = false;
   this->has_pin_response_ = false;
-  ESP_LOGV("am43", "DEC(%d): 0x%s", length, pkt_to_hex(data, length).c_str());
+  char hex_buf[format_hex_size(24)];  // Max expected packet size
+  ESP_LOGV("am43", "DEC(%d): 0x%s", length, format_hex_to(hex_buf, data, length));
 
   if (length < 2 || data[0] != 0x9a)
     return;

esphome/components/anova/anova_base.cpp

@@ -18,31 +18,31 @@ AnovaPacket *AnovaCodec::clean_packet_() {
 
 AnovaPacket *AnovaCodec::get_read_device_status_request() {
   this->current_query_ = READ_DEVICE_STATUS;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_DEVICE_STATUS);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_DEVICE_STATUS);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_read_target_temp_request() {
   this->current_query_ = READ_TARGET_TEMPERATURE;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_TARGET_TEMP);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_TARGET_TEMP);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_read_current_temp_request() {
   this->current_query_ = READ_CURRENT_TEMPERATURE;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_CURRENT_TEMP);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_CURRENT_TEMP);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_read_unit_request() {
   this->current_query_ = READ_UNIT;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_UNIT);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_UNIT);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_read_data_request() {
   this->current_query_ = READ_DATA;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_DATA);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_DATA);
   return this->clean_packet_();
 }
 
@@ -50,25 +50,25 @@ AnovaPacket *AnovaCodec::get_set_target_temp_request(float temperature) {
   this->current_query_ = SET_TARGET_TEMPERATURE;
   if (this->fahrenheit_)
     temperature = ctof(temperature);
-  sprintf((char *) this->packet_.data, CMD_SET_TARGET_TEMP, temperature);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), CMD_SET_TARGET_TEMP, temperature);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_set_unit_request(char unit) {
   this->current_query_ = SET_UNIT;
-  sprintf((char *) this->packet_.data, CMD_SET_TEMP_UNIT, unit);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), CMD_SET_TEMP_UNIT, unit);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_start_request() {
   this->current_query_ = START;
-  sprintf((char *) this->packet_.data, CMD_START);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_START);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_stop_request() {
   this->current_query_ = STOP;
-  sprintf((char *) this->packet_.data, CMD_STOP);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_STOP);
   return this->clean_packet_();
 }
 

esphome/components/api/api_connection.cpp

@@ -1712,17 +1712,16 @@ void APIConnection::on_home_assistant_state_response(const HomeAssistantStateRes
     }
 
     // Create null-terminated state for callback (parse_number needs null-termination)
-    // HA state max length is 255, so 256 byte buffer covers all cases
-    char state_buf[256];
-    size_t copy_len = msg.state.size();
-    if (copy_len >= sizeof(state_buf)) {
-      copy_len = sizeof(state_buf) - 1;  // Truncate to leave space for null terminator
+    // HA state max length is 255 characters, but attributes can be much longer
+    // Use stack buffer for common case (states), heap fallback for large attributes
+    size_t state_len = msg.state.size();
+    SmallBufferWithHeapFallback<MAX_STATE_LEN + 1> state_buf_alloc(state_len + 1);
+    char *state_buf = reinterpret_cast<char *>(state_buf_alloc.get());
+    if (state_len > 0) {
+      memcpy(state_buf, msg.state.c_str(), state_len);
     }
-    if (copy_len > 0) {
-      memcpy(state_buf, msg.state.c_str(), copy_len);
-    }
-    state_buf[copy_len] = '\0';
-    it.callback(StringRef(state_buf, copy_len));
+    state_buf[state_len] = '\0';
+    it.callback(StringRef(state_buf, state_len));
   }
 }
 #endif

esphome/components/ccs811/ccs811.cpp

@@ -81,8 +81,8 @@ void CCS811Component::setup() {
            bootloader_version, application_version);
   if (this->version_ != nullptr) {
     char version[20];  // "15.15.15 (0xffff)" is 17 chars, plus NUL, plus wiggle room
-    sprintf(version, "%d.%d.%d (0x%02x)", (application_version >> 12 & 15), (application_version >> 8 & 15),
-            (application_version >> 4 & 15), application_version);
+    buf_append_printf(version, sizeof(version), 0, "%d.%d.%d (0x%02x)", (application_version >> 12 & 15),
+                      (application_version >> 8 & 15), (application_version >> 4 & 15), application_version);
     ESP_LOGD(TAG, "publishing version state: %s", version);
     this->version_->publish_state(version);
   }

esphome/components/ch422g/ch422g.cpp

@@ -133,7 +133,7 @@ bool CH422GGPIOPin::digital_read() { return this->parent_->digital_read(this->pi
 
 void CH422GGPIOPin::digital_write(bool value) { this->parent_->digital_write(this->pin_, value ^ this->inverted_); }
 size_t CH422GGPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "EXIO%u via CH422G", this->pin_);
+  return buf_append_printf(buffer, len, 0, "EXIO%u via CH422G", this->pin_);
 }
 void CH422GGPIOPin::set_flags(gpio::Flags flags) {
   flags_ = flags;

esphome/components/cse7766/cse7766.cpp

@@ -207,20 +207,24 @@ void CSE7766Component::parse_data_() {
 
 #if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERY_VERBOSE
   {
-    std::string buf = "Parsed:";
+    // Buffer: 7 + 15 + 33 + 15 + 25 = 95 chars max + null, rounded to 128 for safety margin.
+    // Float sizes with %.4f can be up to 11 chars for large values (e.g., 999999.9999).
+    char buf[128];
+    size_t pos = buf_append_printf(buf, sizeof(buf), 0, "Parsed:");
     if (have_voltage) {
-      buf += str_sprintf(" V=%fV", voltage);
+      pos = buf_append_printf(buf, sizeof(buf), pos, " V=%.4fV", voltage);
     }
     if (have_current) {
-      buf += str_sprintf(" I=%fmA (~%fmA)", current * 1000.0f, calculated_current * 1000.0f);
+      pos = buf_append_printf(buf, sizeof(buf), pos, " I=%.4fmA (~%.4fmA)", current * 1000.0f,
+                              calculated_current * 1000.0f);
     }
     if (have_power) {
-      buf += str_sprintf(" P=%fW", power);
+      pos = buf_append_printf(buf, sizeof(buf), pos, " P=%.4fW", power);
     }
     if (energy != 0.0f) {
-      buf += str_sprintf(" E=%fkWh (%u)", energy, cf_pulses);
+      buf_append_printf(buf, sizeof(buf), pos, " E=%.4fkWh (%u)", energy, cf_pulses);
     }
-    ESP_LOGVV(TAG, "%s", buf.c_str());
+    ESP_LOGVV(TAG, "%s", buf);
   }
 #endif
 }

esphome/components/daikin_arc/daikin_arc.cpp

@@ -258,8 +258,9 @@ bool DaikinArcClimate::parse_state_frame_(const uint8_t frame[]) {
   }
 
   char buf[DAIKIN_STATE_FRAME_SIZE * 3 + 1] = {0};
+  size_t pos = 0;
   for (size_t i = 0; i < DAIKIN_STATE_FRAME_SIZE; i++) {
-    sprintf(buf, "%s%02x ", buf, frame[i]);
+    pos = buf_append_printf(buf, sizeof(buf), pos, "%02x ", frame[i]);
   }
   ESP_LOGD(TAG, "FRAME %s", buf);
 
@@ -349,8 +350,9 @@ bool DaikinArcClimate::on_receive(remote_base::RemoteReceiveData data) {
   if (data.expect_item(DAIKIN_HEADER_MARK, DAIKIN_HEADER_SPACE)) {
     valid_daikin_frame = true;
     size_t bytes_count = data.size() / 2 / 8;
-    std::unique_ptr<char[]> buf(new char[bytes_count * 3 + 1]);
-    buf[0] = '\0';
+    size_t buf_size = bytes_count * 3 + 1;
+    std::unique_ptr<char[]> buf(new char[buf_size]());  // value-initialize (zero-fill)
+    size_t buf_pos = 0;
     for (size_t i = 0; i < bytes_count; i++) {
       uint8_t byte = 0;
       for (int8_t bit = 0; bit < 8; bit++) {
@@ -361,19 +363,19 @@ bool DaikinArcClimate::on_receive(remote_base::RemoteReceiveData data) {
           break;
         }
       }
-      sprintf(buf.get(), "%s%02x ", buf.get(), byte);
+      buf_pos = buf_append_printf(buf.get(), buf_size, buf_pos, "%02x ", byte);
     }
     ESP_LOGD(TAG, "WHOLE FRAME %s  size: %d", buf.get(), data.size());
   }
   if (!valid_daikin_frame) {
-    char sbuf[16 * 10 + 1];
-    sbuf[0] = '\0';
+    char sbuf[16 * 10 + 1] = {0};
+    size_t sbuf_pos = 0;
     for (size_t j = 0; j < static_cast<size_t>(data.size()); j++) {
       if ((j - 2) % 16 == 0) {
         if (j > 0) {
           ESP_LOGD(TAG, "DATA %04x: %s", (j - 16 > 0xffff ? 0 : j - 16), sbuf);
         }
-        sbuf[0] = '\0';
+        sbuf_pos = 0;
       }
       char type_ch = ' ';
       // debug_tolerance = 25%
@@ -401,9 +403,10 @@ bool DaikinArcClimate::on_receive(remote_base::RemoteReceiveData data) {
         type_ch = '0';
 
       if (abs(data[j]) > 100000) {
-        sprintf(sbuf, "%s%-5d[%c] ", sbuf, data[j] > 0 ? 99999 : -99999, type_ch);
+        sbuf_pos = buf_append_printf(sbuf, sizeof(sbuf), sbuf_pos, "%-5d[%c] ", data[j] > 0 ? 99999 : -99999, type_ch);
       } else {
-        sprintf(sbuf, "%s%-5d[%c] ", sbuf, (int) (round(data[j] / 10.) * 10), type_ch);
+        sbuf_pos =
+            buf_append_printf(sbuf, sizeof(sbuf), sbuf_pos, "%-5d[%c] ", (int) (round(data[j] / 10.) * 10), type_ch);
       }
       if (j + 1 == static_cast<size_t>(data.size())) {
         ESP_LOGD(TAG, "DATA %04x: %s", (j - 8 > 0xffff ? 0 : j - 8), sbuf);

esphome/components/dfrobot_sen0395/commands.cpp

@@ -127,7 +127,9 @@ DetRangeCfgCommand::DetRangeCfgCommand(float min1, float max1, float min2, float
     this->min2_ = min2 = this->max2_ = max2 = this->min3_ = min3 = this->max3_ = max3 = this->min4_ = min4 =
         this->max4_ = max4 = -1;
 
-    this->cmd_ = str_sprintf("detRangeCfg -1 %.0f %.0f", min1 / 0.15, max1 / 0.15);
+    char buf[72];  // max 72: "detRangeCfg -1 "(15) + 8 * (float(5) + space(1)) + null
+    snprintf(buf, sizeof(buf), "detRangeCfg -1 %.0f %.0f", min1 / 0.15, max1 / 0.15);
+    this->cmd_ = buf;
   } else if (min3 < 0 || max3 < 0) {
     this->min1_ = min1 = round(min1 / 0.15) * 0.15;
     this->max1_ = max1 = round(max1 / 0.15) * 0.15;
@@ -135,7 +137,10 @@ DetRangeCfgCommand::DetRangeCfgCommand(float min1, float max1, float min2, float
     this->max2_ = max2 = round(max2 / 0.15) * 0.15;
     this->min3_ = min3 = this->max3_ = max3 = this->min4_ = min4 = this->max4_ = max4 = -1;
 
-    this->cmd_ = str_sprintf("detRangeCfg -1 %.0f %.0f %.0f %.0f", min1 / 0.15, max1 / 0.15, min2 / 0.15, max2 / 0.15);
+    char buf[72];  // max 72: "detRangeCfg -1 "(15) + 8 * (float(5) + space(1)) + null
+    snprintf(buf, sizeof(buf), "detRangeCfg -1 %.0f %.0f %.0f %.0f", min1 / 0.15, max1 / 0.15, min2 / 0.15,
+             max2 / 0.15);
+    this->cmd_ = buf;
   } else if (min4 < 0 || max4 < 0) {
     this->min1_ = min1 = round(min1 / 0.15) * 0.15;
     this->max1_ = max1 = round(max1 / 0.15) * 0.15;
@@ -145,9 +150,10 @@ DetRangeCfgCommand::DetRangeCfgCommand(float min1, float max1, float min2, float
     this->max3_ = max3 = round(max3 / 0.15) * 0.15;
     this->min4_ = min4 = this->max4_ = max4 = -1;
 
-    this->cmd_ = str_sprintf("detRangeCfg -1 "
-                             "%.0f %.0f %.0f %.0f %.0f %.0f",
-                             min1 / 0.15, max1 / 0.15, min2 / 0.15, max2 / 0.15, min3 / 0.15, max3 / 0.15);
+    char buf[72];  // max 72: "detRangeCfg -1 "(15) + 8 * (float(5) + space(1)) + null
+    snprintf(buf, sizeof(buf), "detRangeCfg -1 %.0f %.0f %.0f %.0f %.0f %.0f", min1 / 0.15, max1 / 0.15, min2 / 0.15,
+             max2 / 0.15, min3 / 0.15, max3 / 0.15);
+    this->cmd_ = buf;
   } else {
     this->min1_ = min1 = round(min1 / 0.15) * 0.15;
     this->max1_ = max1 = round(max1 / 0.15) * 0.15;
@@ -158,10 +164,10 @@ DetRangeCfgCommand::DetRangeCfgCommand(float min1, float max1, float min2, float
     this->min4_ = min4 = round(min4 / 0.15) * 0.15;
     this->max4_ = max4 = round(max4 / 0.15) * 0.15;
 
-    this->cmd_ = str_sprintf("detRangeCfg -1 "
-                             "%.0f %.0f %.0f %.0f %.0f %.0f %.0f %.0f",
-                             min1 / 0.15, max1 / 0.15, min2 / 0.15, max2 / 0.15, min3 / 0.15, max3 / 0.15, min4 / 0.15,
-                             max4 / 0.15);
+    char buf[72];  // max 72: "detRangeCfg -1 "(15) + 8 * (float(5) + space(1)) + null
+    snprintf(buf, sizeof(buf), "detRangeCfg -1 %.0f %.0f %.0f %.0f %.0f %.0f %.0f %.0f", min1 / 0.15, max1 / 0.15,
+             min2 / 0.15, max2 / 0.15, min3 / 0.15, max3 / 0.15, min4 / 0.15, max4 / 0.15);
+    this->cmd_ = buf;
   }
 
   this->min1_ = min1;
@@ -203,7 +209,10 @@ SetLatencyCommand::SetLatencyCommand(float delay_after_detection, float delay_af
   delay_after_disappear = std::round(delay_after_disappear / 0.025f) * 0.025f;
   this->delay_after_detection_ = clamp(delay_after_detection, 0.0f, 1638.375f);
   this->delay_after_disappear_ = clamp(delay_after_disappear, 0.0f, 1638.375f);
-  this->cmd_ = str_sprintf("setLatency %.03f %.03f", this->delay_after_detection_, this->delay_after_disappear_);
+  // max 32: "setLatency "(11) + float(8) + " "(1) + float(8) + null, rounded to 32
+  char buf[32];
+  snprintf(buf, sizeof(buf), "setLatency %.03f %.03f", this->delay_after_detection_, this->delay_after_disappear_);
+  this->cmd_ = buf;
 };
 
 uint8_t SetLatencyCommand::on_message(std::string &message) {

esphome/components/dfrobot_sen0395/commands.h

@@ -75,8 +75,8 @@ class SetLatencyCommand : public Command {
 class SensorCfgStartCommand : public Command {
  public:
   SensorCfgStartCommand(bool startup_mode) : startup_mode_(startup_mode) {
-    char tmp_cmd[20] = {0};
-    sprintf(tmp_cmd, "sensorCfgStart %d", startup_mode);
+    char tmp_cmd[20];  // "sensorCfgStart " (15) + "0/1" (1) + null = 17
+    buf_append_printf(tmp_cmd, sizeof(tmp_cmd), 0, "sensorCfgStart %d", startup_mode);
     cmd_ = std::string(tmp_cmd);
   }
   uint8_t on_message(std::string &message) override;
@@ -142,8 +142,8 @@ class SensitivityCommand : public Command {
   SensitivityCommand(uint8_t sensitivity) : sensitivity_(sensitivity) {
     if (sensitivity > 9)
       sensitivity_ = sensitivity = 9;
-    char tmp_cmd[20] = {0};
-    sprintf(tmp_cmd, "setSensitivity %d", sensitivity);
+    char tmp_cmd[20];  // "setSensitivity " (15) + "0-9" (1) + null = 17
+    buf_append_printf(tmp_cmd, sizeof(tmp_cmd), 0, "setSensitivity %d", sensitivity);
     cmd_ = std::string(tmp_cmd);
   };
   uint8_t on_message(std::string &message) override;

esphome/components/dsmr/__init__.py

@@ -25,29 +25,13 @@ dsmr_ns = cg.esphome_ns.namespace("esphome::dsmr")
 Dsmr = dsmr_ns.class_("Dsmr", cg.Component, uart.UARTDevice)
 
