[am43][lightwaverf][rf_bridge][spi_led_strip] Replace sprintf with safe alternatives

esphome/components/am43/am43_base.cpp

@@ -1,6 +1,6 @@
 #include "am43_base.h"
+#include "esphome/core/helpers.h"
 #include <cstring>
-#include <cstdio>
 
 namespace esphome {
 namespace am43 {
@@ -8,12 +8,9 @@ namespace am43 {
 const uint8_t START_PACKET[5] = {0x00, 0xff, 0x00, 0x00, 0x9a};
 
 std::string pkt_to_hex(const uint8_t *data, uint16_t len) {
-  char buf[64];
-  memset(buf, 0, 64);
-  for (int i = 0; i < len; i++)
-    sprintf(&buf[i * 2], "%02x", data[i]);
-  std::string ret = buf;
-  return ret;
+  char buf[64];  // format_hex_size(31) = 63, fits 31 bytes of hex data
+  format_hex_to(buf, sizeof(buf), data, len);
+  return buf;
 }
 
 Am43Packet *Am43Encoder::get_battery_level_request() {

esphome/components/api/proto.cpp

@@ -48,14 +48,14 @@ uint32_t ProtoDecodableMessage::count_repeated_field(const uint8_t *buffer, size
         }
         uint32_t field_length = res->as_uint32();
         ptr += consumed;
-        if (field_length > static_cast<size_t>(end - ptr)) {
+        if (ptr + field_length > end) {
           return count;  // Out of bounds
         }
         ptr += field_length;
         break;
       }
       case WIRE_TYPE_FIXED32: {  // 32-bit - skip 4 bytes
-        if (end - ptr < 4) {
+        if (ptr + 4 > end) {
           return count;
         }
         ptr += 4;
@@ -110,7 +110,7 @@ void ProtoDecodableMessage::decode(const uint8_t *buffer, size_t length) {
         }
         uint32_t field_length = res->as_uint32();
         ptr += consumed;
-        if (field_length > static_cast<size_t>(end - ptr)) {
+        if (ptr + field_length > end) {
           ESP_LOGV(TAG, "Out-of-bounds Length Delimited at offset %ld", (long) (ptr - buffer));
           return;
         }
@@ -121,7 +121,7 @@ void ProtoDecodableMessage::decode(const uint8_t *buffer, size_t length) {
         break;
       }
       case WIRE_TYPE_FIXED32: {  // 32-bit
-        if (end - ptr < 4) {
+        if (ptr + 4 > end) {
           ESP_LOGV(TAG, "Out-of-bounds Fixed32-bit at offset %ld", (long) (ptr - buffer));
           return;
         }

esphome/components/hmac_sha256/hmac_sha256.cpp

@@ -1,3 +1,4 @@
+#include <cstdio>
 #include <cstring>
 #include "hmac_sha256.h"
 #if defined(USE_ESP32) || defined(USE_ESP8266) || defined(USE_RP2040) || defined(USE_LIBRETINY) || defined(USE_HOST)
@@ -25,7 +26,9 @@ void HmacSHA256::calculate() { mbedtls_md_hmac_finish(&this->ctx_, this->digest_
 void HmacSHA256::get_bytes(uint8_t *output) { memcpy(output, this->digest_, SHA256_DIGEST_SIZE); }
 
 void HmacSHA256::get_hex(char *output) {
-  format_hex_to(output, SHA256_DIGEST_SIZE * 2 + 1, this->digest_, SHA256_DIGEST_SIZE);
+  for (size_t i = 0; i < SHA256_DIGEST_SIZE; i++) {
+    sprintf(output + (i * 2), "%02x", this->digest_[i]);
+  }
 }
 
 bool HmacSHA256::equals_bytes(const uint8_t *expected) {

esphome/components/http_request/http_request.h

@@ -242,7 +242,9 @@ template<typename... Ts> class HttpRequestSendAction : public Action<Ts...> {
       return;
     }
 
-    size_t max_length = this->max_response_buffer_size_;
+    size_t content_length = container->content_length;
+    size_t max_length = std::min(content_length, this->max_response_buffer_size_);
+
 #ifdef USE_HTTP_REQUEST_RESPONSE
     if (this->capture_response_.value(x...)) {
       std::string response_body;

esphome/components/http_request/http_request_idf.cpp

@@ -213,12 +213,18 @@ int HttpContainerIDF::read(uint8_t *buf, size_t max_len) {
   const uint32_t start = millis();
   watchdog::WatchdogManager wdm(this->parent_->get_watchdog_timeout());
 
-  this->feed_wdt();
-  int read_len = esp_http_client_read(this->client_, (char *) buf, max_len);
-  this->feed_wdt();
-  if (read_len > 0) {
-    this->bytes_read_ += read_len;
+  int bufsize = std::min(max_len, this->content_length - this->bytes_read_);
+
+  if (bufsize == 0) {
+    this->duration_ms += (millis() - start);
+    return 0;
   }
+
+  this->feed_wdt();
+  int read_len = esp_http_client_read(this->client_, (char *) buf, bufsize);
+  this->feed_wdt();
+  this->bytes_read_ += read_len;
+
   this->duration_ms += (millis() - start);
 
   return read_len;

esphome/components/hub75/display.py

@@ -1,4 +1,3 @@
-import logging
 from typing import Any
 
 from esphome import automation, pins
@@ -19,16 +18,13 @@ from esphome.const import (
     CONF_ROTATION,
     CONF_UPDATE_INTERVAL,
 )
-from esphome.core import ID, EnumValue
+from esphome.core import ID
 from esphome.cpp_generator import MockObj, TemplateArgsType
 import esphome.final_validate as fv
-from esphome.helpers import add_class_to_obj
 from esphome.types import ConfigType
 
 from . import boards, hub75_ns
 
-_LOGGER = logging.getLogger(__name__)
-
 DEPENDENCIES = ["esp32"]
 CODEOWNERS = ["@stuartparmenter"]
 