 
-def _validate_key(value):
-    value = cv.string_strict(value)
-    parts = [value[i : i + 2] for i in range(0, len(value), 2)]
-    if len(parts) != 16:
-        raise cv.Invalid("Decryption key must consist of 16 hexadecimal numbers")
-    parts_int = []
-    if any(len(part) != 2 for part in parts):
-        raise cv.Invalid("Decryption key must be format XX")
-    for part in parts:
-        try:
-            parts_int.append(int(part, 16))
-        except ValueError:
-            # pylint: disable=raise-missing-from
-            raise cv.Invalid("Decryption key must be hex values from 00 to FF")
-
-    return "".join(f"{part:02X}" for part in parts_int)
-
-
 CONFIG_SCHEMA = cv.All(
     cv.Schema(
         {
             cv.GenerateID(): cv.declare_id(Dsmr),
-            cv.Optional(CONF_DECRYPTION_KEY): _validate_key,
+            cv.Optional(CONF_DECRYPTION_KEY): lambda value: cv.bind_key(
+                value, name="Decryption key"
+            ),
             cv.Optional(CONF_CRC_CHECK, default=True): cv.boolean,
             cv.Optional(CONF_GAS_MBUS_ID, default=1): cv.int_,
             cv.Optional(CONF_WATER_MBUS_ID, default=2): cv.int_,

esphome/components/dsmr/dsmr.cpp

@@ -1,4 +1,5 @@
 #include "dsmr.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 #include <AES.h>
@@ -294,8 +295,8 @@ void Dsmr::dump_config() {
   DSMR_TEXT_SENSOR_LIST(DSMR_LOG_TEXT_SENSOR, )
 }
 
-void Dsmr::set_decryption_key(const std::string &decryption_key) {
-  if (decryption_key.empty()) {
+void Dsmr::set_decryption_key(const char *decryption_key) {
+  if (decryption_key == nullptr || decryption_key[0] == '\0') {
     ESP_LOGI(TAG, "Disabling decryption");
     this->decryption_key_.clear();
     if (this->crypt_telegram_ != nullptr) {
@@ -305,21 +306,15 @@ void Dsmr::set_decryption_key(const std::string &decryption_key) {
     return;
   }
 
-  if (decryption_key.length() != 32) {
-    ESP_LOGE(TAG, "Error, decryption key must be 32 character long");
+  if (!parse_hex(decryption_key, this->decryption_key_, 16)) {
+    ESP_LOGE(TAG, "Error, decryption key must be 32 hex characters");
+    this->decryption_key_.clear();
     return;
   }
-  this->decryption_key_.clear();
 
   ESP_LOGI(TAG, "Decryption key is set");
   // Verbose level prints decryption key
-  ESP_LOGV(TAG, "Using decryption key: %s", decryption_key.c_str());
-
-  char temp[3] = {0};
-  for (int i = 0; i < 16; i++) {
-    strncpy(temp, &(decryption_key.c_str()[i * 2]), 2);
-    this->decryption_key_.push_back(std::strtoul(temp, nullptr, 16));
-  }
+  ESP_LOGV(TAG, "Using decryption key: %s", decryption_key);
 
   if (this->crypt_telegram_ == nullptr) {
     this->crypt_telegram_ = new uint8_t[this->max_telegram_len_];  // NOLINT

esphome/components/dsmr/dsmr.h

@@ -63,7 +63,7 @@ class Dsmr : public Component, public uart::UARTDevice {
 
   void dump_config() override;
 
-  void set_decryption_key(const std::string &decryption_key);
+  void set_decryption_key(const char *decryption_key);
   void set_max_telegram_length(size_t length) { this->max_telegram_len_ = length; }
   void set_request_pin(GPIOPin *request_pin) { this->request_pin_ = request_pin; }
   void set_request_interval(uint32_t interval) { this->request_interval_ = interval; }

esphome/components/esp32_ble/ble_uuid.h

@@ -46,6 +46,8 @@ class ESPBTUUID {
 
   esp_bt_uuid_t get_uuid() const;
 
+  // Remove before 2026.8.0
+  ESPDEPRECATED("Use to_str() instead. Removed in 2026.8.0", "2026.2.0")
   std::string to_string() const;
   const char *to_str(std::span<char, UUID_STR_LEN> output) const;
 

esphome/components/esp32_hosted/update/esp32_hosted_update.cpp

@@ -69,7 +69,10 @@ void Esp32HostedUpdate::setup() {
   // Get coprocessor version
   esp_hosted_coprocessor_fwver_t ver_info;
   if (esp_hosted_get_coprocessor_fwversion(&ver_info) == ESP_OK) {
-    this->update_info_.current_version = str_sprintf("%d.%d.%d", ver_info.major1, ver_info.minor1, ver_info.patch1);
+    // 16 bytes: "255.255.255" (11 chars) + null + safety margin
+    char buf[16];
+    snprintf(buf, sizeof(buf), "%d.%d.%d", ver_info.major1, ver_info.minor1, ver_info.patch1);
+    this->update_info_.current_version = buf;
   } else {
     this->update_info_.current_version = "unknown";
   }

esphome/components/esp8266/core.cpp

@@ -6,7 +6,11 @@
 #include "esphome/core/helpers.h"
 #include "preferences.h"
 #include <Arduino.h>
-#include <Esp.h>
+#include <core_esp8266_features.h>
+
+extern "C" {
+#include <user_interface.h>
+}
 
 namespace esphome {
 
@@ -16,23 +20,19 @@ void IRAM_ATTR HOT delay(uint32_t ms) { ::delay(ms); }
 uint32_t IRAM_ATTR HOT micros() { return ::micros(); }
 void IRAM_ATTR HOT delayMicroseconds(uint32_t us) { delay_microseconds_safe(us); }
 void arch_restart() {
-  ESP.restart();  // NOLINT(readability-static-accessed-through-instance)
+  system_restart();
   // restart() doesn't always end execution
   while (true) {  // NOLINT(clang-diagnostic-unreachable-code)
     yield();
   }
 }
 void arch_init() {}
-void IRAM_ATTR HOT arch_feed_wdt() {
-  ESP.wdtFeed();  // NOLINT(readability-static-accessed-through-instance)
-}
+void IRAM_ATTR HOT arch_feed_wdt() { system_soft_wdt_feed(); }
 
 uint8_t progmem_read_byte(const uint8_t *addr) {
   return pgm_read_byte(addr);  // NOLINT
 }
-uint32_t IRAM_ATTR HOT arch_get_cpu_cycle_count() {
-  return ESP.getCycleCount();  // NOLINT(readability-static-accessed-through-instance)
-}
+uint32_t IRAM_ATTR HOT arch_get_cpu_cycle_count() { return esp_get_cycle_count(); }
 uint32_t arch_get_cpu_freq_hz() { return F_CPU; }
 
 void force_link_symbols() {

esphome/components/esp8266/gpio.cpp

@@ -99,7 +99,7 @@ void ESP8266GPIOPin::pin_mode(gpio::Flags flags) {
 }
 
 size_t ESP8266GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "GPIO%u", this->pin_);
+  return buf_append_printf(buffer, len, 0, "GPIO%u", this->pin_);
 }
 
 bool ESP8266GPIOPin::digital_read() {

esphome/components/event/__init__.py

@@ -90,9 +90,7 @@ async def setup_event_core_(var, config, *, event_types: list[str]):
 
     for conf in config.get(CONF_ON_EVENT, []):
         trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        await automation.build_automation(
-            trigger, [(cg.std_string, "event_type")], conf
-        )
+        await automation.build_automation(trigger, [(cg.StringRef, "event_type")], conf)
 
     cg.add(var.set_event_types(event_types))
 

esphome/components/event/automation.h

@@ -14,10 +14,10 @@ template<typename... Ts> class TriggerEventAction : public Action<Ts...>, public
   void play(const Ts &...x) override { this->parent_->trigger(this->event_type_.value(x...)); }
 };
 
-class EventTrigger : public Trigger<std::string> {
+class EventTrigger : public Trigger<StringRef> {
  public:
   EventTrigger(Event *event) {
-    event->add_on_event_callback([this](const std::string &event_type) { this->trigger(event_type); });
+    event->add_on_event_callback([this](StringRef event_type) { this->trigger(event_type); });
   }
 };
 

esphome/components/event/event.cpp

@@ -23,7 +23,7 @@ void Event::trigger(const std::string &event_type) {
   }
   this->last_event_type_ = found;
   ESP_LOGD(TAG, "'%s' >> '%s'", this->get_name().c_str(), this->last_event_type_);
-  this->event_callback_.call(event_type);
+  this->event_callback_.call(StringRef(found));
 #if defined(USE_EVENT) && defined(USE_CONTROLLER_REGISTRY)
   ControllerRegistry::notify_event(this);
 #endif
@@ -45,7 +45,7 @@ void Event::set_event_types(const std::vector<const char *> &event_types) {
   this->last_event_type_ = nullptr;  // Reset when types change
 }
 
-void Event::add_on_event_callback(std::function<void(const std::string &event_type)> &&callback) {
+void Event::add_on_event_callback(std::function<void(StringRef event_type)> &&callback) {
   this->event_callback_.add(std::move(callback));
 }
 

esphome/components/event/event.h

@@ -70,10 +70,10 @@ class Event : public EntityBase, public EntityBase_DeviceClass {
   /// Check if an event has been triggered.
   bool has_event() const { return this->last_event_type_ != nullptr; }
 
-  void add_on_event_callback(std::function<void(const std::string &event_type)> &&callback);
+  void add_on_event_callback(std::function<void(StringRef event_type)> &&callback);
 
  protected:
-  LazyCallbackManager<void(const std::string &event_type)> event_callback_;
+  LazyCallbackManager<void(StringRef event_type)> event_callback_;
   FixedVector<const char *> types_;
 
  private:

esphome/components/ezo/ezo.cpp

@@ -160,7 +160,7 @@ void EZOSensor::loop() {
   this->commands_.pop_front();
 }
 
-void EZOSensor::add_command_(const std::string &command, EzoCommandType command_type, uint16_t delay_ms) {
+void EZOSensor::add_command_(const char *command, EzoCommandType command_type, uint16_t delay_ms) {
   std::unique_ptr<EzoCommand> ezo_command(new EzoCommand);
   ezo_command->command = command;
   ezo_command->command_type = command_type;
@@ -169,13 +169,17 @@ void EZOSensor::add_command_(const std::string &command, EzoCommandType command_
 }
 
 void EZOSensor::set_calibration_point_(EzoCalibrationType type, float value) {
-  std::string payload = str_sprintf("Cal,%s,%0.2f", EZO_CALIBRATION_TYPE_STRINGS[type], value);
+  // max 21: "Cal,"(4) + type(4) + ","(1) + float(11) + null; use 24 for safety
+  char payload[24];
+  snprintf(payload, sizeof(payload), "Cal,%s,%0.2f", EZO_CALIBRATION_TYPE_STRINGS[type], value);
   this->add_command_(payload, EzoCommandType::EZO_CALIBRATION, 900);
 }
 
 void EZOSensor::set_address(uint8_t address) {
   if (address > 0 && address < 128) {
-    std::string payload = str_sprintf("I2C,%u", address);
+    // max 8: "I2C,"(4) + uint8(3) + null
+    char payload[8];
+    snprintf(payload, sizeof(payload), "I2C,%u", address);
     this->new_address_ = address;
     this->add_command_(payload, EzoCommandType::EZO_I2C);
   } else {
@@ -194,7 +198,9 @@ void EZOSensor::get_slope() { this->add_command_("Slope,?", EzoCommandType::EZO_
 void EZOSensor::get_t() { this->add_command_("T,?", EzoCommandType::EZO_T); }
 
 void EZOSensor::set_t(float value) {
-  std::string payload = str_sprintf("T,%0.2f", value);
+  // max 14 bytes: "T,"(2) + float with "%0.2f" (up to 11 chars) + null(1); use 16 for alignment
+  char payload[16];
+  snprintf(payload, sizeof(payload), "T,%0.2f", value);
   this->add_command_(payload, EzoCommandType::EZO_T);
 }
 
@@ -215,7 +221,9 @@ void EZOSensor::set_calibration_point_high(float value) {
 }
 
 void EZOSensor::set_calibration_generic(float value) {
-  std::string payload = str_sprintf("Cal,%0.2f", value);
+  // exact 16 bytes: "Cal," (4) + float with "%0.2f" (up to 11 chars, e.g. "-9999999.99") + null (1) = 16
+  char payload[16];
+  snprintf(payload, sizeof(payload), "Cal,%0.2f", value);
   this->add_command_(payload, EzoCommandType::EZO_CALIBRATION, 900);
 }
 
@@ -223,13 +231,11 @@ void EZOSensor::clear_calibration() { this->add_command_("Cal,clear", EzoCommand
 
 void EZOSensor::get_led_state() { this->add_command_("L,?", EzoCommandType::EZO_LED); }
 
-void EZOSensor::set_led_state(bool on) {
-  std::string to_send = "L,";
-  to_send += on ? "1" : "0";
-  this->add_command_(to_send, EzoCommandType::EZO_LED);
-}
+void EZOSensor::set_led_state(bool on) { this->add_command_(on ? "L,1" : "L,0", EzoCommandType::EZO_LED); }
 
-void EZOSensor::send_custom(const std::string &to_send) { this->add_command_(to_send, EzoCommandType::EZO_CUSTOM); }
+void EZOSensor::send_custom(const std::string &to_send) {
+  this->add_command_(to_send.c_str(), EzoCommandType::EZO_CUSTOM);
+}
 
 }  // namespace ezo
 }  // namespace esphome

esphome/components/ezo/ezo.h

@@ -92,7 +92,7 @@ class EZOSensor : public sensor::Sensor, public PollingComponent, public i2c::I2
   std::deque<std::unique_ptr<EzoCommand>> commands_;
   int new_address_;
 
-  void add_command_(const std::string &command, EzoCommandType command_type, uint16_t delay_ms = 300);
+  void add_command_(const char *command, EzoCommandType command_type, uint16_t delay_ms = 300);
 
   void set_calibration_point_(EzoCalibrationType type, float value);
 

esphome/components/ezo_pmp/ezo_pmp.cpp

@@ -318,90 +318,93 @@ void EzoPMP::send_next_command_() {
   switch (this->next_command_) {
     // Read Commands
     case EZO_PMP_COMMAND_READ_DOSING:  // Page 54
-      command_buffer_length = sprintf((char *) command_buffer, "D,?");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "D,?");
       break;
 
     case EZO_PMP_COMMAND_READ_SINGLE_REPORT:  // Single Report (page 53)
-      command_buffer_length = sprintf((char *) command_buffer, "R");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "R");
       break;
 
     case EZO_PMP_COMMAND_READ_MAX_FLOW_RATE:
-      command_buffer_length = sprintf((char *) command_buffer, "DC,?");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "DC,?");
       break;
 
     case EZO_PMP_COMMAND_READ_PAUSE_STATUS:
-      command_buffer_length = sprintf((char *) command_buffer, "P,?");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "P,?");
       break;
 
     case EZO_PMP_COMMAND_READ_TOTAL_VOLUME_DOSED:
-      command_buffer_length = sprintf((char *) command_buffer, "TV,?");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "TV,?");
       break;
 
     case EZO_PMP_COMMAND_READ_ABSOLUTE_TOTAL_VOLUME_DOSED:
-      command_buffer_length = sprintf((char *) command_buffer, "ATV,?");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "ATV,?");
       break;
 
     case EZO_PMP_COMMAND_READ_CALIBRATION_STATUS:
-      command_buffer_length = sprintf((char *) command_buffer, "Cal,?");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "Cal,?");
       break;
 
     case EZO_PMP_COMMAND_READ_PUMP_VOLTAGE:
-      command_buffer_length = sprintf((char *) command_buffer, "PV,?");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "PV,?");
       break;
 