@@ -124,51 +120,13 @@ PANEL_LAYOUTS = {
 }
 
 Hub75ScanWiring = cg.global_ns.enum("Hub75ScanWiring", is_class=True)
-SCAN_WIRINGS = {
+SCAN_PATTERNS = {
     "STANDARD_TWO_SCAN": Hub75ScanWiring.STANDARD_TWO_SCAN,
-    "SCAN_1_4_16PX_HIGH": Hub75ScanWiring.SCAN_1_4_16PX_HIGH,
-    "SCAN_1_8_32PX_HIGH": Hub75ScanWiring.SCAN_1_8_32PX_HIGH,
-    "SCAN_1_8_40PX_HIGH": Hub75ScanWiring.SCAN_1_8_40PX_HIGH,
-    "SCAN_1_8_64PX_HIGH": Hub75ScanWiring.SCAN_1_8_64PX_HIGH,
+    "FOUR_SCAN_16PX_HIGH": Hub75ScanWiring.FOUR_SCAN_16PX_HIGH,
+    "FOUR_SCAN_32PX_HIGH": Hub75ScanWiring.FOUR_SCAN_32PX_HIGH,
+    "FOUR_SCAN_64PX_HIGH": Hub75ScanWiring.FOUR_SCAN_64PX_HIGH,
 }
 
-# Deprecated scan wiring names - mapped to new names
-DEPRECATED_SCAN_WIRINGS = {
-    "FOUR_SCAN_16PX_HIGH": "SCAN_1_4_16PX_HIGH",
-    "FOUR_SCAN_32PX_HIGH": "SCAN_1_8_32PX_HIGH",
-    "FOUR_SCAN_64PX_HIGH": "SCAN_1_8_64PX_HIGH",
-}
-
-
-def _validate_scan_wiring(value):
-    """Validate scan_wiring with deprecation warnings for old names."""
-    value = cv.string(value).upper().replace(" ", "_")
-
-    # Check if using deprecated name
-    # Remove deprecated names in 2026.7.0
-    if value in DEPRECATED_SCAN_WIRINGS:
-        new_name = DEPRECATED_SCAN_WIRINGS[value]
-        _LOGGER.warning(
-            "Scan wiring '%s' is deprecated and will be removed in ESPHome 2026.7.0. "
-            "Please use '%s' instead.",
-            value,
-            new_name,
-        )
-        value = new_name
-
-    # Validate against allowed values
-    if value not in SCAN_WIRINGS:
-        raise cv.Invalid(
-            f"Unknown scan wiring '{value}'. "
-            f"Valid options are: {', '.join(sorted(SCAN_WIRINGS.keys()))}"
-        )
-
-    # Return as EnumValue like cv.enum does
-    result = add_class_to_obj(value, EnumValue)
-    result.enum_value = SCAN_WIRINGS[value]
-    return result
-
-
 Hub75ClockSpeed = cg.global_ns.enum("Hub75ClockSpeed", is_class=True)
 CLOCK_SPEEDS = {
     "8MHZ": Hub75ClockSpeed.HZ_8M,
@@ -424,7 +382,9 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_LAYOUT_COLS): cv.positive_int,
             cv.Optional(CONF_LAYOUT): cv.enum(PANEL_LAYOUTS, upper=True, space="_"),
             # Panel hardware configuration
-            cv.Optional(CONF_SCAN_WIRING): _validate_scan_wiring,
+            cv.Optional(CONF_SCAN_WIRING): cv.enum(
+                SCAN_PATTERNS, upper=True, space="_"
+            ),
             cv.Optional(CONF_SHIFT_DRIVER): cv.enum(SHIFT_DRIVERS, upper=True),
             # Display configuration
             cv.Optional(CONF_DOUBLE_BUFFER): cv.boolean,
@@ -587,7 +547,7 @@ def _build_config_struct(
 async def to_code(config: ConfigType) -> None:
     add_idf_component(
         name="esphome/esp-hub75",
-        ref="0.3.0",
+        ref="0.2.2",
     )
 
     # Set compile-time configuration via build flags (so external library sees them)

esphome/components/infrared/infrared.cpp

@@ -19,12 +19,12 @@ InfraredCall &InfraredCall::set_carrier_frequency(uint32_t frequency) {
 InfraredCall &InfraredCall::set_raw_timings(const std::vector<int32_t> &timings) {
   this->raw_timings_ = &timings;
   this->packed_data_ = nullptr;
-  this->base64url_ptr_ = nullptr;
+  this->base85_ptr_ = nullptr;
   return *this;
 }
 
-InfraredCall &InfraredCall::set_raw_timings_base64url(const std::string &base64url) {
-  this->base64url_ptr_ = &base64url;
+InfraredCall &InfraredCall::set_raw_timings_base85(const std::string &base85) {
+  this->base85_ptr_ = &base85;
   this->raw_timings_ = nullptr;
   this->packed_data_ = nullptr;
   return *this;
@@ -35,7 +35,7 @@ InfraredCall &InfraredCall::set_raw_timings_packed(const uint8_t *data, uint16_t
   this->packed_length_ = length;
   this->packed_count_ = count;
   this->raw_timings_ = nullptr;
-  this->base64url_ptr_ = nullptr;
+  this->base85_ptr_ = nullptr;
   return *this;
 }
 
@@ -101,22 +101,13 @@ void Infrared::control(const InfraredCall &call) {
                                                call.get_packed_count());
     ESP_LOGD(TAG, "Transmitting packed raw timings: count=%u, repeat=%u", call.get_packed_count(),
              call.get_repeat_count());
-  } else if (call.is_base64url()) {
-    // Decode base64url (URL-safe) into transmit buffer
-    if (!transmit_data->set_data_from_base64url(call.get_base64url_data())) {
-      ESP_LOGE(TAG, "Invalid base64url data");
+  } else if (call.is_base85()) {
+    // Decode base85 directly into transmit buffer (zero heap allocations)
+    if (!transmit_data->set_data_from_base85(call.get_base85_data())) {
+      ESP_LOGE(TAG, "Invalid base85 data");
       return;
     }
-    // Sanity check: validate timing values are within reasonable bounds
-    constexpr int32_t max_timing_us = 500000;  // 500ms absolute max
-    for (int32_t timing : transmit_data->get_data()) {
-      int32_t abs_timing = timing < 0 ? -timing : timing;
-      if (abs_timing > max_timing_us) {
-        ESP_LOGE(TAG, "Invalid timing value: %d µs (max %d)", timing, max_timing_us);
-        return;
-      }
-    }
-    ESP_LOGD(TAG, "Transmitting base64url raw timings: count=%zu, repeat=%u", transmit_data->get_data().size(),
+    ESP_LOGD(TAG, "Transmitting base85 raw timings: count=%zu, repeat=%u", transmit_data->get_data().size(),
              call.get_repeat_count());
   } else {
     // From vector (lambdas/automations)

esphome/components/infrared/infrared.h

@@ -40,11 +40,11 @@ class InfraredCall {
   /// @note Usage: Primarily for lambdas/automations where the vector is in scope.
   InfraredCall &set_raw_timings(const std::vector<int32_t> &timings);
 
-  /// Set the raw timings from base64url-encoded little-endian int32 data
+  /// Set the raw timings from base85-encoded int32 data
   /// @note Lifetime: Stores a pointer to the string. The string must outlive perform().
-  /// @note Usage: For web_server - base64url is fully URL-safe (uses '-' and '_').
+  /// @note Usage: For web_server where the encoded string is on the stack.
   /// @note Decoding happens at perform() time, directly into the transmit buffer.
-  InfraredCall &set_raw_timings_base64url(const std::string &base64url);
+  InfraredCall &set_raw_timings_base85(const std::string &base85);
 
   /// Set the raw timings from packed protobuf sint32 data (zigzag + varint encoded)
   /// @note Lifetime: Stores a pointer to the buffer. The buffer must outlive perform().
@@ -59,18 +59,18 @@ class InfraredCall {
 
   /// Get the carrier frequency
   const optional<uint32_t> &get_carrier_frequency() const { return this->carrier_frequency_; }
-  /// Get the raw timings (only valid if set via set_raw_timings)
+  /// Get the raw timings (only valid if set via set_raw_timings, not packed or base85)
   const std::vector<int32_t> &get_raw_timings() const { return *this->raw_timings_; }
-  /// Check if raw timings have been set (any format)
+  /// Check if raw timings have been set (vector, packed, or base85)
   bool has_raw_timings() const {
-    return this->raw_timings_ != nullptr || this->packed_data_ != nullptr || this->base64url_ptr_ != nullptr;
+    return this->raw_timings_ != nullptr || this->packed_data_ != nullptr || this->base85_ptr_ != nullptr;
   }
   /// Check if using packed data format
   bool is_packed() const { return this->packed_data_ != nullptr; }
-  /// Check if using base64url data format
-  bool is_base64url() const { return this->base64url_ptr_ != nullptr; }
-  /// Get the base64url data string
-  const std::string &get_base64url_data() const { return *this->base64url_ptr_; }
+  /// Check if using base85 data format
+  bool is_base85() const { return this->base85_ptr_ != nullptr; }
+  /// Get the base85 data string
+  const std::string &get_base85_data() const { return *this->base85_ptr_; }
   /// Get packed data (only valid if set via set_raw_timings_packed)
   const uint8_t *get_packed_data() const { return this->packed_data_; }
   uint16_t get_packed_length() const { return this->packed_length_; }
@@ -84,8 +84,8 @@ class InfraredCall {
   optional<uint32_t> carrier_frequency_;
   // Pointer to vector-based timings (caller-owned, must outlive perform())
   const std::vector<int32_t> *raw_timings_{nullptr};
-  // Pointer to base64url-encoded string (caller-owned, must outlive perform())
-  const std::string *base64url_ptr_{nullptr};
+  // Pointer to base85-encoded string (caller-owned, must outlive perform())
+  const std::string *base85_ptr_{nullptr};
   // Pointer to packed protobuf buffer (caller-owned, must outlive perform())
   const uint8_t *packed_data_{nullptr};
   uint16_t packed_length_{0};

esphome/components/lightwaverf/lightwaverf.cpp

@@ -1,3 +1,4 @@
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 #ifdef USE_ESP8266
@@ -44,13 +45,16 @@ void LightWaveRF::send_rx(const std::vector<uint8_t> &msg, uint8_t repeats, bool
 }
 
 void LightWaveRF::print_msg_(uint8_t *msg, uint8_t len) {
-  char buffer[65];
+#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_DEBUG
+  char buffer[65];  // max 10 entries * 6 chars + null
   ESP_LOGD(TAG, " Received code (len:%i): ", len);
 