       // Non-Read Commands
 
     case EZO_PMP_COMMAND_FIND:  // Find (page 52)
-      command_buffer_length = sprintf((char *) command_buffer, "Find");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "Find");
       wait_time_for_command = 60000;  // This command will block all updates for a minute
       break;
 
     case EZO_PMP_COMMAND_DOSE_CONTINUOUSLY:  // Continuous Dispensing (page 54)
-      command_buffer_length = sprintf((char *) command_buffer, "D,*");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "D,*");
       break;
 
     case EZO_PMP_COMMAND_CLEAR_TOTAL_VOLUME_DOSED:  // Clear Total Volume Dosed (page 64)
-      command_buffer_length = sprintf((char *) command_buffer, "Clear");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "Clear");
       break;
 
     case EZO_PMP_COMMAND_CLEAR_CALIBRATION:  // Clear Calibration (page 65)
-      command_buffer_length = sprintf((char *) command_buffer, "Cal,clear");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "Cal,clear");
       break;
 
     case EZO_PMP_COMMAND_PAUSE_DOSING:  // Pause (page 61)
-      command_buffer_length = sprintf((char *) command_buffer, "P");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "P");
       break;
 
     case EZO_PMP_COMMAND_STOP_DOSING:  // Stop (page 62)
-      command_buffer_length = sprintf((char *) command_buffer, "X");
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "X");
       break;
 
       // Non-Read commands with parameters
 
     case EZO_PMP_COMMAND_DOSE_VOLUME:  // Volume Dispensing (page 55)
-      command_buffer_length = sprintf((char *) command_buffer, "D,%0.1f", this->next_command_volume_);
+      command_buffer_length =
+          snprintf((char *) command_buffer, sizeof(command_buffer), "D,%0.1f", this->next_command_volume_);
       break;
 
     case EZO_PMP_COMMAND_DOSE_VOLUME_OVER_TIME:  // Dose over time (page 56)
-      command_buffer_length =
-          sprintf((char *) command_buffer, "D,%0.1f,%i", this->next_command_volume_, this->next_command_duration_);
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "D,%0.1f,%i",
+                                       this->next_command_volume_, this->next_command_duration_);
       break;
 
     case EZO_PMP_COMMAND_DOSE_WITH_CONSTANT_FLOW_RATE:  // Constant Flow Rate (page 57)
-      command_buffer_length =
-          sprintf((char *) command_buffer, "DC,%0.1f,%i", this->next_command_volume_, this->next_command_duration_);
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "DC,%0.1f,%i",
+                                       this->next_command_volume_, this->next_command_duration_);
       break;
 
     case EZO_PMP_COMMAND_SET_CALIBRATION_VOLUME:  // Set Calibration Volume (page 65)
-      command_buffer_length = sprintf((char *) command_buffer, "Cal,%0.2f", this->next_command_volume_);
+      command_buffer_length =
+          snprintf((char *) command_buffer, sizeof(command_buffer), "Cal,%0.2f", this->next_command_volume_);
       break;
 
     case EZO_PMP_COMMAND_CHANGE_I2C_ADDRESS:  // Change I2C Address (page 73)
-      command_buffer_length = sprintf((char *) command_buffer, "I2C,%i", this->next_command_duration_);
+      command_buffer_length =
+          snprintf((char *) command_buffer, sizeof(command_buffer), "I2C,%i", this->next_command_duration_);
       break;
 
     case EZO_PMP_COMMAND_EXEC_ARBITRARY_COMMAND_ADDRESS:  // Run an arbitrary command
-      command_buffer_length = sprintf((char *) command_buffer, this->arbitrary_command_, this->next_command_duration_);
+      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "%s", this->arbitrary_command_);
       ESP_LOGI(TAG, "Sending arbitrary command: %s", (char *) command_buffer);
       break;
 

esphome/components/fan/__init__.py

@@ -77,7 +77,7 @@ FanSpeedSetTrigger = fan_ns.class_(
     "FanSpeedSetTrigger", automation.Trigger.template(cg.int_)
 )
 FanPresetSetTrigger = fan_ns.class_(
-    "FanPresetSetTrigger", automation.Trigger.template(cg.std_string)
+    "FanPresetSetTrigger", automation.Trigger.template(cg.StringRef)
 )
 
 FanIsOnCondition = fan_ns.class_("FanIsOnCondition", automation.Condition.template())
@@ -287,7 +287,7 @@ async def setup_fan_core_(var, config):
         await automation.build_automation(trigger, [(cg.int_, "x")], conf)
     for conf in config.get(CONF_ON_PRESET_SET, []):
         trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        await automation.build_automation(trigger, [(cg.std_string, "x")], conf)
+        await automation.build_automation(trigger, [(cg.StringRef, "x")], conf)
 
 
 async def register_fan(var, config):

esphome/components/fan/automation.h

@@ -208,7 +208,7 @@ class FanSpeedSetTrigger : public Trigger<int> {
   int last_speed_;
 };
 
-class FanPresetSetTrigger : public Trigger<std::string> {
+class FanPresetSetTrigger : public Trigger<StringRef> {
  public:
   FanPresetSetTrigger(Fan *state) {
     state->add_on_state_callback([this, state]() {
@@ -216,7 +216,7 @@ class FanPresetSetTrigger : public Trigger<std::string> {
       auto should_trigger = preset_mode != this->last_preset_mode_;
       this->last_preset_mode_ = preset_mode;
       if (should_trigger) {
-        this->trigger(std::string(preset_mode));
+        this->trigger(preset_mode);
       }
     });
     this->last_preset_mode_ = state->get_preset_mode();

esphome/components/gdk101/gdk101.cpp

@@ -163,9 +163,10 @@ bool GDK101Component::read_fw_version_(uint8_t *data) {
       return false;
     }
 
-    const std::string fw_version_str = str_sprintf("%d.%d", data[0], data[1]);
-
-    this->fw_version_text_sensor_->publish_state(fw_version_str);
+    // max 8: "255.255" (7 chars) + null
+    char buf[8];
+    snprintf(buf, sizeof(buf), "%d.%d", data[0], data[1]);
+    this->fw_version_text_sensor_->publish_state(buf);
   }
 #endif  // USE_TEXT_SENSOR
   return true;

esphome/components/homeassistant/number/homeassistant_number.cpp

@@ -97,7 +97,7 @@ void HomeassistantNumber::control(float value) {
   entity_value.key = VALUE_KEY;
   // Stack buffer - no heap allocation; %g produces shortest representation
   char value_buf[16];
-  snprintf(value_buf, sizeof(value_buf), "%g", value);
+  buf_append_printf(value_buf, sizeof(value_buf), 0, "%g", value);
   entity_value.value = StringRef(value_buf);
 
   api::global_api_server->send_homeassistant_action(resp);

esphome/components/i2c/i2c.cpp

@@ -42,8 +42,8 @@ ErrorCode I2CDevice::read_register16(uint16_t a_register, uint8_t *data, size_t
 }
 
 ErrorCode I2CDevice::write_register(uint8_t a_register, const uint8_t *data, size_t len) const {
-  SmallBufferWithHeapFallback<17> buffer_alloc;  // Most I2C writes are <= 16 bytes
-  uint8_t *buffer = buffer_alloc.get(len + 1);
+  SmallBufferWithHeapFallback<17> buffer_alloc(len + 1);  // Most I2C writes are <= 16 bytes
+  uint8_t *buffer = buffer_alloc.get();
 
   buffer[0] = a_register;
   std::copy(data, data + len, buffer + 1);
@@ -51,8 +51,8 @@ ErrorCode I2CDevice::write_register(uint8_t a_register, const uint8_t *data, siz
 }
 
 ErrorCode I2CDevice::write_register16(uint16_t a_register, const uint8_t *data, size_t len) const {
-  SmallBufferWithHeapFallback<18> buffer_alloc;  // Most I2C writes are <= 16 bytes + 2 for register
-  uint8_t *buffer = buffer_alloc.get(len + 2);
+  SmallBufferWithHeapFallback<18> buffer_alloc(len + 2);  // Most I2C writes are <= 16 bytes + 2 for register
+  uint8_t *buffer = buffer_alloc.get();
 
   buffer[0] = a_register >> 8;
   buffer[1] = a_register;

esphome/components/i2c/i2c_bus.h

@@ -11,22 +11,6 @@
 namespace esphome {
 namespace i2c {
 
-/// @brief Helper class for efficient buffer allocation - uses stack for small sizes, heap for large
-template<size_t STACK_SIZE> class SmallBufferWithHeapFallback {
- public:
-  uint8_t *get(size_t size) {
-    if (size <= STACK_SIZE) {
-      return this->stack_buffer_;
-    }
-    this->heap_buffer_ = std::unique_ptr<uint8_t[]>(new uint8_t[size]);
-    return this->heap_buffer_.get();
-  }
-
- private:
-  uint8_t stack_buffer_[STACK_SIZE];
-  std::unique_ptr<uint8_t[]> heap_buffer_;
-};
-
 /// @brief Error codes returned by I2CBus and I2CDevice methods
 enum ErrorCode {
   NO_ERROR = 0,                ///< No error found during execution of method
@@ -92,8 +76,8 @@ class I2CBus {
       total_len += read_buffers[i].len;
     }
 
-    SmallBufferWithHeapFallback<128> buffer_alloc;  // Most I2C reads are small
-    uint8_t *buffer = buffer_alloc.get(total_len);
+    SmallBufferWithHeapFallback<128> buffer_alloc(total_len);  // Most I2C reads are small
+    uint8_t *buffer = buffer_alloc.get();
 
     auto err = this->write_readv(address, nullptr, 0, buffer, total_len);
     if (err != ERROR_OK)
@@ -116,8 +100,8 @@ class I2CBus {
       total_len += write_buffers[i].len;
     }
 
-    SmallBufferWithHeapFallback<128> buffer_alloc;  // Most I2C writes are small
-    uint8_t *buffer = buffer_alloc.get(total_len);
+    SmallBufferWithHeapFallback<128> buffer_alloc(total_len);  // Most I2C writes are small
+    uint8_t *buffer = buffer_alloc.get();
 
     size_t pos = 0;
     for (size_t i = 0; i != count; i++) {

esphome/components/lightwaverf/lightwaverf.cpp

@@ -1,3 +1,4 @@
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 #ifdef USE_ESP8266
@@ -44,13 +45,16 @@ void LightWaveRF::send_rx(const std::vector<uint8_t> &msg, uint8_t repeats, bool
 }
 
 void LightWaveRF::print_msg_(uint8_t *msg, uint8_t len) {
-  char buffer[65];
+#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_DEBUG
+  char buffer[65];  // max 10 entries * 6 chars + null
   ESP_LOGD(TAG, " Received code (len:%i): ", len);
 
+  size_t pos = 0;
   for (int i = 0; i < len; i++) {
-    sprintf(&buffer[i * 6], "0x%02x, ", msg[i]);
+    pos = buf_append_printf(buffer, sizeof(buffer), pos, "0x%02x, ", msg[i]);
   }
   ESP_LOGD(TAG, "[%s]", buffer);
+#endif
 }
 
 void LightWaveRF::dump_config() {

esphome/components/max6956/max6956.cpp

@@ -162,7 +162,7 @@ void MAX6956GPIOPin::pin_mode(gpio::Flags flags) { this->parent_->pin_mode(this-
 bool MAX6956GPIOPin::digital_read() { return this->parent_->digital_read(this->pin_) != this->inverted_; }
 void MAX6956GPIOPin::digital_write(bool value) { this->parent_->digital_write(this->pin_, value != this->inverted_); }
 size_t MAX6956GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via Max6956", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via Max6956", this->pin_);
 }
 
 }  // namespace max6956

esphome/components/mcp23016/mcp23016.cpp

@@ -100,7 +100,7 @@ void MCP23016GPIOPin::pin_mode(gpio::Flags flags) { this->parent_->pin_mode(this
 bool MCP23016GPIOPin::digital_read() { return this->parent_->digital_read(this->pin_) != this->inverted_; }
 void MCP23016GPIOPin::digital_write(bool value) { this->parent_->digital_write(this->pin_, value != this->inverted_); }
 size_t MCP23016GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via MCP23016", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via MCP23016", this->pin_);
 }
 
 }  // namespace mcp23016

esphome/components/mcp23xxx_base/mcp23xxx_base.cpp

@@ -17,7 +17,7 @@ template<uint8_t N> void MCP23XXXGPIOPin<N>::digital_write(bool value) {
   this->parent_->digital_write(this->pin_, value != this->inverted_);
 }
 template<uint8_t N> size_t MCP23XXXGPIOPin<N>::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via MCP23XXX", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via MCP23XXX", this->pin_);
 }
 
 template class MCP23XXXGPIOPin<8>;

esphome/components/mipi_spi/mipi_spi.h

@@ -224,12 +224,9 @@ class MipiSpi : public display::Display,
                     this->madctl_ & MADCTL_BGR ? "BGR" : "RGB", DISPLAYPIXEL * 8, IS_BIG_ENDIAN ? "Big" : "Little");
     if (this->brightness_.has_value())
       esph_log_config(TAG, "  Brightness: %u", this->brightness_.value());
-    if (this->cs_ != nullptr)
-      esph_log_config(TAG, "  CS Pin: %s", this->cs_->dump_summary().c_str());
-    if (this->reset_pin_ != nullptr)
-      esph_log_config(TAG, "  Reset Pin: %s", this->reset_pin_->dump_summary().c_str());
-    if (this->dc_pin_ != nullptr)
-      esph_log_config(TAG, "  DC Pin: %s", this->dc_pin_->dump_summary().c_str());
+    log_pin(TAG, "  CS Pin: ", this->cs_);
+    log_pin(TAG, "  Reset Pin: ", this->reset_pin_);
+    log_pin(TAG, "  DC Pin: ", this->dc_pin_);
     esph_log_config(TAG,
                     "  SPI Mode: %d\n"
                     "  SPI Data rate: %dMHz\n"

esphome/components/mipi_spi/models/adafruit.py

@@ -26,5 +26,3 @@ ST7789V.extend(
     reset_pin=40,
     invert_colors=True,
 )
-
-models = {}

esphome/components/mipi_spi/models/amoled.py

@@ -105,6 +105,3 @@ CO5300 = DriverChip(
         (WCE, 0x00),
     ),
 )
-
-
-models = {}

esphome/components/mipi_spi/models/cyd.py

@@ -1,10 +1,45 @@
-from .ili import ILI9341
+from .ili import ILI9341, ILI9342, ST7789V
 
 ILI9341.extend(
+    # ESP32-2432S028 CYD board with Micro USB, has ILI9341 controller
     "ESP32-2432S028",
     data_rate="40MHz",
-    cs_pin=15,
-    dc_pin=2,
+    cs_pin={"number": 15, "ignore_strapping_warning": True},
+    dc_pin={"number": 2, "ignore_strapping_warning": True},
 )
 
-models = {}
+ST7789V.extend(
+    # ESP32-2432S028 CYD board with USB C + Micro USB, has ST7789V controller
+    "ESP32-2432S028-7789",
+    data_rate="40MHz",
+    cs_pin={"number": 15, "ignore_strapping_warning": True},
+    dc_pin={"number": 2, "ignore_strapping_warning": True},
+)
+
+# fmt: off
+
+ILI9342.extend(
+    # ESP32-2432S028 CYD board with USB C + Micro USB, has ILI9342 controller
+    "ESP32-2432S028-9342",
+    data_rate="40MHz",
+    cs_pin={"number": 15, "ignore_strapping_warning": True},
+    dc_pin={"number": 2, "ignore_strapping_warning": True},
+    initsequence=(
+        (0xCB, 0x39, 0x2C, 0x00, 0x34, 0x02),  # Power Control A
+        (0xCF, 0x00, 0xC1, 0x30),  # Power Control B
+        (0xE8, 0x85, 0x00, 0x78),  # Driver timing control A
+        (0xEA, 0x00, 0x00),  # Driver timing control B
+        (0xED, 0x64, 0x03, 0x12, 0x81),  # Power on sequence control
+        (0xF7, 0x20),  # Pump ratio control
+        (0xC0, 0x23),  # Power Control 1
+        (0xC1, 0x10),  # Power Control 2
+        (0xC5, 0x3E, 0x28),  # VCOM Control 1
+        (0xC7, 0x86),  # VCOM Control 2
+        (0xB1, 0x00, 0x1B),  # Frame Rate Control
+        (0xB6, 0x0A, 0xA2, 0x27, 0x00),  # Display Function Control
+        (0xF2, 0x00),  # Enable 3G
+        (0x26, 0x01),  # Gamma Set
+        (0xE0, 0x00, 0x0C, 0x11, 0x04, 0x11, 0x08, 0x37, 0x89, 0x4C, 0x06, 0x0C, 0x0A, 0x2E, 0x34, 0x0F),  # Positive Gamma Correction
+        (0xE1, 0x00, 0x0B, 0x11, 0x05, 0x13, 0x09, 0x33, 0x67, 0x48, 0x07, 0x0E, 0x0B, 0x23, 0x33, 0x0F),  # Negative Gamma Correction
+    )
+)

esphome/components/mipi_spi/models/ili.py

@@ -148,6 +148,34 @@ ILI9341 = DriverChip(
         ),
     ),
 )
+
+# fmt: off
+
+ILI9342 = DriverChip(
+    "ILI9342",
+    width=320,
+    height=240,
+    mirror_x=True,
+    initsequence=(
+        (0xCB, 0x39, 0x2C, 0x00, 0x34, 0x02),  # Power Control A
+        (0xCF, 0x00, 0xC1, 0x30),  # Power Control B
+        (0xE8, 0x85, 0x00, 0x78),  # Driver timing control A
+        (0xEA, 0x00, 0x00),  # Driver timing control B
+        (0xED, 0x64, 0x03, 0x12, 0x81),  # Power on sequence control
+        (0xF7, 0x20),  # Pump ratio control
+        (0xC0, 0x23),  # Power Control 1
+        (0xC1, 0x10),  # Power Control 2
+        (0xC5, 0x3E, 0x28),  # VCOM Control 1
+        (0xC7, 0x86),  # VCOM Control 2
+        (0xB1, 0x00, 0x1B),  # Frame Rate Control
+        (0xB6, 0x0A, 0xA2, 0x27, 0x00),  # Display Function Control
+        (0xF2, 0x00),  # Enable 3G
+        (0x26, 0x01),  # Gamma Set
+        (0xE0, 0x0F, 0x1F, 0x1C, 0x0C, 0x0F, 0x08, 0x48, 0x98, 0x37, 0x0A, 0x13, 0x04, 0x11, 0x0D, 0x00),  # Positive Gamma
+        (0xE1, 0x0F, 0x32, 0x2E, 0x0B, 0x0D, 0x05, 0x47, 0x75, 0x37, 0x06, 0x10, 0x03, 0x24, 0x20, 0x00),  # Negative Gamma
+    ),
+)
+
 # M5Stack Core2 uses ILI9341 chip - mirror_x disabled for correct orientation
 ILI9341.extend(
     "M5CORE2",
@@ -758,5 +786,3 @@ ST7796.extend(
     dc_pin=0,
     invert_colors=True,
 )
-
-models = {}

esphome/components/mipi_spi/models/jc.py

@@ -588,5 +588,3 @@ DriverChip(
         (0x29, 0x00),
     ),
 )
-
-models = {}

esphome/components/mipi_spi/models/lanbon.py

@@ -11,5 +11,3 @@ ST7789V.extend(
     dc_pin=21,
     reset_pin=18,
 )
-
-models = {}

esphome/components/mipi_spi/models/lilygo.py

@@ -56,5 +56,3 @@ ST7796.extend(
     backlight_pin=48,
     invert_colors=True,
 )
-
-models = {}

esphome/components/mpr121/mpr121.cpp

@@ -154,7 +154,7 @@ void MPR121GPIOPin::digital_write(bool value) {
 }
 
 size_t MPR121GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "ELE%u on MPR121", this->pin_);
+  return buf_append_printf(buffer, len, 0, "ELE%u on MPR121", this->pin_);
 }
 
 }  // namespace mpr121

esphome/components/mqtt/mqtt_client.cpp

@@ -5,6 +5,7 @@
 #include <utility>
 #include "esphome/components/network/util.h"
 #include "esphome/core/application.h"
+#include "esphome/core/entity_base.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/version.h"
@@ -66,10 +67,13 @@ void MQTTClientComponent::setup() {
         "esphome/discover", [this](const std::string &topic, const std::string &payload) { this->send_device_info_(); },
         2);
 
-    std::string topic = "esphome/ping/";
-    topic.append(App.get_name());
+    // Format topic on stack - subscribe() copies it
+    // "esphome/ping/" (13) + name (ESPHOME_DEVICE_NAME_MAX_LEN) + null (1)
+    constexpr size_t ping_topic_buffer_size = 13 + ESPHOME_DEVICE_NAME_MAX_LEN + 1;
+    char ping_topic[ping_topic_buffer_size];
+    buf_append_printf(ping_topic, sizeof(ping_topic), 0, "esphome/ping/%s", App.get_name().c_str());
     this->subscribe(
-        topic, [this](const std::string &topic, const std::string &payload) { this->send_device_info_(); }, 2);
+        ping_topic, [this](const std::string &topic, const std::string &payload) { this->send_device_info_(); }, 2);
   }
 
   if (this->enable_on_boot_) {
@@ -81,8 +85,11 @@ void MQTTClientComponent::send_device_info_() {
   if (!this->is_connected() or !this->is_discovery_ip_enabled()) {
     return;
   }
-  std::string topic = "esphome/discover/";
-  topic.append(App.get_name());
+  // Format topic on stack to avoid heap allocation
+  // "esphome/discover/" (17) + name (ESPHOME_DEVICE_NAME_MAX_LEN) + null (1)
+  constexpr size_t topic_buffer_size = 17 + ESPHOME_DEVICE_NAME_MAX_LEN + 1;
+  char topic[topic_buffer_size];
+  buf_append_printf(topic, sizeof(topic), 0, "esphome/discover/%s", App.get_name().c_str());
 
   // NOLINTBEGIN(clang-analyzer-cplusplus.NewDeleteLeaks) false positive with ArduinoJson
   this->publish_json(
@@ -500,39 +507,49 @@ bool MQTTClientComponent::publish(const std::string &topic, const std::string &p
 
 bool MQTTClientComponent::publish(const std::string &topic, const char *payload, size_t payload_length, uint8_t qos,
                                   bool retain) {
-  return publish({.topic = topic, .payload = std::string(payload, payload_length), .qos = qos, .retain = retain});
+  return this->publish(topic.c_str(), payload, payload_length, qos, retain);
 }
 
 bool MQTTClientComponent::publish(const MQTTMessage &message) {
+  return this->publish(message.topic.c_str(), message.payload.c_str(), message.payload.length(), message.qos,
+                       message.retain);
+}
+bool MQTTClientComponent::publish_json(const std::string &topic, const json::json_build_t &f, uint8_t qos,
+                                       bool retain) {
+  return this->publish_json(topic.c_str(), f, qos, retain);
+}
+
+bool MQTTClientComponent::publish(const char *topic, const char *payload, size_t payload_length, uint8_t qos,
+                                  bool retain) {
   if (!this->is_connected()) {
-    // critical components will re-transmit their messages
     return false;
   }
-  bool logging_topic = this->log_message_.topic == message.topic;
-  bool ret = this->mqtt_backend_.publish(message);
+  size_t topic_len = strlen(topic);
+  bool logging_topic = (topic_len == this->log_message_.topic.size()) &&
+                       (memcmp(this->log_message_.topic.c_str(), topic, topic_len) == 0);
+  bool ret = this->mqtt_backend_.publish(topic, payload, payload_length, qos, retain);
   delay(0);
   if (!ret && !logging_topic && this->is_connected()) {
     delay(0);
-    ret = this->mqtt_backend_.publish(message);
+    ret = this->mqtt_backend_.publish(topic, payload, payload_length, qos, retain);
     delay(0);
   }
 
   if (!logging_topic) {
     if (ret) {
-      ESP_LOGV(TAG, "Publish(topic='%s' payload='%s' retain=%d qos=%d)", message.topic.c_str(), message.payload.c_str(),
-               message.retain, message.qos);
+      ESP_LOGV(TAG, "Publish(topic='%s' retain=%d qos=%d)", topic, retain, qos);
+      ESP_LOGVV(TAG, "Publish payload (len=%u): '%.*s'", payload_length, static_cast<int>(payload_length), payload);
     } else {
-      ESP_LOGV(TAG, "Publish failed for topic='%s' (len=%u). Will retry", message.topic.c_str(),
-               message.payload.length());
+      ESP_LOGV(TAG, "Publish failed for topic='%s' (len=%u). Will retry", topic, payload_length);
       this->status_momentary_warning("publish", 1000);
     }
   }
   return ret != 0;
 }
-bool MQTTClientComponent::publish_json(const std::string &topic, const json::json_build_t &f, uint8_t qos,
-                                       bool retain) {
+
+bool MQTTClientComponent::publish_json(const char *topic, const json::json_build_t &f, uint8_t qos, bool retain) {
   std::string message = json::build_json(f);
-  return this->publish(topic, message, qos, retain);
+  return this->publish(topic, message.c_str(), message.length(), qos, retain);
 }
 
 void MQTTClientComponent::enable() {
@@ -610,18 +627,10 @@ static bool topic_match(const char *message, const char *subscription) {
 }
 
 void MQTTClientComponent::on_message(const std::string &topic, const std::string &payload) {
-#ifdef USE_ESP8266
-  // on ESP8266, this is called in lwIP/AsyncTCP task; some components do not like running
-  // from a different task.
-  this->defer([this, topic, payload]() {
-#endif
-    for (auto &subscription : this->subscriptions_) {
-      if (topic_match(topic.c_str(), subscription.topic.c_str()))
-        subscription.callback(topic, payload);
-    }
-#ifdef USE_ESP8266
-  });
-#endif
+  for (auto &subscription : this->subscriptions_) {
+    if (topic_match(topic.c_str(), subscription.topic.c_str()))
+      subscription.callback(topic, payload);
+  }
 }
 
 // Setters
@@ -635,7 +644,8 @@ void MQTTClientComponent::set_log_message_template(MQTTMessage &&message) { this
 const MQTTDiscoveryInfo &MQTTClientComponent::get_discovery_info() const { return this->discovery_info_; }
 void MQTTClientComponent::set_topic_prefix(const std::string &topic_prefix, const std::string &check_topic_prefix) {
   if (App.is_name_add_mac_suffix_enabled() && (topic_prefix == check_topic_prefix)) {
-    this->topic_prefix_ = str_sanitize(App.get_name());
+    char buf[ESPHOME_DEVICE_NAME_MAX_LEN + 1];
+    this->topic_prefix_ = str_sanitize_to(buf, App.get_name().c_str());
   } else {
     this->topic_prefix_ = topic_prefix;
   }

esphome/components/mqtt/mqtt_client.h

@@ -229,6 +229,9 @@ class MQTTClientComponent : public Component
   bool publish(const std::string &topic, const char *payload, size_t payload_length, uint8_t qos = 0,
                bool retain = false);
 
+  /// Publish directly without creating MQTTMessage (avoids heap allocation for topic)
+  bool publish(const char *topic, const char *payload, size_t payload_length, uint8_t qos = 0, bool retain = false);
+
   /** Construct and send a JSON MQTT message.
    *
    * @param topic The topic.
@@ -237,6 +240,9 @@ class MQTTClientComponent : public Component
    */
   bool publish_json(const std::string &topic, const json::json_build_t &f, uint8_t qos = 0, bool retain = false);
 
+  /// Publish JSON directly without heap allocation for topic
+  bool publish_json(const char *topic, const json::json_build_t &f, uint8_t qos = 0, bool retain = false);
+
   /// Setup the MQTT client, registering a bunch of callbacks and attempting to connect.
   void setup() override;
   void dump_config() override;

esphome/components/mqtt/mqtt_component.cpp

@@ -48,7 +48,8 @@ void MQTTComponent::set_subscribe_qos(uint8_t qos) { this->subscribe_qos_ = qos;
 void MQTTComponent::set_retain(bool retain) { this->retain_ = retain; }
 
 std::string MQTTComponent::get_discovery_topic_(const MQTTDiscoveryInfo &discovery_info) const {
-  std::string sanitized_name = str_sanitize(App.get_name());
+  char sanitized_name[ESPHOME_DEVICE_NAME_MAX_LEN + 1];
+  str_sanitize_to(sanitized_name, App.get_name().c_str());
   const char *comp_type = this->component_type();
   char object_id_buf[OBJECT_ID_MAX_LEN];
   StringRef object_id = this->get_default_object_id_to_(object_id_buf);
@@ -60,7 +61,7 @@ std::string MQTTComponent::get_discovery_topic_(const MQTTDiscoveryInfo &discove
   p = append_char(p, '/');
   p = append_str(p, comp_type, strlen(comp_type));
   p = append_char(p, '/');
-  p = append_str(p, sanitized_name.data(), sanitized_name.size());
+  p = append_str(p, sanitized_name, strlen(sanitized_name));
   p = append_char(p, '/');
   p = append_str(p, object_id.c_str(), object_id.size());
   p = append_str(p, "/config", 7);

esphome/components/network/ip_address.h

@@ -60,6 +60,8 @@ struct IPAddress {
   }
   IPAddress(const std::string &in_address) { inet_aton(in_address.c_str(), &ip_addr_); }
   IPAddress(const ip_addr_t *other_ip) { ip_addr_ = *other_ip; }
+  // Remove before 2026.8.0
+  ESPDEPRECATED("Use str_to() instead. Removed in 2026.8.0", "2026.2.0")
   std::string str() const {
     char buf[IP_ADDRESS_BUFFER_SIZE];
     this->str_to(buf);
@@ -147,6 +149,8 @@ struct IPAddress {
   bool is_ip4() const { return IP_IS_V4(&ip_addr_); }
   bool is_ip6() const { return IP_IS_V6(&ip_addr_); }
   bool is_multicast() const { return ip_addr_ismulticast(&ip_addr_); }
+  // Remove before 2026.8.0
+  ESPDEPRECATED("Use str_to() instead. Removed in 2026.8.0", "2026.2.0")
   std::string str() const {
     char buf[IP_ADDRESS_BUFFER_SIZE];
     this->str_to(buf);

esphome/components/nextion/nextion.cpp

@@ -1,6 +1,7 @@
 #include "nextion.h"
 #include <cinttypes>
 #include "esphome/core/application.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/util.h"
 
@@ -1283,8 +1284,9 @@ void Nextion::check_pending_waveform_() {
   size_t buffer_to_send = component->get_wave_buffer_size() < 255 ? component->get_wave_buffer_size()
                                                                   : 255;  // ADDT command can only send 255
 
-  std::string command = "addt " + to_string(component->get_component_id()) + "," +
-                        to_string(component->get_wave_channel_id()) + "," + to_string(buffer_to_send);
+  char command[24];  // "addt " + uint8 + "," + uint8 + "," + uint8 + null = max 17 chars
+  buf_append_printf(command, sizeof(command), 0, "addt %u,%u,%zu", component->get_component_id(),
+                    component->get_wave_channel_id(), buffer_to_send);
   if (!this->send_command_(command)) {
     delete nb;  // NOLINT(cppcoreguidelines-owning-memory)
     this->waveform_queue_.pop_front();

esphome/components/nextion/nextion_upload_arduino.cpp

@@ -34,7 +34,7 @@ int Nextion::upload_by_chunks_(HTTPClient &http_client, uint32_t &range_start) {
   }
 
   char range_header[32];
-  sprintf(range_header, "bytes=%" PRIu32 "-%" PRIu32, range_start, range_end);
+  buf_append_printf(range_header, sizeof(range_header), 0, "bytes=%" PRIu32 "-%" PRIu32, range_start, range_end);
   ESP_LOGV(TAG, "Range: %s", range_header);
   http_client.addHeader("Range", range_header);
   int code = http_client.GET();

esphome/components/nextion/nextion_upload_esp32.cpp

@@ -36,7 +36,7 @@ int Nextion::upload_by_chunks_(esp_http_client_handle_t http_client, uint32_t &r
   }
 
   char range_header[32];
-  sprintf(range_header, "bytes=%" PRIu32 "-%" PRIu32, range_start, range_end);
+  buf_append_printf(range_header, sizeof(range_header), 0, "bytes=%" PRIu32 "-%" PRIu32, range_start, range_end);
   ESP_LOGV(TAG, "Range: %s", range_header);
   esp_http_client_set_header(http_client, "Range", range_header);
   ESP_LOGV(TAG, "Open HTTP");

esphome/components/pca6416a/pca6416a.cpp

@@ -181,7 +181,7 @@ void PCA6416AGPIOPin::pin_mode(gpio::Flags flags) { this->parent_->pin_mode(this
 bool PCA6416AGPIOPin::digital_read() { return this->parent_->digital_read(this->pin_) != this->inverted_; }
 void PCA6416AGPIOPin::digital_write(bool value) { this->parent_->digital_write(this->pin_, value != this->inverted_); }
 size_t PCA6416AGPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via PCA6416A", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via PCA6416A", this->pin_);
 }
 