+  size_t pos = 0;
   for (int i = 0; i < len; i++) {
-    sprintf(&buffer[i * 6], "0x%02x, ", msg[i]);
+    pos = buf_append_printf(buffer, sizeof(buffer), pos, "0x%02x, ", msg[i]);
   }
   ESP_LOGD(TAG, "[%s]", buffer);
+#endif
 }
 
 void LightWaveRF::dump_config() {

esphome/components/mqtt/custom_mqtt_device.cpp

@@ -18,7 +18,7 @@ bool CustomMQTTDevice::publish(const std::string &topic, float value, int8_t num
 }
 bool CustomMQTTDevice::publish(const std::string &topic, int value) {
   char buffer[24];
-  size_t len = buf_append_printf(buffer, sizeof(buffer), 0, "%d", value);
+  int len = snprintf(buffer, sizeof(buffer), "%d", value);
   return global_mqtt_client->publish(topic, buffer, len);
 }
 bool CustomMQTTDevice::publish_json(const std::string &topic, const json::json_build_t &f, uint8_t qos, bool retain) {

esphome/components/mqtt/mqtt_client.cpp

@@ -91,17 +91,7 @@ void MQTTClientComponent::send_device_info_() {
         uint8_t index = 0;
         for (auto &ip : network::get_ip_addresses()) {
           if (ip.is_set()) {
-            char key[8];  // "ip" + up to 3 digits + null
-            char ip_buf[network::IP_ADDRESS_BUFFER_SIZE];
-            if (index == 0) {
-              key[0] = 'i';
-              key[1] = 'p';
-              key[2] = '\0';
-            } else {
-              buf_append_printf(key, sizeof(key), 0, "ip%u", index);
-            }
-            ip.str_to(ip_buf);
-            root[key] = ip_buf;
+            root["ip" + (index == 0 ? "" : esphome::to_string(index))] = ip.str();
             index++;
           }
         }

esphome/components/mqtt/mqtt_component.cpp

@@ -189,37 +189,27 @@ bool MQTTComponent::send_discovery_() {
         StringRef object_id = this->get_default_object_id_to_(object_id_buf);
         if (discovery_info.unique_id_generator == MQTT_MAC_ADDRESS_UNIQUE_ID_GENERATOR) {
           char friendly_name_hash[9];
-          buf_append_printf(friendly_name_hash, sizeof(friendly_name_hash), 0, "%08" PRIx32,
-                            fnv1_hash(this->friendly_name_()));
+          snprintf(friendly_name_hash, sizeof(friendly_name_hash), "%08" PRIx32, fnv1_hash(this->friendly_name_()));
           // Format: mac-component_type-hash (e.g. "aabbccddeeff-sensor-12345678")
           // MAC (12) + "-" (1) + domain (max 20) + "-" (1) + hash (8) + null (1) = 43
           char unique_id[MAC_ADDRESS_BUFFER_SIZE + ESPHOME_DOMAIN_MAX_LEN + 11];
           char mac_buf[MAC_ADDRESS_BUFFER_SIZE];
           get_mac_address_into_buffer(mac_buf);
-          buf_append_printf(unique_id, sizeof(unique_id), 0, "%s-%s-%s", mac_buf, this->component_type(),
-                            friendly_name_hash);
+          snprintf(unique_id, sizeof(unique_id), "%s-%s-%s", mac_buf, this->component_type(), friendly_name_hash);
           root[MQTT_UNIQUE_ID] = unique_id;
         } else {
           // default to almost-unique ID. It's a hack but the only way to get that
           // gorgeous device registry view.
-          // "ESP" (3) + component_type (max 20) + object_id (max 128) + null
-          char unique_id_buf[3 + MQTT_COMPONENT_TYPE_MAX_LEN + OBJECT_ID_MAX_LEN + 1];
-          buf_append_printf(unique_id_buf, sizeof(unique_id_buf), 0, "ESP%s%s", this->component_type(),
-                            object_id.c_str());
-          root[MQTT_UNIQUE_ID] = unique_id_buf;
+          root[MQTT_UNIQUE_ID] = "ESP" + std::string(this->component_type()) + object_id.c_str();
         }
 
         const std::string &node_name = App.get_name();
-        if (discovery_info.object_id_generator == MQTT_DEVICE_NAME_OBJECT_ID_GENERATOR) {
-          // node_name (max 31) + "_" (1) + object_id (max 128) + null
-          char object_id_full[ESPHOME_DEVICE_NAME_MAX_LEN + 1 + OBJECT_ID_MAX_LEN + 1];
-          buf_append_printf(object_id_full, sizeof(object_id_full), 0, "%s_%s", node_name.c_str(), object_id.c_str());
-          root[MQTT_OBJECT_ID] = object_id_full;
-        }
+        if (discovery_info.object_id_generator == MQTT_DEVICE_NAME_OBJECT_ID_GENERATOR)
+          root[MQTT_OBJECT_ID] = node_name + "_" + object_id.c_str();
 
         const std::string &friendly_name_ref = App.get_friendly_name();
         const std::string &node_friendly_name = friendly_name_ref.empty() ? node_name : friendly_name_ref;
-        const char *node_area = App.get_area();
+        std::string node_area = App.get_area();
 
         JsonObject device_info = root[MQTT_DEVICE].to<JsonObject>();
         char mac[MAC_ADDRESS_BUFFER_SIZE];
@@ -230,29 +220,18 @@ bool MQTTComponent::send_discovery_() {
         device_info[MQTT_DEVICE_SW_VERSION] = ESPHOME_PROJECT_VERSION " (ESPHome " ESPHOME_VERSION ")";
         const char *model = std::strchr(ESPHOME_PROJECT_NAME, '.');
         device_info[MQTT_DEVICE_MODEL] = model == nullptr ? ESPHOME_BOARD : model + 1;
-        if (model == nullptr) {
-          device_info[MQTT_DEVICE_MANUFACTURER] = ESPHOME_PROJECT_NAME;
-        } else {
-          // Extract manufacturer (part before '.') using stack buffer to avoid heap allocation
-          // memcpy is used instead of strncpy since we know the exact length and strncpy
-          // would still require manual null-termination
-          char manufacturer[sizeof(ESPHOME_PROJECT_NAME)];
-          size_t len = model - ESPHOME_PROJECT_NAME;
-          memcpy(manufacturer, ESPHOME_PROJECT_NAME, len);
-          manufacturer[len] = '\0';
-          device_info[MQTT_DEVICE_MANUFACTURER] = manufacturer;
-        }
+        device_info[MQTT_DEVICE_MANUFACTURER] =
+            model == nullptr ? ESPHOME_PROJECT_NAME : std::string(ESPHOME_PROJECT_NAME, model - ESPHOME_PROJECT_NAME);
 #else
         static const char ver_fmt[] PROGMEM = ESPHOME_VERSION " (config hash 0x%08" PRIx32 ")";
-        // Buffer sized for format string expansion: ~4 bytes net growth from format specifier to 8 hex digits, plus
-        // safety margin
-        char version_buf[sizeof(ver_fmt) + 8];
 #ifdef USE_ESP8266
-        snprintf_P(version_buf, sizeof(version_buf), ver_fmt, App.get_config_hash());
+        char fmt_buf[sizeof(ver_fmt)];
+        strcpy_P(fmt_buf, ver_fmt);
+        const char *fmt = fmt_buf;
 #else
-        snprintf(version_buf, sizeof(version_buf), ver_fmt, App.get_config_hash());
+        const char *fmt = ver_fmt;
 #endif
-        device_info[MQTT_DEVICE_SW_VERSION] = version_buf;
+        device_info[MQTT_DEVICE_SW_VERSION] = str_sprintf(fmt, App.get_config_hash());
         device_info[MQTT_DEVICE_MODEL] = ESPHOME_BOARD;
 #if defined(USE_ESP8266) || defined(USE_ESP32)
         device_info[MQTT_DEVICE_MANUFACTURER] = "Espressif";
@@ -266,7 +245,7 @@ bool MQTTComponent::send_discovery_() {
         device_info[MQTT_DEVICE_MANUFACTURER] = "Host";
 #endif
 #endif
-        if (node_area[0] != '\0') {
+        if (!node_area.empty()) {
           device_info[MQTT_DEVICE_SUGGESTED_AREA] = node_area;
         }
 

esphome/components/mqtt/mqtt_fan.cpp

@@ -175,7 +175,7 @@ bool MQTTFanComponent::publish_state() {
   auto traits = this->state_->get_traits();
   if (traits.supports_speed()) {
     char buf[12];
-    size_t len = buf_append_printf(buf, sizeof(buf), 0, "%d", this->state_->speed);
+    int len = snprintf(buf, sizeof(buf), "%d", this->state_->speed);
     bool success = this->publish(this->get_speed_level_state_topic(), buf, len);
     failed = failed || !success;
   }

esphome/components/mqtt/mqtt_number.cpp

@@ -75,7 +75,7 @@ bool MQTTNumberComponent::send_initial_state() {
 }
 bool MQTTNumberComponent::publish_state(float value) {
   char buffer[64];
-  buf_append_printf(buffer, sizeof(buffer), 0, "%f", value);
+  snprintf(buffer, sizeof(buffer), "%f", value);
   return this->publish(this->get_state_topic_(), buffer);
 }
 

esphome/components/remote_base/remote_base.cpp

@@ -2,6 +2,8 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
+#include <cinttypes>
+
 namespace esphome {
 namespace remote_base {
 
@@ -158,8 +160,8 @@ void RemoteTransmitData::set_data_from_packed_sint32(const uint8_t *data, size_t
   }
 }
 
-bool RemoteTransmitData::set_data_from_base64url(const std::string &base64url) {
-  return base64_decode_int32_vector(base64url, this->data_);
+bool RemoteTransmitData::set_data_from_base85(const std::string &base85) {
+  return base85_decode_int32_vector(base85, this->data_);
 }
 