 }  // namespace pca6416a

esphome/components/pca9554/pca9554.cpp

@@ -130,7 +130,7 @@ void PCA9554GPIOPin::pin_mode(gpio::Flags flags) { this->parent_->pin_mode(this-
 bool PCA9554GPIOPin::digital_read() { return this->parent_->digital_read(this->pin_) != this->inverted_; }
 void PCA9554GPIOPin::digital_write(bool value) { this->parent_->digital_write(this->pin_, value != this->inverted_); }
 size_t PCA9554GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via PCA9554", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via PCA9554", this->pin_);
 }
 
 }  // namespace pca9554

esphome/components/pcf8574/pcf8574.cpp

@@ -107,7 +107,7 @@ void PCF8574GPIOPin::pin_mode(gpio::Flags flags) { this->parent_->pin_mode(this-
 bool PCF8574GPIOPin::digital_read() { return this->parent_->digital_read(this->pin_) != this->inverted_; }
 void PCF8574GPIOPin::digital_write(bool value) { this->parent_->digital_write(this->pin_, value != this->inverted_); }
 size_t PCF8574GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via PCF8574", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via PCF8574", this->pin_);
 }
 
 }  // namespace pcf8574

esphome/components/pi4ioe5v6408/pi4ioe5v6408.cpp

@@ -165,7 +165,7 @@ void PI4IOE5V6408GPIOPin::digital_write(bool value) {
   this->parent_->digital_write(this->pin_, value != this->inverted_);
 }
 size_t PI4IOE5V6408GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via PI4IOE5V6408", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via PI4IOE5V6408", this->pin_);
 }
 
 }  // namespace pi4ioe5v6408

esphome/components/pipsolar/output/pipsolar_output.cpp

@@ -8,7 +8,7 @@ namespace pipsolar {
 static const char *const TAG = "pipsolar.output";
 
 void PipsolarOutput::write_state(float state) {
-  char tmp[10];
+  char tmp[16];
   snprintf(tmp, sizeof(tmp), this->set_command_, state);
 
   if (std::find(this->possible_values_.begin(), this->possible_values_.end(), state) != this->possible_values_.end()) {

esphome/components/rc522_spi/rc522_spi.cpp

@@ -1,4 +1,5 @@
 #include "rc522_spi.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 // Based on:
@@ -70,7 +71,7 @@ void RC522Spi::pcd_read_register(PcdRegister reg,  ///< The register to read fro
     index++;
 
 #ifdef ESPHOME_LOG_HAS_VERY_VERBOSE
-    sprintf(cstrb, " %x", values[0]);
+    buf_append_printf(cstrb, sizeof(cstrb), 0, " %x", values[0]);
     buf.append(cstrb);
 #endif
   }
@@ -78,7 +79,7 @@ void RC522Spi::pcd_read_register(PcdRegister reg,  ///< The register to read fro
     values[index] = transfer_byte(address);  // Read value and tell that we want to read the same address again.
 
 #ifdef ESPHOME_LOG_HAS_VERY_VERBOSE
-    sprintf(cstrb, " %x", values[index]);
+    buf_append_printf(cstrb, sizeof(cstrb), 0, " %x", values[index]);
     buf.append(cstrb);
 #endif
 
@@ -88,7 +89,7 @@ void RC522Spi::pcd_read_register(PcdRegister reg,  ///< The register to read fro
 
 #ifdef ESPHOME_LOG_HAS_VERY_VERBOSE
   buf = buf + " ";
-  sprintf(cstrb, "%x", values[index]);
+  buf_append_printf(cstrb, sizeof(cstrb), 0, "%x", values[index]);
   buf.append(cstrb);
 
   ESP_LOGVV(TAG, "read_register_array_(%x, %d, , %d) -> %s", reg, count, rx_align, buf.c_str());
@@ -127,7 +128,7 @@ void RC522Spi::pcd_write_register(PcdRegister reg,  ///< The register to write t
     transfer_byte(values[index]);
 
 #ifdef ESPHOME_LOG_HAS_VERY_VERBOSE
-    sprintf(cstrb, " %x", values[index]);
+    buf_append_printf(cstrb, sizeof(cstrb), 0, " %x", values[index]);
     buf.append(cstrb);
 #endif
   }

esphome/components/rf_bridge/rf_bridge.cpp

@@ -1,6 +1,7 @@
 #include "rf_bridge.h"
-#include "esphome/core/log.h"
 #include "esphome/core/application.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
 #include <cinttypes>
 #include <cstring>
 
@@ -72,9 +73,9 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
 
       data.length = raw[2];
       data.protocol = raw[3];
-      char next_byte[3];
+      char next_byte[3];  // 2 hex chars + null
       for (uint8_t i = 0; i < data.length - 1; i++) {
-        sprintf(next_byte, "%02X", raw[4 + i]);
+        buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[4 + i]);
         data.code += next_byte;
       }
 
@@ -90,10 +91,10 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
 
       uint8_t buckets = raw[2] << 1;
       std::string str;
-      char next_byte[3];
+      char next_byte[3];  // 2 hex chars + null
 
       for (uint32_t i = 0; i <= at; i++) {
-        sprintf(next_byte, "%02X", raw[i]);
+        buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[i]);
         str += next_byte;
         if ((i > 3) && buckets) {
           buckets--;

esphome/components/select/__init__.py

@@ -33,7 +33,7 @@ SelectPtr = Select.operator("ptr")
 # Triggers
 SelectStateTrigger = select_ns.class_(
     "SelectStateTrigger",
-    automation.Trigger.template(cg.std_string, cg.size_t),
+    automation.Trigger.template(cg.StringRef, cg.size_t),
 )
 
 # Actions
@@ -100,7 +100,7 @@ async def setup_select_core_(var, config, *, options: list[str]):
     for conf in config.get(CONF_ON_VALUE, []):
         trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
         await automation.build_automation(
-            trigger, [(cg.std_string, "x"), (cg.size_t, "i")], conf
+            trigger, [(cg.StringRef, "x"), (cg.size_t, "i")], conf
         )
 
     if (mqtt_id := config.get(CONF_MQTT_ID)) is not None:

esphome/components/select/automation.h

@@ -6,11 +6,11 @@
 
 namespace esphome::select {
 
-class SelectStateTrigger : public Trigger<std::string, size_t> {
+class SelectStateTrigger : public Trigger<StringRef, size_t> {
  public:
   explicit SelectStateTrigger(Select *parent) : parent_(parent) {
     parent->add_on_state_callback(
-        [this](size_t index) { this->trigger(std::string(this->parent_->option_at(index)), index); });
+        [this](size_t index) { this->trigger(StringRef(this->parent_->option_at(index)), index); });
   }
 
  protected:

esphome/components/shtcx/shtcx.cpp

@@ -13,14 +13,14 @@ static const uint16_t SHTCX_COMMAND_READ_ID_REGISTER = 0xEFC8;
 static const uint16_t SHTCX_COMMAND_SOFT_RESET = 0x805D;
 static const uint16_t SHTCX_COMMAND_POLLING_H = 0x7866;
 
-inline const char *to_string(SHTCXType type) {
+static const LogString *shtcx_type_to_string(SHTCXType type) {
   switch (type) {
     case SHTCX_TYPE_SHTC3:
-      return "SHTC3";
+      return LOG_STR("SHTC3");
     case SHTCX_TYPE_SHTC1:
-      return "SHTC1";
+      return LOG_STR("SHTC1");
     default:
-      return "UNKNOWN";
+      return LOG_STR("UNKNOWN");
   }
 }
 
@@ -52,7 +52,7 @@ void SHTCXComponent::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "SHTCx:\n"
                 "  Model: %s (%04x)",
-                to_string(this->type_), this->sensor_id_);
+                LOG_STR_ARG(shtcx_type_to_string(this->type_)), this->sensor_id_);
   LOG_I2C_DEVICE(this);
   if (this->is_failed()) {
     ESP_LOGE(TAG, ESP_LOG_MSG_COMM_FAIL);

esphome/components/sim800l/sim800l.cpp

@@ -1,4 +1,5 @@
 #include "sim800l.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include <cstring>
 
@@ -50,8 +51,8 @@ void Sim800LComponent::update() {
   } else if (state_ == STATE_RECEIVED_SMS) {
     // Serial Buffer should have flushed.
     // Send cmd to delete received sms
-    char delete_cmd[20];
-    sprintf(delete_cmd, "AT+CMGD=%d", this->parse_index_);
+    char delete_cmd[20];  // "AT+CMGD=" (8) + uint8_t (max 3) + null = 12 <= 20
+    buf_append_printf(delete_cmd, sizeof(delete_cmd), 0, "AT+CMGD=%d", this->parse_index_);
     this->send_cmd_(delete_cmd);
     this->state_ = STATE_CHECK_SMS;
     this->expect_ack_ = true;

esphome/components/sml/sml_parser.cpp

@@ -104,7 +104,10 @@ std::vector<ObisInfo> SmlFile::get_obis_info() {
 std::string bytes_repr(const BytesView &buffer) {
   std::string repr;
   for (auto const value : buffer) {
-    repr += str_sprintf("%02x", value & 0xff);
+    // max 3: 2 hex digits + null
+    char hex_buf[3];
+    snprintf(hex_buf, sizeof(hex_buf), "%02x", static_cast<unsigned int>(value));
+    repr += hex_buf;
   }
   return repr;
 }
@@ -146,7 +149,11 @@ ObisInfo::ObisInfo(const BytesView &server_id, const SmlNode &val_list_entry) :
 }
 
 std::string ObisInfo::code_repr() const {
-  return str_sprintf("%d-%d:%d.%d.%d", this->code[0], this->code[1], this->code[2], this->code[3], this->code[4]);
+  // max 20: "255-255:255.255.255" (19 chars) + null
+  char buf[20];
+  snprintf(buf, sizeof(buf), "%d-%d:%d.%d.%d", this->code[0], this->code[1], this->code[2], this->code[3],
+           this->code[4]);
+  return buf;
 }
 
 }  // namespace sml

esphome/components/sn74hc165/sn74hc165.cpp

@@ -65,7 +65,7 @@ float SN74HC165Component::get_setup_priority() const { return setup_priority::IO
 bool SN74HC165GPIOPin::digital_read() { return this->parent_->digital_read_(this->pin_) != this->inverted_; }
 
 size_t SN74HC165GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via SN74HC165", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via SN74HC165", this->pin_);
 }
 
 }  // namespace sn74hc165

esphome/components/sn74hc595/sn74hc595.cpp

@@ -94,7 +94,7 @@ void SN74HC595GPIOPin::digital_write(bool value) {
   this->parent_->digital_write_(this->pin_, value != this->inverted_);
 }
 size_t SN74HC595GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via SN74HC595", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via SN74HC595", this->pin_);
 }
 
 }  // namespace sn74hc595

esphome/components/socket/socket.cpp

@@ -107,9 +107,9 @@ std::unique_ptr<Socket> socket_ip_loop_monitored(int type, int protocol) {
 #endif /* USE_NETWORK_IPV6 */
 }
 
-socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const std::string &ip_address, uint16_t port) {
+socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const char *ip_address, uint16_t port) {
 #if USE_NETWORK_IPV6
-  if (ip_address.find(':') != std::string::npos) {
+  if (strchr(ip_address, ':') != nullptr) {
     if (addrlen < sizeof(sockaddr_in6)) {
       errno = EINVAL;
       return 0;
@@ -121,14 +121,14 @@ socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const std::stri
 
 #ifdef USE_SOCKET_IMPL_BSD_SOCKETS
     // Use standard inet_pton for BSD sockets
-    if (inet_pton(AF_INET6, ip_address.c_str(), &server->sin6_addr) != 1) {
+    if (inet_pton(AF_INET6, ip_address, &server->sin6_addr) != 1) {
       errno = EINVAL;
       return 0;
     }
 #else
     // Use LWIP-specific functions
     ip6_addr_t ip6;
-    inet6_aton(ip_address.c_str(), &ip6);
+    inet6_aton(ip_address, &ip6);
     memcpy(server->sin6_addr.un.u32_addr, ip6.addr, sizeof(ip6.addr));
 #endif
     return sizeof(sockaddr_in6);
@@ -141,7 +141,7 @@ socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const std::stri
   auto *server = reinterpret_cast<sockaddr_in *>(addr);
   memset(server, 0, sizeof(sockaddr_in));
   server->sin_family = AF_INET;
-  server->sin_addr.s_addr = inet_addr(ip_address.c_str());
+  server->sin_addr.s_addr = inet_addr(ip_address);
   server->sin_port = htons(port);
   return sizeof(sockaddr_in);
 }

esphome/components/socket/socket.h

@@ -87,7 +87,17 @@ std::unique_ptr<Socket> socket_loop_monitored(int domain, int type, int protocol
 std::unique_ptr<Socket> socket_ip_loop_monitored(int type, int protocol);
 
 /// Set a sockaddr to the specified address and port for the IP version used by socket_ip().
-socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const std::string &ip_address, uint16_t port);
+/// @param addr Destination sockaddr structure
+/// @param addrlen Size of the addr buffer
+/// @param ip_address Null-terminated IP address string (IPv4 or IPv6)
+/// @param port Port number in host byte order
+/// @return Size of the sockaddr structure used, or 0 on error
+socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const char *ip_address, uint16_t port);
+
+/// Convenience overload for std::string (backward compatible).
+inline socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const std::string &ip_address, uint16_t port) {
+  return set_sockaddr(addr, addrlen, ip_address.c_str(), port);
+}
 
 /// Set a sockaddr to the any address and specified port for the IP version used by socket_ip().
 socklen_t set_sockaddr_any(struct sockaddr *addr, socklen_t addrlen, uint16_t port);

esphome/components/spi_led_strip/spi_led_strip.cpp

@@ -1,4 +1,5 @@
 #include "spi_led_strip.h"
+#include "esphome/core/helpers.h"
 
 namespace esphome {
 namespace spi_led_strip {
@@ -47,15 +48,14 @@ void SpiLedStrip::dump_config() {
 void SpiLedStrip::write_state(light::LightState *state) {
   if (this->is_failed())
     return;
-  if (ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE) {
-    char strbuf[49];
-    size_t len = std::min(this->buffer_size_, (size_t) (sizeof(strbuf) - 1) / 3);
-    memset(strbuf, 0, sizeof(strbuf));
-    for (size_t i = 0; i != len; i++) {
-      sprintf(strbuf + i * 3, "%02X ", this->buf_[i]);
-    }
+#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE
+  {
+    char strbuf[49];  // format_hex_pretty_size(16) = 48, fits 16 bytes
+    size_t len = std::min(this->buffer_size_, (size_t) 16);
+    format_hex_pretty_to(strbuf, sizeof(strbuf), this->buf_, len, ' ');
     esph_log_v(TAG, "write_state: buf = %s", strbuf);
   }
+#endif
   this->enable();
   this->write_array(this->buf_, this->buffer_size_);
   this->disable();

esphome/components/sprinkler/sprinkler.cpp

@@ -43,13 +43,11 @@ SprinklerControllerSwitch::SprinklerControllerSwitch()
     : turn_on_trigger_(new Trigger<>()), turn_off_trigger_(new Trigger<>()) {}
 
 void SprinklerControllerSwitch::loop() {
-  if (!this->f_.has_value())
-    return;
+  // Loop is only enabled when f_ has a value (see setup())
   auto s = (*this->f_)();
-  if (!s.has_value())
-    return;
-
-  this->publish_state(*s);
+  if (s.has_value()) {
+    this->publish_state(*s);
+  }
 }
 
 void SprinklerControllerSwitch::write_state(bool state) {
@@ -74,7 +72,13 @@ float SprinklerControllerSwitch::get_setup_priority() const { return setup_prior
 Trigger<> *SprinklerControllerSwitch::get_turn_on_trigger() const { return this->turn_on_trigger_; }
 Trigger<> *SprinklerControllerSwitch::get_turn_off_trigger() const { return this->turn_off_trigger_; }
 