 /* RemoteTransmitterBase */

esphome/components/remote_base/remote_base.h

@@ -36,11 +36,11 @@ class RemoteTransmitData {
   /// @param len Length of the buffer in bytes
   /// @param count Number of values (for reserve optimization)
   void set_data_from_packed_sint32(const uint8_t *data, size_t len, size_t count);
-  /// Set data from base64url-encoded little-endian int32 values
-  /// Base64url is URL-safe: uses '-' instead of '+', '_' instead of '/'
-  /// @param base64url Base64url-encoded string of little-endian int32 values
+  /// Set data from base85-encoded int32 values
+  /// Decodes directly into internal buffer (zero heap allocations)
+  /// @param base85 Base85-encoded string (5 chars per int32 value)
   /// @return true if successful, false if decode failed or invalid size
-  bool set_data_from_base64url(const std::string &base64url);
+  bool set_data_from_base85(const std::string &base85);
   void reset() {
     this->data_.clear();
     this->carrier_frequency_ = 0;

esphome/components/rf_bridge/rf_bridge.cpp

@@ -1,6 +1,7 @@
 #include "rf_bridge.h"
-#include "esphome/core/log.h"
 #include "esphome/core/application.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
 #include <cinttypes>
 #include <cstring>
 
@@ -72,9 +73,9 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
 
       data.length = raw[2];
       data.protocol = raw[3];
-      char next_byte[3];
+      char next_byte[3];  // 2 hex chars + null
       for (uint8_t i = 0; i < data.length - 1; i++) {
-        sprintf(next_byte, "%02X", raw[4 + i]);
+        buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[4 + i]);
         data.code += next_byte;
       }
 
@@ -90,10 +91,10 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
 
       uint8_t buckets = raw[2] << 1;
       std::string str;
-      char next_byte[3];
+      char next_byte[3];  // 2 hex chars + null
 
       for (uint32_t i = 0; i <= at; i++) {
-        sprintf(next_byte, "%02X", raw[i]);
+        buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[i]);
         str += next_byte;
         if ((i > 3) && buckets) {
           buckets--;

esphome/components/spi_led_strip/spi_led_strip.cpp

@@ -1,4 +1,5 @@
 #include "spi_led_strip.h"
+#include "esphome/core/helpers.h"
 
 namespace esphome {
 namespace spi_led_strip {
@@ -47,15 +48,14 @@ void SpiLedStrip::dump_config() {
 void SpiLedStrip::write_state(light::LightState *state) {
   if (this->is_failed())
     return;
-  if (ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE) {
-    char strbuf[49];
-    size_t len = std::min(this->buffer_size_, (size_t) (sizeof(strbuf) - 1) / 3);
-    memset(strbuf, 0, sizeof(strbuf));
-    for (size_t i = 0; i != len; i++) {
-      sprintf(strbuf + i * 3, "%02X ", this->buf_[i]);
-    }
+#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE
+  {
+    char strbuf[49];  // format_hex_pretty_size(16) = 48, fits 16 bytes
+    size_t len = std::min(this->buffer_size_, (size_t) 16);
+    format_hex_pretty_to(strbuf, sizeof(strbuf), this->buf_, len, ' ');
     esph_log_v(TAG, "write_state: buf = %s", strbuf);
   }
+#endif
   this->enable();
   this->write_array(this->buf_, this->buffer_size_);
   this->disable();

esphome/components/web_server/web_server.cpp

@@ -658,24 +658,6 @@ std::string WebServer::text_sensor_json_(text_sensor::TextSensor *obj, const std
 #endif
 
 #ifdef USE_SWITCH
-enum SwitchAction : uint8_t { SWITCH_ACTION_NONE, SWITCH_ACTION_TOGGLE, SWITCH_ACTION_TURN_ON, SWITCH_ACTION_TURN_OFF };
-
-static void execute_switch_action(switch_::Switch *obj, SwitchAction action) {
-  switch (action) {
-    case SWITCH_ACTION_TOGGLE:
-      obj->toggle();
-      break;
-    case SWITCH_ACTION_TURN_ON:
-      obj->turn_on();
-      break;
-    case SWITCH_ACTION_TURN_OFF:
-      obj->turn_off();
-      break;
-    default:
-      break;
-  }
-}
-
 void WebServer::on_switch_update(switch_::Switch *obj) {
   if (!this->include_internal_ && obj->is_internal())
     return;
@@ -694,22 +676,34 @@ void WebServer::handle_switch_request(AsyncWebServerRequest *request, const UrlM
       return;
     }
 
-    SwitchAction action = SWITCH_ACTION_NONE;
+    // Handle action methods with single defer and response
+    enum SwitchAction { NONE, TOGGLE, TURN_ON, TURN_OFF };
+    SwitchAction action = NONE;
 
     if (match.method_equals(ESPHOME_F("toggle"))) {
-      action = SWITCH_ACTION_TOGGLE;
+      action = TOGGLE;
     } else if (match.method_equals(ESPHOME_F("turn_on"))) {
-      action = SWITCH_ACTION_TURN_ON;
+      action = TURN_ON;
     } else if (match.method_equals(ESPHOME_F("turn_off"))) {
-      action = SWITCH_ACTION_TURN_OFF;
+      action = TURN_OFF;
     }
 
-    if (action != SWITCH_ACTION_NONE) {
-#ifdef USE_ESP8266
-      execute_switch_action(obj, action);
-#else
-      this->defer([obj, action]() { execute_switch_action(obj, action); });
-#endif
+    if (action != NONE) {
+      this->defer([obj, action]() {
+        switch (action) {
+          case TOGGLE:
+            obj->toggle();
+            break;
+          case TURN_ON:
+            obj->turn_on();
+            break;
+          case TURN_OFF:
+            obj->turn_off();
+            break;
+          default:
+            break;
+        }
+      });
       request->send(200);
     } else {
       request->send(404);
@@ -749,7 +743,7 @@ void WebServer::handle_button_request(AsyncWebServerRequest *request, const UrlM
       std::string data = this->button_json_(obj, detail);
       request->send(200, "application/json", data.c_str());
     } else if (match.method_equals(ESPHOME_F("press"))) {
-      DEFER_ACTION(obj, obj->press());
+      this->defer([obj]() { obj->press(); });
       request->send(200);
       return;
     } else {
@@ -834,7 +828,7 @@ void WebServer::handle_fan_request(AsyncWebServerRequest *request, const UrlMatc
       std::string data = this->fan_json_(obj, detail);
       request->send(200, "application/json", data.c_str());
     } else if (match.method_equals(ESPHOME_F("toggle"))) {
-      DEFER_ACTION(obj, obj->toggle().perform());
+      this->defer([obj]() { obj->toggle().perform(); });
       request->send(200);
     } else {
       bool is_on = match.method_equals(ESPHOME_F("turn_on"));
@@ -865,7 +859,7 @@ void WebServer::handle_fan_request(AsyncWebServerRequest *request, const UrlMatc
             return;
         }
       }
-      DEFER_ACTION(call, call.perform());
+      this->defer([call]() mutable { call.perform(); });
       request->send(200);
     }
     return;
@@ -915,7 +909,7 @@ void WebServer::handle_light_request(AsyncWebServerRequest *request, const UrlMa
       std::string data = this->light_json_(obj, detail);
       request->send(200, "application/json", data.c_str());
     } else if (match.method_equals(ESPHOME_F("toggle"))) {
-      DEFER_ACTION(obj, obj->toggle().perform());
+      this->defer([obj]() { obj->toggle().perform(); });
       request->send(200);
     } else {
       bool is_on = match.method_equals(ESPHOME_F("turn_on"));
@@ -944,7 +938,7 @@ void WebServer::handle_light_request(AsyncWebServerRequest *request, const UrlMa
         parse_string_param_(request, ESPHOME_F("effect"), call, &decltype(call)::set_effect);
       }
 
-      DEFER_ACTION(call, call.perform());
+      this->defer([call]() mutable { call.perform(); });
       request->send(200);
     }
     return;
@@ -1033,7 +1027,7 @@ void WebServer::handle_cover_request(AsyncWebServerRequest *request, const UrlMa
     parse_float_param_(request, ESPHOME_F("position"), call, &decltype(call)::set_position);
     parse_float_param_(request, ESPHOME_F("tilt"), call, &decltype(call)::set_tilt);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1092,7 +1086,7 @@ void WebServer::handle_number_request(AsyncWebServerRequest *request, const UrlM
     auto call = obj->make_call();
     parse_float_param_(request, ESPHOME_F("value"), call, &decltype(call)::set_value);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1165,7 +1159,7 @@ void WebServer::handle_date_request(AsyncWebServerRequest *request, const UrlMat
 
     parse_string_param_(request, ESPHOME_F("value"), call, &decltype(call)::set_date);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1229,7 +1223,7 @@ void WebServer::handle_time_request(AsyncWebServerRequest *request, const UrlMat
 
     parse_string_param_(request, ESPHOME_F("value"), call, &decltype(call)::set_time);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1292,7 +1286,7 @@ void WebServer::handle_datetime_request(AsyncWebServerRequest *request, const Ur
 
     parse_string_param_(request, ESPHOME_F("value"), call, &decltype(call)::set_datetime);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1352,7 +1346,7 @@ void WebServer::handle_text_request(AsyncWebServerRequest *request, const UrlMat
     auto call = obj->make_call();
     parse_string_param_(request, ESPHOME_F("value"), call, &decltype(call)::set_value);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1410,7 +1404,7 @@ void WebServer::handle_select_request(AsyncWebServerRequest *request, const UrlM
     auto call = obj->make_call();
     parse_string_param_(request, ESPHOME_F("option"), call, &decltype(call)::set_option);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1479,7 +1473,7 @@ void WebServer::handle_climate_request(AsyncWebServerRequest *request, const Url
     parse_float_param_(request, ESPHOME_F("target_temperature_low"), call, &decltype(call)::set_target_temperature_low);
     parse_float_param_(request, ESPHOME_F("target_temperature"), call, &decltype(call)::set_target_temperature);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1595,24 +1589,6 @@ std::string WebServer::climate_json_(climate::Climate *obj, JsonDetail start_con
 #endif
 