-void SprinklerControllerSwitch::setup() { this->state = this->get_initial_state_with_restore_mode().value_or(false); }
+void SprinklerControllerSwitch::setup() {
+  this->state = this->get_initial_state_with_restore_mode().value_or(false);
+  // Disable loop if no state lambda is set - nothing to poll
+  if (!this->f_.has_value()) {
+    this->disable_loop();
+  }
+}
 
 void SprinklerControllerSwitch::dump_config() { LOG_SWITCH("", "Sprinkler Switch", this); }
 
@@ -327,25 +331,32 @@ SprinklerValveOperator *SprinklerValveRunRequest::valve_operator() { return this
 
 SprinklerValveRunRequestOrigin SprinklerValveRunRequest::request_is_from() { return this->origin_; }
 
-Sprinkler::Sprinkler() {}
-Sprinkler::Sprinkler(const std::string &name) {
-  // The `name` is needed to set timers up, hence non-default constructor
-  // replaces `set_name()` method previously existed
-  this->name_ = name;
+Sprinkler::Sprinkler() : Sprinkler("") {}
+Sprinkler::Sprinkler(const char *name) : name_(name) {
+  // The `name` is stored for dump_config logging
   this->timer_.init(2);
-  this->timer_.push_back({this->name_ + "sm", false, 0, 0, std::bind(&Sprinkler::sm_timer_callback_, this)});
-  this->timer_.push_back({this->name_ + "vs", false, 0, 0, std::bind(&Sprinkler::valve_selection_callback_, this)});
+  // Timer names only need to be unique within this component instance
+  this->timer_.push_back({"sm", false, 0, 0, std::bind(&Sprinkler::sm_timer_callback_, this)});
+  this->timer_.push_back({"vs", false, 0, 0, std::bind(&Sprinkler::valve_selection_callback_, this)});
 }
 
-void Sprinkler::setup() { this->all_valves_off_(true); }
+void Sprinkler::setup() {
+  this->all_valves_off_(true);
+  // Start with loop disabled - nothing to do when idle
+  this->disable_loop();
+}
 
 void Sprinkler::loop() {
   for (auto &vo : this->valve_op_) {
     vo.loop();
   }
-  if (this->prev_req_.has_request() && this->prev_req_.has_valve_operator() &&
-      this->prev_req_.valve_operator()->state() == IDLE) {
-    this->prev_req_.reset();
+  if (this->prev_req_.has_request()) {
+    if (this->prev_req_.has_valve_operator() && this->prev_req_.valve_operator()->state() == IDLE) {
+      this->prev_req_.reset();
+    }
+  } else if (this->state_ == IDLE) {
+    // Nothing more to do - disable loop until next activation
+    this->disable_loop();
   }
 }
 
@@ -1333,6 +1344,8 @@ void Sprinkler::start_valve_(SprinklerValveRunRequest *req) {
   if (!this->is_a_valid_valve(req->valve())) {
     return;  // we can't do anything if the valve number isn't valid
   }
+  // Enable loop to monitor valve operator states
+  this->enable_loop();
   for (auto &vo : this->valve_op_) {  // find the first available SprinklerValveOperator, load it and start it up
     if (vo.state() == IDLE) {
       auto run_duration = req->run_duration() ? req->run_duration() : this->valve_run_duration_adjusted(req->valve());
@@ -1575,8 +1588,7 @@ const LogString *Sprinkler::state_as_str_(SprinklerState state) {
 
 void Sprinkler::start_timer_(const SprinklerTimerIndex timer_index) {
   if (this->timer_duration_(timer_index) > 0) {
-    // FixedVector ensures timer_ can't be resized, so .c_str() pointers remain valid
-    this->set_timeout(this->timer_[timer_index].name.c_str(), this->timer_duration_(timer_index),
+    this->set_timeout(this->timer_[timer_index].name, this->timer_duration_(timer_index),
                       this->timer_cbf_(timer_index));
     this->timer_[timer_index].start_time = millis();
     this->timer_[timer_index].active = true;
@@ -1587,7 +1599,7 @@ void Sprinkler::start_timer_(const SprinklerTimerIndex timer_index) {
 
 bool Sprinkler::cancel_timer_(const SprinklerTimerIndex timer_index) {
   this->timer_[timer_index].active = false;
-  return this->cancel_timeout(this->timer_[timer_index].name.c_str());
+  return this->cancel_timeout(this->timer_[timer_index].name);
 }
 
 bool Sprinkler::timer_active_(const SprinklerTimerIndex timer_index) { return this->timer_[timer_index].active; }
@@ -1618,7 +1630,7 @@ void Sprinkler::sm_timer_callback_() {
 }
 
 void Sprinkler::dump_config() {
-  ESP_LOGCONFIG(TAG, "Sprinkler Controller -- %s", this->name_.c_str());
+  ESP_LOGCONFIG(TAG, "Sprinkler Controller -- %s", this->name_);
   if (this->manual_selection_delay_.has_value()) {
     ESP_LOGCONFIG(TAG, "  Manual Selection Delay: %" PRIu32 " seconds", this->manual_selection_delay_.value_or(0));
   }

esphome/components/sprinkler/sprinkler.h

@@ -11,7 +11,7 @@
 
 namespace esphome::sprinkler {
 
-const std::string MIN_STR = "min";
+inline constexpr const char *MIN_STR = "min";
 
 enum SprinklerState : uint8_t {
   // NOTE: these states are used by both SprinklerValveOperator and Sprinkler (the controller)!
@@ -49,7 +49,7 @@ struct SprinklerQueueItem {
 };
 
 struct SprinklerTimer {
-  const std::string name;
+  const char *name;
   bool active;
   uint32_t time;
   uint32_t start_time;
@@ -176,7 +176,7 @@ class SprinklerValveRunRequest {
 class Sprinkler : public Component {
  public:
   Sprinkler();
-  Sprinkler(const std::string &name);
+  Sprinkler(const char *name);
   void setup() override;
   void loop() override;
   void dump_config() override;
@@ -504,7 +504,7 @@ class Sprinkler : public Component {
   uint32_t start_delay_{0};
   uint32_t stop_delay_{0};
 
-  std::string name_;
+  const char *name_{""};
 
   /// Sprinkler controller state
   SprinklerState state_{IDLE};

esphome/components/status/binary_sensor.py

@@ -7,14 +7,14 @@ DEPENDENCIES = ["network"]
 
 status_ns = cg.esphome_ns.namespace("status")
 StatusBinarySensor = status_ns.class_(
-    "StatusBinarySensor", binary_sensor.BinarySensor, cg.Component
+    "StatusBinarySensor", binary_sensor.BinarySensor, cg.PollingComponent
 )
 
 CONFIG_SCHEMA = binary_sensor.binary_sensor_schema(
     StatusBinarySensor,
     device_class=DEVICE_CLASS_CONNECTIVITY,
     entity_category=ENTITY_CATEGORY_DIAGNOSTIC,
-).extend(cv.COMPONENT_SCHEMA)
+).extend(cv.polling_component_schema("1s"))
 
 
 async def to_code(config):

esphome/components/status/status_binary_sensor.cpp

@@ -10,12 +10,11 @@
 #include "esphome/components/api/api_server.h"
 #endif
 
-namespace esphome {
-namespace status {
+namespace esphome::status {
 
 static const char *const TAG = "status";
 
-void StatusBinarySensor::loop() {
+void StatusBinarySensor::update() {
   bool status = network::is_connected();
 #ifdef USE_MQTT
   if (mqtt::global_mqtt_client != nullptr) {
@@ -33,5 +32,4 @@ void StatusBinarySensor::loop() {
 void StatusBinarySensor::setup() { this->publish_initial_state(false); }
 void StatusBinarySensor::dump_config() { LOG_BINARY_SENSOR("", "Status Binary Sensor", this); }
 
-}  // namespace status
-}  // namespace esphome
+}  // namespace esphome::status

esphome/components/status/status_binary_sensor.h

@@ -3,12 +3,11 @@
 #include "esphome/core/component.h"
 #include "esphome/components/binary_sensor/binary_sensor.h"
 
-namespace esphome {
-namespace status {
+namespace esphome::status {
 
-class StatusBinarySensor : public binary_sensor::BinarySensor, public Component {
+class StatusBinarySensor : public binary_sensor::BinarySensor, public PollingComponent {
  public:
-  void loop() override;
+  void update() override;
 
   void setup() override;
   void dump_config() override;
@@ -16,5 +15,4 @@ class StatusBinarySensor : public binary_sensor::BinarySensor, public Component
   bool is_status_binary_sensor() const override { return true; }
 };
 
-}  // namespace status
-}  // namespace esphome
+}  // namespace esphome::status

esphome/components/sx1509/sx1509_gpio_pin.cpp

@@ -13,7 +13,7 @@ void SX1509GPIOPin::pin_mode(gpio::Flags flags) { this->parent_->pin_mode(this->
 bool SX1509GPIOPin::digital_read() { return this->parent_->digital_read(this->pin_) != this->inverted_; }
 void SX1509GPIOPin::digital_write(bool value) { this->parent_->digital_write(this->pin_, value != this->inverted_); }
 size_t SX1509GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via sx1509", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via sx1509", this->pin_);
 }
 
 }  // namespace sx1509

esphome/components/syslog/esphome_syslog.cpp

@@ -47,29 +47,27 @@ void Syslog::log_(const int level, const char *tag, const char *message, size_t
   size_t remaining = sizeof(packet);
 
   // Write PRI - abort if this fails as packet would be malformed
-  int ret = snprintf(packet, remaining, "<%d>", pri);
-  if (ret <= 0 || static_cast<size_t>(ret) >= remaining) {
-    return;
+  offset = buf_append_printf(packet, sizeof(packet), 0, "<%d>", pri);
+  if (offset == 0) {
+    return;  // PRI always produces at least "<0>" (3 chars), so 0 means error
   }
-  offset = ret;
-  remaining -= ret;
+  remaining -= offset;
 
   // Write timestamp directly into packet (RFC 5424: use "-" if time not valid or strftime fails)
   auto now = this->time_->now();
   size_t ts_written = now.is_valid() ? now.strftime(packet + offset, remaining, "%b %e %H:%M:%S") : 0;
   if (ts_written > 0) {
     offset += ts_written;
-    remaining -= ts_written;
   } else if (remaining > 0) {
     packet[offset++] = '-';
-    remaining--;
   }
 
   // Write hostname, tag, and message
-  ret = snprintf(packet + offset, remaining, " %s %s: %.*s", App.get_name().c_str(), tag, (int) len, message);
-  if (ret > 0) {
-    // snprintf returns chars that would be written; clamp to actual buffer space
-    offset += std::min(static_cast<size_t>(ret), remaining > 0 ? remaining - 1 : 0);
+  offset = buf_append_printf(packet, sizeof(packet), offset, " %s %s: %.*s", App.get_name().c_str(), tag, (int) len,
+                             message);
+  // Clamp to exclude null terminator position if buffer was filled
+  if (offset >= sizeof(packet)) {
+    offset = sizeof(packet) - 1;
   }
 
   if (offset > 0) {

esphome/components/tca9555/tca9555.cpp

@@ -139,7 +139,7 @@ void TCA9555GPIOPin::pin_mode(gpio::Flags flags) { this->parent_->pin_mode(this-
 bool TCA9555GPIOPin::digital_read() { return this->parent_->digital_read(this->pin_) != this->inverted_; }
 void TCA9555GPIOPin::digital_write(bool value) { this->parent_->digital_write(this->pin_, value != this->inverted_); }
 size_t TCA9555GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via TCA9555", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via TCA9555", this->pin_);
 }
 
 }  // namespace tca9555

esphome/components/template/select/__init__.py

@@ -88,5 +88,5 @@ async def to_code(config):
 
     if CONF_SET_ACTION in config:
         await automation.build_automation(
-            var.get_set_trigger(), [(cg.std_string, "x")], config[CONF_SET_ACTION]
+            var.get_set_trigger(), [(cg.StringRef, "x")], config[CONF_SET_ACTION]
         )

esphome/components/template/select/template_select.cpp

@@ -41,7 +41,7 @@ void TemplateSelect::update() {
 }
 
 void TemplateSelect::control(size_t index) {
-  this->set_trigger_->trigger(std::string(this->option_at(index)));
+  this->set_trigger_->trigger(StringRef(this->option_at(index)));
 
   if (this->optimistic_)
     this->publish_state(index);

esphome/components/template/select/template_select.h

@@ -4,6 +4,7 @@
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
 #include "esphome/core/preferences.h"
+#include "esphome/core/string_ref.h"
 #include "esphome/core/template_lambda.h"
 
 namespace esphome::template_ {
@@ -17,7 +18,7 @@ class TemplateSelect final : public select::Select, public PollingComponent {
   void dump_config() override;
   float get_setup_priority() const override { return setup_priority::HARDWARE; }
 
-  Trigger<std::string> *get_set_trigger() const { return this->set_trigger_; }
+  Trigger<StringRef> *get_set_trigger() const { return this->set_trigger_; }
   void set_optimistic(bool optimistic) { this->optimistic_ = optimistic; }
   void set_initial_option_index(size_t initial_option_index) { this->initial_option_index_ = initial_option_index; }
   void set_restore_value(bool restore_value) { this->restore_value_ = restore_value; }
@@ -27,7 +28,7 @@ class TemplateSelect final : public select::Select, public PollingComponent {
   bool optimistic_ = false;
   size_t initial_option_index_{0};
   bool restore_value_ = false;
-  Trigger<std::string> *set_trigger_ = new Trigger<std::string>();
+  Trigger<StringRef> *set_trigger_ = new Trigger<StringRef>();
   TemplateLambda<std::string> f_;
 
   ESPPreferenceObject pref_;

esphome/components/tormatic/tormatic_protocol.h

@@ -55,6 +55,7 @@ enum MessageType : uint16_t {
   COMMAND = 0x0106,
 };
 
+// Max string length: 7 ("Unknown"/"Command"). Update print() buffer sizes if adding longer strings.
 inline const char *message_type_to_str(MessageType t) {
   switch (t) {
     case STATUS:
@@ -83,7 +84,11 @@ struct MessageHeader {
   }
 
   std::string print() {
-    return str_sprintf("MessageHeader: seq %d, len %d, type %s", this->seq, this->len, message_type_to_str(this->type));
+    // 64 bytes: "MessageHeader: seq " + uint16 + ", len " + uint32 + ", type " + type + safety margin
+    char buf[64];
+    buf_append_printf(buf, sizeof(buf), 0, "MessageHeader: seq %d, len %d, type %s", this->seq, this->len,
+                      message_type_to_str(this->type));
+    return buf;
   }
 
   void byteswap() {
@@ -131,6 +136,7 @@ inline CoverOperation gate_status_to_cover_operation(GateStatus s) {
   return COVER_OPERATION_IDLE;
 }
 
+// Max string length: 11 ("Ventilating"). Update print() buffer sizes if adding longer strings.
 inline const char *gate_status_to_str(GateStatus s) {
   switch (s) {
     case PAUSED:
@@ -170,7 +176,12 @@ struct StatusReply {
   GateStatus state;
   uint8_t trailer = 0x0;
 
-  std::string print() { return str_sprintf("StatusReply: state %s", gate_status_to_str(this->state)); }
+  std::string print() {
+    // 48 bytes: "StatusReply: state " (19) + state (11) + safety margin
+    char buf[48];
+    buf_append_printf(buf, sizeof(buf), 0, "StatusReply: state %s", gate_status_to_str(this->state));
+    return buf;
+  }
 
   void byteswap(){};
 } __attribute__((packed));
@@ -202,7 +213,12 @@ struct CommandRequestReply {
   CommandRequestReply() = default;
   CommandRequestReply(GateStatus state) { this->state = state; }
 
-  std::string print() { return str_sprintf("CommandRequestReply: state %s", gate_status_to_str(this->state)); }
+  std::string print() {
+    // 56 bytes: "CommandRequestReply: state " (27) + state (11) + safety margin
+    char buf[56];
+    buf_append_printf(buf, sizeof(buf), 0, "CommandRequestReply: state %s", gate_status_to_str(this->state));
+    return buf;
+  }
 
   void byteswap() { this->type = convert_big_endian(this->type); }
 } __attribute__((packed));

esphome/components/toshiba/toshiba.cpp

@@ -1,5 +1,6 @@
 #include "toshiba.h"
 #include "esphome/components/remote_base/toshiba_ac_protocol.h"
+#include "esphome/core/helpers.h"
 
 #include <vector>
 
@@ -427,10 +428,17 @@ void ToshibaClimate::setup() {
   // Never send nan to HA
   if (std::isnan(this->target_temperature))
     this->target_temperature = 24;
+#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE
   // Log final state for debugging HA errors
-  ESP_LOGV(TAG, "Setup complete - Mode: %d, Fan: %s, Swing: %d, Temp: %.1f", static_cast<int>(this->mode),
-           this->fan_mode.has_value() ? std::to_string(static_cast<int>(this->fan_mode.value())).c_str() : "NONE",
+  const char *fan_mode_str = "NONE";
+  char fan_mode_buf[4];  // max 3 digits for fan mode enum + null
+  if (this->fan_mode.has_value()) {
+    buf_append_printf(fan_mode_buf, sizeof(fan_mode_buf), 0, "%d", static_cast<int>(this->fan_mode.value()));
+    fan_mode_str = fan_mode_buf;
+  }
+  ESP_LOGV(TAG, "Setup complete - Mode: %d, Fan: %s, Swing: %d, Temp: %.1f", static_cast<int>(this->mode), fan_mode_str,
            static_cast<int>(this->swing_mode), this->target_temperature);
+#endif
 }
 
 void ToshibaClimate::transmit_state() {

esphome/components/tuya/light/tuya_light.cpp

@@ -191,7 +191,7 @@ void TuyaLight::write_state(light::LightState *state) {
       case TuyaColorType::RGB: {
         char buffer[7];
         const char *format_str = this->color_type_lowercase_ ? "%02x%02x%02x" : "%02X%02X%02X";
-        sprintf(buffer, format_str, int(red * 255), int(green * 255), int(blue * 255));
+        snprintf(buffer, sizeof(buffer), format_str, int(red * 255), int(green * 255), int(blue * 255));
         color_value = buffer;
         break;
       }
@@ -201,7 +201,7 @@ void TuyaLight::write_state(light::LightState *state) {
         rgb_to_hsv(red, green, blue, hue, saturation, value);
         char buffer[13];
         const char *format_str = this->color_type_lowercase_ ? "%04x%04x%04x" : "%04X%04X%04X";
-        sprintf(buffer, format_str, hue, int(saturation * 1000), int(value * 1000));
+        snprintf(buffer, sizeof(buffer), format_str, hue, int(saturation * 1000), int(value * 1000));
         color_value = buffer;
         break;
       }
@@ -211,8 +211,8 @@ void TuyaLight::write_state(light::LightState *state) {
         rgb_to_hsv(red, green, blue, hue, saturation, value);
         char buffer[15];
         const char *format_str = this->color_type_lowercase_ ? "%02x%02x%02x%04x%02x%02x" : "%02X%02X%02X%04X%02X%02X";
-        sprintf(buffer, format_str, int(red * 255), int(green * 255), int(blue * 255), hue, int(saturation * 255),
-                int(value * 255));
+        snprintf(buffer, sizeof(buffer), format_str, int(red * 255), int(green * 255), int(blue * 255), hue,
+                 int(saturation * 255), int(value * 255));
         color_value = buffer;
         break;
       }

esphome/components/tuya/text_sensor/tuya_text_sensor.cpp

@@ -24,7 +24,7 @@ void TuyaTextSensor::setup() {
       }
       case TuyaDatapointType::ENUM: {
         char buf[4];  // uint8_t max is 3 digits + null
-        snprintf(buf, sizeof(buf), "%u", datapoint.value_enum);
+        buf_append_printf(buf, sizeof(buf), 0, "%u", datapoint.value_enum);
         ESP_LOGD(TAG, "MCU reported text sensor %u is: %s", datapoint.id, buf);
         this->publish_state(buf);
         break;

esphome/components/uart/uart_debugger.cpp

@@ -107,7 +107,7 @@ void UARTDebug::log_hex(UARTDirection direction, std::vector<uint8_t> bytes, uin
     if (i > 0) {
       res += separator;
     }
-    sprintf(buf, "%02X", bytes[i]);
+    buf_append_printf(buf, sizeof(buf), 0, "%02X", bytes[i]);
     res += buf;
   }
   ESP_LOGD(TAG, "%s", res.c_str());
@@ -147,7 +147,7 @@ void UARTDebug::log_string(UARTDirection direction, std::vector<uint8_t> bytes)
     } else if (bytes[i] == 92) {
       res += "\\\\";
     } else if (bytes[i] < 32 || bytes[i] > 127) {
-      sprintf(buf, "\\x%02X", bytes[i]);
+      buf_append_printf(buf, sizeof(buf), 0, "\\x%02X", bytes[i]);
       res += buf;
     } else {
       res += bytes[i];
@@ -166,11 +166,13 @@ void UARTDebug::log_int(UARTDirection direction, std::vector<uint8_t> bytes, uin
   } else {
     res += ">>> ";
   }
+  char buf[4];  // max 3 digits for uint8_t (255) + null
   for (size_t i = 0; i < len; i++) {
     if (i > 0) {
       res += separator;
     }
-    res += to_string(bytes[i]);
+    buf_append_printf(buf, sizeof(buf), 0, "%u", bytes[i]);
+    res += buf;
   }
   ESP_LOGD(TAG, "%s", res.c_str());
   delay(10);
@@ -189,7 +191,7 @@ void UARTDebug::log_binary(UARTDirection direction, std::vector<uint8_t> bytes,
     if (i > 0) {
       res += separator;
     }
-    sprintf(buf, "0b" BYTE_TO_BINARY_PATTERN " (0x%02X)", BYTE_TO_BINARY(bytes[i]), bytes[i]);
+    buf_append_printf(buf, sizeof(buf), 0, "0b" BYTE_TO_BINARY_PATTERN " (0x%02X)", BYTE_TO_BINARY(bytes[i]), bytes[i]);
     res += buf;
   }
   ESP_LOGD(TAG, "%s", res.c_str());

esphome/components/uptime/text_sensor/uptime_text_sensor.cpp

@@ -9,17 +9,12 @@ namespace uptime {
 
 static const char *const TAG = "uptime.sensor";
 
-// Clamp position to valid buffer range when snprintf indicates truncation
-static size_t clamp_buffer_pos(size_t pos, size_t buf_size) { return pos < buf_size ? pos : buf_size - 1; }
-
 static void append_unit(char *buf, size_t buf_size, size_t &pos, const char *separator, unsigned value,
                         const char *label) {
   if (pos > 0) {
-    pos += snprintf(buf + pos, buf_size - pos, "%s", separator);
-    pos = clamp_buffer_pos(pos, buf_size);
+    pos = buf_append_printf(buf, buf_size, pos, "%s", separator);
   }
-  pos += snprintf(buf + pos, buf_size - pos, "%u%s", value, label);
-  pos = clamp_buffer_pos(pos, buf_size);
+  pos = buf_append_printf(buf, buf_size, pos, "%u%s", value, label);
 }
 
 void UptimeTextSensor::setup() {

esphome/components/voice_assistant/voice_assistant.h

@@ -81,6 +81,8 @@ struct Timer {
              this->id.c_str(), this->name.c_str(), this->total_seconds, this->seconds_left, YESNO(this->is_active));
     return buffer.data();
   }
+  // Remove before 2026.8.0
+  ESPDEPRECATED("Use to_str() instead. Removed in 2026.8.0", "2026.2.0")
   std::string to_string() const {
     char buffer[TO_STR_BUFFER_SIZE];
     return this->to_str(buffer);

esphome/components/web_server/web_server.cpp

@@ -1188,11 +1188,7 @@ std::string WebServer::date_json_(datetime::DateEntity *obj, JsonDetail start_co
 
   // Format: YYYY-MM-DD (max 10 chars + null)
   char value[12];
-#ifdef USE_ESP8266
-  snprintf_P(value, sizeof(value), PSTR("%d-%02d-%02d"), obj->year, obj->month, obj->day);
-#else
-  snprintf(value, sizeof(value), "%d-%02d-%02d", obj->year, obj->month, obj->day);
-#endif
+  buf_append_printf(value, sizeof(value), 0, "%d-%02d-%02d", obj->year, obj->month, obj->day);
   set_json_icon_state_value(root, obj, "date", value, value, start_config);
   if (start_config == DETAIL_ALL) {
     this->add_sorting_info_(root, obj);
@@ -1251,11 +1247,7 @@ std::string WebServer::time_json_(datetime::TimeEntity *obj, JsonDetail start_co
 
   // Format: HH:MM:SS (8 chars + null)
   char value[12];
-#ifdef USE_ESP8266
-  snprintf_P(value, sizeof(value), PSTR("%02d:%02d:%02d"), obj->hour, obj->minute, obj->second);
-#else
-  snprintf(value, sizeof(value), "%02d:%02d:%02d", obj->hour, obj->minute, obj->second);
-#endif
+  buf_append_printf(value, sizeof(value), 0, "%02d:%02d:%02d", obj->hour, obj->minute, obj->second);
   set_json_icon_state_value(root, obj, "time", value, value, start_config);
   if (start_config == DETAIL_ALL) {
     this->add_sorting_info_(root, obj);
@@ -1314,13 +1306,8 @@ std::string WebServer::datetime_json_(datetime::DateTimeEntity *obj, JsonDetail
 
   // Format: YYYY-MM-DD HH:MM:SS (max 19 chars + null)
   char value[24];
-#ifdef USE_ESP8266
-  snprintf_P(value, sizeof(value), PSTR("%d-%02d-%02d %02d:%02d:%02d"), obj->year, obj->month, obj->day, obj->hour,
-             obj->minute, obj->second);
-#else
-  snprintf(value, sizeof(value), "%d-%02d-%02d %02d:%02d:%02d", obj->year, obj->month, obj->day, obj->hour, obj->minute,
-           obj->second);
-#endif
+  buf_append_printf(value, sizeof(value), 0, "%d-%02d-%02d %02d:%02d:%02d", obj->year, obj->month, obj->day, obj->hour,
+                    obj->minute, obj->second);
   set_json_icon_state_value(root, obj, "datetime", value, value, start_config);
   if (start_config == DETAIL_ALL) {
     this->add_sorting_info_(root, obj);

esphome/components/weikai/weikai.cpp

@@ -246,7 +246,7 @@ void WeikaiGPIOPin::setup() {
 }
 
 size_t WeikaiGPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via WeiKai %s", this->pin_, this->parent_->get_name());
+  return buf_append_printf(buffer, len, 0, "%u via WeiKai %s", this->pin_, this->parent_->get_name());
 }
 
 ///////////////////////////////////////////////////////////////////////////////

esphome/components/wiegand/wiegand.cpp

@@ -1,4 +1,5 @@
 #include "wiegand.h"
+#include <cinttypes>
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
@@ -69,32 +70,35 @@ void Wiegand::loop() {
   for (auto *trigger : this->raw_triggers_)
     trigger->trigger(count, value);
   if (count == 26) {
-    std::string tag = to_string((value >> 1) & 0xffffff);
-    ESP_LOGD(TAG, "received 26-bit tag: %s", tag.c_str());
+    char tag_buf[12];  // max 8 digits for 24-bit value + null
+    buf_append_printf(tag_buf, sizeof(tag_buf), 0, "%" PRIu32, static_cast<uint32_t>((value >> 1) & 0xffffff));
+    ESP_LOGD(TAG, "received 26-bit tag: %s", tag_buf);
     if (!check_eparity(value, 13, 13) || !check_oparity(value, 0, 13)) {
       ESP_LOGW(TAG, "invalid parity");
       return;
     }
     for (auto *trigger : this->tag_triggers_)
-      trigger->trigger(tag);
+      trigger->trigger(tag_buf);
   } else if (count == 34) {
-    std::string tag = to_string((value >> 1) & 0xffffffff);
-    ESP_LOGD(TAG, "received 34-bit tag: %s", tag.c_str());
+    char tag_buf[12];  // max 10 digits for 32-bit value + null
+    buf_append_printf(tag_buf, sizeof(tag_buf), 0, "%" PRIu32, static_cast<uint32_t>((value >> 1) & 0xffffffff));
+    ESP_LOGD(TAG, "received 34-bit tag: %s", tag_buf);
     if (!check_eparity(value, 17, 17) || !check_oparity(value, 0, 17)) {
       ESP_LOGW(TAG, "invalid parity");
       return;
     }
     for (auto *trigger : this->tag_triggers_)
-      trigger->trigger(tag);
+      trigger->trigger(tag_buf);
   } else if (count == 37) {
-    std::string tag = to_string((value >> 1) & 0x7ffffffff);
-    ESP_LOGD(TAG, "received 37-bit tag: %s", tag.c_str());
+    char tag_buf[12];  // max 11 digits for 35-bit value + null
+    buf_append_printf(tag_buf, sizeof(tag_buf), 0, "%" PRIu64, static_cast<uint64_t>((value >> 1) & 0x7ffffffff));
+    ESP_LOGD(TAG, "received 37-bit tag: %s", tag_buf);
     if (!check_eparity(value, 18, 19) || !check_oparity(value, 0, 19)) {
       ESP_LOGW(TAG, "invalid parity");
       return;
     }
     for (auto *trigger : this->tag_triggers_)
-      trigger->trigger(tag);
+      trigger->trigger(tag_buf);
   } else if (count == 4) {
     for (auto *trigger : this->key_triggers_)
       trigger->trigger(value);

esphome/components/wifi/wifi_component_libretiny.cpp

@@ -660,27 +660,21 @@ void WiFiComponent::wifi_scan_done_callback_() {
   this->scan_result_.clear();
   this->scan_done_ = true;
 
-  // Access scan data directly to avoid String allocation from WiFi.SSID(i)
-  // WiFi.scan is public in LibreTiny (WiFi.h)
-  if (WiFi.scan == nullptr || WiFi.scan->running)
+  int16_t num = WiFi.scanComplete();
+  if (num < 0)
     return;
 
-  uint8_t num = WiFi.scan->count;
-  if (num == 0) {
-    WiFi.scanDelete();
-    return;
-  }
+  this->scan_result_.init(static_cast<unsigned int>(num));
+  for (int i = 0; i < num; i++) {
+    String ssid = WiFi.SSID(i);
+    wifi_auth_mode_t authmode = WiFi.encryptionType(i);
+    int32_t rssi = WiFi.RSSI(i);
+    uint8_t *bssid = WiFi.BSSID(i);
+    int32_t channel = WiFi.channel(i);
 
-  this->scan_result_.init(num);
-  for (uint8_t i = 0; i < num; i++) {
-    const auto &ap = WiFi.scan->ap[i];
-    const char *ssid_cstr = ap.ssid;
-    size_t ssid_len = ssid_cstr ? strlen(ssid_cstr) : 0;
-
-    this->scan_result_.emplace_back(bssid_t{ap.bssid.addr[0], ap.bssid.addr[1], ap.bssid.addr[2], ap.bssid.addr[3],
-                                            ap.bssid.addr[4], ap.bssid.addr[5]},
-                                    std::string(ssid_cstr ? ssid_cstr : "", ssid_len), ap.channel, ap.rssi,
-                                    ap.auth != WIFI_AUTH_OPEN, ssid_len == 0);
+    this->scan_result_.emplace_back(bssid_t{bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]},
+                                    std::string(ssid.c_str()), channel, rssi, authmode != WIFI_AUTH_OPEN,
+                                    ssid.length() == 0);
   }
   WiFi.scanDelete();
 #ifdef USE_WIFI_SCAN_RESULTS_LISTENERS

esphome/components/wl_134/wl_134.cpp

@@ -1,4 +1,5 @@
 #include "wl_134.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 #include <cinttypes>
@@ -78,8 +79,8 @@ Wl134Component::Rfid134Error Wl134Component::read_packet_() {
            reading.id, reading.country, reading.isData ? "true" : "false", reading.isAnimal ? "true" : "false",
            reading.reserved0, reading.reserved1);
 
-  char buf[20];
-  sprintf(buf, "%03d%012lld", reading.country, reading.id);
+  char buf[20];  // "%03d" (3) + "%012" PRId64 (12) + null = 16 max
+  buf_append_printf(buf, sizeof(buf), 0, "%03d%012" PRId64, reading.country, reading.id);
   this->publish_state(buf);
   if (this->do_reset_) {
     this->set_timeout(1000, [this]() { this->publish_state(""); });

esphome/components/xl9535/xl9535.cpp

@@ -111,7 +111,7 @@ void XL9535Component::pin_mode(uint8_t pin, gpio::Flags mode) {
 void XL9535GPIOPin::setup() { this->pin_mode(this->flags_); }
 
 size_t XL9535GPIOPin::dump_summary(char *buffer, size_t len) const {
-  return snprintf(buffer, len, "%u via XL9535", this->pin_);
+  return buf_append_printf(buffer, len, 0, "%u via XL9535", this->pin_);
 }
 
 void XL9535GPIOPin::pin_mode(gpio::Flags flags) { this->parent_->pin_mode(this->pin_, flags); }

esphome/components/zephyr/preferences.cpp

@@ -5,6 +5,8 @@
 #include "esphome/core/preferences.h"
 #include "esphome/core/log.h"
 #include <zephyr/settings/settings.h>
+#include <cinttypes>
+#include <cstring>
 
 namespace esphome {
 namespace zephyr {
@@ -13,6 +15,9 @@ static const char *const TAG = "zephyr.preferences";
 
 #define ESPHOME_SETTINGS_KEY "esphome"
 
+// Buffer size for key: "esphome/" (8) + max hex uint32 (8) + null terminator (1) = 17; use 20 for safety margin
+static constexpr size_t KEY_BUFFER_SIZE = 20;
+
 class ZephyrPreferenceBackend : public ESPPreferenceBackend {
  public:
   ZephyrPreferenceBackend(uint32_t type) { this->type_ = type; }
@@ -27,7 +32,9 @@ class ZephyrPreferenceBackend : public ESPPreferenceBackend {
 
   bool load(uint8_t *data, size_t len) override {
     if (len != this->data.size()) {
-      ESP_LOGE(TAG, "size of setting key %s changed, from: %u, to: %u", get_key().c_str(), this->data.size(), len);
+      char key_buf[KEY_BUFFER_SIZE];
+      this->format_key(key_buf, sizeof(key_buf));
+      ESP_LOGE(TAG, "size of setting key %s changed, from: %u, to: %u", key_buf, this->data.size(), len);
       return false;
     }
     std::memcpy(data, this->data.data(), len);
@@ -36,7 +43,7 @@ class ZephyrPreferenceBackend : public ESPPreferenceBackend {
   }
 
   uint32_t get_type() const { return this->type_; }
-  std::string get_key() const { return str_sprintf(ESPHOME_SETTINGS_KEY "/%" PRIx32, this->type_); }
+  void format_key(char *buf, size_t size) const { snprintf(buf, size, ESPHOME_SETTINGS_KEY "/%" PRIx32, this->type_); }
 
   std::vector<uint8_t> data;
 
@@ -85,7 +92,9 @@ class ZephyrPreferences : public ESPPreferences {
     }
     printf("type %u size %u\n", type, this->backends_.size());
     auto *pref = new ZephyrPreferenceBackend(type);  // NOLINT(cppcoreguidelines-owning-memory)
-    ESP_LOGD(TAG, "Add new setting %s.", pref->get_key().c_str());
+    char key_buf[KEY_BUFFER_SIZE];
+    pref->format_key(key_buf, sizeof(key_buf));
+    ESP_LOGD(TAG, "Add new setting %s.", key_buf);
     this->backends_.push_back(pref);
     return ESPPreferenceObject(pref);
   }
@@ -134,9 +143,10 @@ class ZephyrPreferences : public ESPPreferences {
 
   static int export_settings(int (*cb)(const char *name, const void *value, size_t val_len)) {
     for (auto *backend : static_cast<ZephyrPreferences *>(global_preferences)->backends_) {
-      auto name = backend->get_key();
-      int err = cb(name.c_str(), backend->data.data(), backend->data.size());
-      ESP_LOGD(TAG, "save in flash, name %s, len %u, err %d", name.c_str(), backend->data.size(), err);
+      char name[KEY_BUFFER_SIZE];
+      backend->format_key(name, sizeof(name));
+      int err = cb(name, backend->data.data(), backend->data.size());
+      ESP_LOGD(TAG, "save in flash, name %s, len %u, err %d", name, backend->data.size(), err);
     }
     return 0;
   }

esphome/config_validation.py

@@ -1046,20 +1046,20 @@ def mac_address(value):
     return core.MACAddress(*parts_int)
 
 
-def bind_key(value):
+def bind_key(value, *, name="Bind key"):
     value = string_strict(value)
     parts = [value[i : i + 2] for i in range(0, len(value), 2)]
     if len(parts) != 16:
-        raise Invalid("Bind key must consist of 16 hexadecimal numbers")
+        raise Invalid(f"{name} must consist of 16 hexadecimal numbers")
     parts_int = []
     if any(len(part) != 2 for part in parts):
-        raise Invalid("Bind key must be format XX")
+        raise Invalid(f"{name} must be format XX")
     for part in parts:
         try:
             parts_int.append(int(part, 16))
         except ValueError:
             # pylint: disable=raise-missing-from
-            raise Invalid("Bind key must be hex values from 00 to FF")
+            raise Invalid(f"{name} must be hex values from 00 to FF")
 
     return "".join(f"{part:02X}" for part in parts_int)
 

esphome/core/helpers.cpp

@@ -206,11 +206,22 @@ std::string str_snake_case(const std::string &str) {
   }
   return result;
 }
-std::string str_sanitize(const std::string &str) {
-  std::string result = str;
-  for (char &c : result) {
-    c = to_sanitized_char(c);
+char *str_sanitize_to(char *buffer, size_t buffer_size, const char *str) {
+  if (buffer_size == 0) {
+    return buffer;
   }
+  size_t i = 0;
+  while (*str && i < buffer_size - 1) {
+    buffer[i++] = to_sanitized_char(*str++);
+  }
+  buffer[i] = '\0';
+  return buffer;
+}
+
+std::string str_sanitize(const std::string &str) {
+  std::string result;
+  result.resize(str.size());
+  str_sanitize_to(&result[0], str.size() + 1, str.c_str());
   return result;
 }
 std::string str_snprintf(const char *fmt, size_t len, ...) {

esphome/core/helpers.h

@@ -366,6 +366,35 @@ template<typename T> class FixedVector {
   const T *end() const { return data_ + size_; }
 };
 
+/// @brief Helper class for efficient buffer allocation - uses stack for small sizes, heap for large
+/// This is useful when most operations need a small buffer but occasionally need larger ones.
+/// The stack buffer avoids heap allocation in the common case, while heap fallback handles edge cases.
+template<size_t STACK_SIZE> class SmallBufferWithHeapFallback {
+ public:
+  explicit SmallBufferWithHeapFallback(size_t size) {
+    if (size <= STACK_SIZE) {
+      this->buffer_ = this->stack_buffer_;
+    } else {
+      this->heap_buffer_ = new uint8_t[size];
+      this->buffer_ = this->heap_buffer_;
+    }
+  }
+  ~SmallBufferWithHeapFallback() { delete[] this->heap_buffer_; }
+
+  // Delete copy and move operations to prevent double-delete
+  SmallBufferWithHeapFallback(const SmallBufferWithHeapFallback &) = delete;
+  SmallBufferWithHeapFallback &operator=(const SmallBufferWithHeapFallback &) = delete;
+  SmallBufferWithHeapFallback(SmallBufferWithHeapFallback &&) = delete;
+  SmallBufferWithHeapFallback &operator=(SmallBufferWithHeapFallback &&) = delete;
+
+  uint8_t *get() { return this->buffer_; }
+
+ private:
+  uint8_t stack_buffer_[STACK_SIZE];
+  uint8_t *heap_buffer_{nullptr};
+  uint8_t *buffer_;
+};
+
 ///@}
 
 /// @name Mathematics
@@ -580,7 +609,25 @@ std::string str_snake_case(const std::string &str);
 constexpr char to_sanitized_char(char c) {
   return (c == '-' || c == '_' || (c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')) ? c : '_';
 }
+
+/** Sanitize a string to buffer, keeping only alphanumerics, dashes, and underscores.
+ *
+ * @param buffer Output buffer to write to.
+ * @param buffer_size Size of the output buffer.
+ * @param str Input string to sanitize.
+ * @return Pointer to buffer.
+ *
+ * Buffer size needed: strlen(str) + 1.
+ */
+char *str_sanitize_to(char *buffer, size_t buffer_size, const char *str);
+
+/// Sanitize a string to buffer. Automatically deduces buffer size.
+template<size_t N> inline char *str_sanitize_to(char (&buffer)[N], const char *str) {
+  return str_sanitize_to(buffer, N, str);
+}
+
 /// Sanitizes the input string by removing all characters but alphanumerics, dashes and underscores.
+/// @warning Allocates heap memory. Use str_sanitize_to() with a stack buffer instead.
 std::string str_sanitize(const std::string &str);
 
 /// Calculate FNV-1 hash of a string while applying snake_case + sanitize transformations.

esphome/core/scheduler.h

@@ -403,7 +403,9 @@ class Scheduler {
       for (size_t i = 0; i < remaining; i++) {
         this->defer_queue_[i] = std::move(this->defer_queue_[this->defer_queue_front_ + i]);
       }
-      this->defer_queue_.resize(remaining);
+      // Use erase() instead of resize() to avoid instantiating _M_default_append
+      // (saves ~156 bytes flash). Erasing from the end is O(1) - no shifting needed.
+      this->defer_queue_.erase(this->defer_queue_.begin() + remaining, this->defer_queue_.end());
     }
     this->defer_queue_front_ = 0;
   }

esphome/core/string_ref.h

@@ -72,6 +72,7 @@ class StringRef {
 
   constexpr const char *c_str() const { return base_; }
   constexpr size_type size() const { return len_; }
+  constexpr size_type length() const { return len_; }
   constexpr bool empty() const { return len_ == 0; }
   constexpr const_reference operator[](size_type pos) const { return *(base_ + pos); }
 
@@ -80,6 +81,32 @@ class StringRef {
 
   operator std::string() const { return str(); }
 
+  /// Find first occurrence of substring, returns std::string::npos if not found.
+  /// Note: Requires the underlying string to be null-terminated.
+  size_type find(const char *s, size_type pos = 0) const {
+    if (pos >= len_)
+      return std::string::npos;
+    const char *result = std::strstr(base_ + pos, s);
+    // Verify entire match is within bounds (strstr searches to null terminator)
+    if (result && result + std::strlen(s) <= base_ + len_)
+      return static_cast<size_type>(result - base_);
+    return std::string::npos;
+  }
+  size_type find(char c, size_type pos = 0) const {
+    if (pos >= len_)
+      return std::string::npos;
+    const void *result = std::memchr(base_ + pos, static_cast<unsigned char>(c), len_ - pos);
+    return result ? static_cast<size_type>(static_cast<const char *>(result) - base_) : std::string::npos;
+  }
+
+  /// Return substring as std::string
+  std::string substr(size_type pos = 0, size_type count = std::string::npos) const {
+    if (pos >= len_)
+      return std::string();
+    size_type actual_count = (count == std::string::npos || pos + count > len_) ? len_ - pos : count;
+    return std::string(base_ + pos, actual_count);
+  }
+
  private:
   const char *base_;
   size_type len_;
@@ -160,6 +187,43 @@ inline std::string operator+(const std::string &lhs, const StringRef &rhs) {
   str.append(rhs.c_str(), rhs.size());
   return str;
 }
+// String conversion functions for ADL compatibility (allows stoi(x) where x is StringRef)
+// Must be in esphome namespace for ADL to find them. Uses strtol/strtod directly to avoid heap allocation.
+namespace internal {
+// NOLINTBEGIN(google-runtime-int)
+template<typename R, typename F> inline R parse_number(const StringRef &str, size_t *pos, F conv) {
+  char *end;
+  R result = conv(str.c_str(), &end);
+  // Set pos to 0 on conversion failure (when no characters consumed), otherwise index after number
+  if (pos)
+    *pos = (end == str.c_str()) ? 0 : static_cast<size_t>(end - str.c_str());
+  return result;
+}
+template<typename R, typename F> inline R parse_number(const StringRef &str, size_t *pos, int base, F conv) {
+  char *end;
+  R result = conv(str.c_str(), &end, base);
+  // Set pos to 0 on conversion failure (when no characters consumed), otherwise index after number
+  if (pos)
+    *pos = (end == str.c_str()) ? 0 : static_cast<size_t>(end - str.c_str());
+  return result;
+}
+// NOLINTEND(google-runtime-int)
+}  // namespace internal
+// NOLINTBEGIN(readability-identifier-naming,google-runtime-int)
+inline int stoi(const StringRef &str, size_t *pos = nullptr, int base = 10) {
+  return static_cast<int>(internal::parse_number<long>(str, pos, base, std::strtol));
+}
+inline long stol(const StringRef &str, size_t *pos = nullptr, int base = 10) {
+  return internal::parse_number<long>(str, pos, base, std::strtol);
+}
+inline float stof(const StringRef &str, size_t *pos = nullptr) {
+  return internal::parse_number<float>(str, pos, std::strtof);
+}
+inline double stod(const StringRef &str, size_t *pos = nullptr) {
+  return internal::parse_number<double>(str, pos, std::strtod);
+}
+// NOLINTEND(readability-identifier-naming,google-runtime-int)
+
 #ifdef USE_JSON
 // NOLINTNEXTLINE(readability-identifier-naming)
 inline void convertToJson(const StringRef &src, JsonVariant dst) { dst.set(src.c_str()); }

esphome/cpp_types.py

@@ -44,3 +44,4 @@ gpio_Flags = gpio_ns.enum("Flags", is_class=True)
 EntityCategory = esphome_ns.enum("EntityCategory")
 Parented = esphome_ns.class_("Parented")
 ESPTime = esphome_ns.struct("ESPTime")
+StringRef = esphome_ns.class_("StringRef")

script/ci-custom.py

@@ -688,6 +688,7 @@ HEAP_ALLOCATING_HELPERS = {
     "format_mac_address_pretty": "format_mac_addr_upper() with a stack buffer",
     "get_mac_address": "get_mac_address_into_buffer() with a stack buffer",
     "get_mac_address_pretty": "get_mac_address_pretty_into_buffer() with a stack buffer",
+    "str_sanitize": "str_sanitize_to() with a stack buffer",
     "str_truncate": "removal (function is unused)",
     "str_upper_case": "removal (function is unused)",
     "str_snake_case": "removal (function is unused)",
@@ -706,6 +707,7 @@ HEAP_ALLOCATING_HELPERS = {
     r"format_mac_address_pretty|"
     r"get_mac_address_pretty(?!_)|"
     r"get_mac_address(?!_)|"
+    r"str_sanitize(?!_)|"
     r"str_truncate|"
     r"str_upper_case|"
     r"str_snake_case"
@@ -730,6 +732,26 @@ def lint_no_heap_allocating_helpers(fname, match):
     )
 
 
+@lint_re_check(
+    # Match sprintf/vsprintf but not snprintf/vsnprintf
+    # [^\w] ensures we don't match the safe variants
+    r"[^\w](v?sprintf)\s*\(" + CPP_RE_EOL,
+    include=cpp_include,
+)
+def lint_no_sprintf(fname, match):
+    func = match.group(1)
+    safe_func = func.replace("sprintf", "snprintf")
+    return (
+        f"{highlight(func + '()')} is not allowed in ESPHome. It has no buffer size limit "
+        f"and can cause buffer overflows.\n"
+        f"Please use one of these alternatives:\n"
+        f"  - {highlight(safe_func + '(buf, sizeof(buf), fmt, ...)')} for general formatting\n"
+        f"  - {highlight('buf_append_printf(buf, sizeof(buf), pos, fmt, ...)')} for "
+        f"offset-based formatting (also stores format strings in flash on ESP8266)\n"
+        f"(If strictly necessary, add `// NOLINT` to the end of the line)"
+    )
+
+
 @lint_content_find_check(
     "ESP_LOG",
     include=["*.h", "*.tcc"],