 #ifdef USE_LOCK
-enum LockAction : uint8_t { LOCK_ACTION_NONE, LOCK_ACTION_LOCK, LOCK_ACTION_UNLOCK, LOCK_ACTION_OPEN };
-
-static void execute_lock_action(lock::Lock *obj, LockAction action) {
-  switch (action) {
-    case LOCK_ACTION_LOCK:
-      obj->lock();
-      break;
-    case LOCK_ACTION_UNLOCK:
-      obj->unlock();
-      break;
-    case LOCK_ACTION_OPEN:
-      obj->open();
-      break;
-    default:
-      break;
-  }
-}
-
 void WebServer::on_lock_update(lock::Lock *obj) {
   if (!this->include_internal_ && obj->is_internal())
     return;
@@ -1631,22 +1607,34 @@ void WebServer::handle_lock_request(AsyncWebServerRequest *request, const UrlMat
       return;
     }
 
-    LockAction action = LOCK_ACTION_NONE;
+    // Handle action methods with single defer and response
+    enum LockAction { NONE, LOCK, UNLOCK, OPEN };
+    LockAction action = NONE;
 
     if (match.method_equals(ESPHOME_F("lock"))) {
-      action = LOCK_ACTION_LOCK;
+      action = LOCK;
     } else if (match.method_equals(ESPHOME_F("unlock"))) {
-      action = LOCK_ACTION_UNLOCK;
+      action = UNLOCK;
     } else if (match.method_equals(ESPHOME_F("open"))) {
-      action = LOCK_ACTION_OPEN;
+      action = OPEN;
     }
 
-    if (action != LOCK_ACTION_NONE) {
-#ifdef USE_ESP8266
-      execute_lock_action(obj, action);
-#else
-      this->defer([obj, action]() { execute_lock_action(obj, action); });
-#endif
+    if (action != NONE) {
+      this->defer([obj, action]() {
+        switch (action) {
+          case LOCK:
+            obj->lock();
+            break;
+          case UNLOCK:
+            obj->unlock();
+            break;
+          case OPEN:
+            obj->open();
+            break;
+          default:
+            break;
+        }
+      });
       request->send(200);
     } else {
       request->send(404);
@@ -1729,7 +1717,7 @@ void WebServer::handle_valve_request(AsyncWebServerRequest *request, const UrlMa
 
     parse_float_param_(request, ESPHOME_F("position"), call, &decltype(call)::set_position);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1808,7 +1796,7 @@ void WebServer::handle_alarm_control_panel_request(AsyncWebServerRequest *reques
       return;
     }
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -1884,7 +1872,7 @@ void WebServer::handle_water_heater_request(AsyncWebServerRequest *request, cons
     // Parse on/off parameter
     parse_bool_param_(request, ESPHOME_F("is_on"), base_call, &water_heater::WaterHeaterCall::set_on);
 
-    DEFER_ACTION(call, call.perform());
+    this->defer([call]() mutable { call.perform(); });
     request->send(200);
     return;
   }
@@ -2044,7 +2032,7 @@ void WebServer::handle_update_request(AsyncWebServerRequest *request, const UrlM
       return;
     }
 
-    DEFER_ACTION(obj, obj->perform());
+    this->defer([obj]() mutable { obj->perform(); });
     request->send(200);
     return;
   }

esphome/components/web_server/web_server.h

@@ -42,14 +42,6 @@ using ParamNameType = const __FlashStringHelper *;
 using ParamNameType = const char *;
 #endif
 
-// ESP8266 is single-threaded, so actions can execute directly in request context.
-// Multi-core platforms need to defer to main loop thread for thread safety.
-#ifdef USE_ESP8266
-#define DEFER_ACTION(capture, action) action
-#else
-#define DEFER_ACTION(capture, action) this->defer([capture]() mutable { action; })
-#endif
-
 /// Result of matching a URL against an entity
 struct EntityMatchResult {
   bool matched;          ///< True if entity matched the URL

esphome/core/helpers.cpp

@@ -624,44 +624,53 @@ std::vector<uint8_t> base64_decode(const std::string &encoded_string) {
   return ret;
 }
 
-/// Decode base64/base64url string directly into vector of little-endian int32 values
-/// @param base64 Base64 or base64url encoded string (both +/ and -_ accepted)
-/// @param out Output vector (cleared and filled with decoded int32 values)
-/// @return true if successful, false if decode failed or invalid size
-bool base64_decode_int32_vector(const std::string &base64, std::vector<int32_t> &out) {
-  // Decode in chunks to minimize stack usage
-  constexpr size_t chunk_bytes = 48;  // 12 int32 values
-  constexpr size_t chunk_chars = 64;  // 48 * 4/3 = 64 chars
-  uint8_t chunk[chunk_bytes];
+/// Encode int32 to 5 base85 characters + null terminator
+/// Standard ASCII85 alphabet: '!' (33) = 0 through 'u' (117) = 84
+inline void base85_encode_int32(int32_t value, std::span<char, BASE85_INT32_ENCODED_SIZE> output) {
+  uint32_t v = static_cast<uint32_t>(value);
+  // Encode least significant digit first, then reverse
+  for (int i = 4; i >= 0; i--) {
+    output[i] = static_cast<char>('!' + (v % 85));
+    v /= 85;
+  }
+  output[5] = '\0';
+}
+
+/// Decode 5 base85 characters to int32
+inline bool base85_decode_int32(const char *input, int32_t &out) {
+  uint8_t c0 = static_cast<uint8_t>(input[0] - '!');
+  uint8_t c1 = static_cast<uint8_t>(input[1] - '!');
+  uint8_t c2 = static_cast<uint8_t>(input[2] - '!');
+  uint8_t c3 = static_cast<uint8_t>(input[3] - '!');
+  uint8_t c4 = static_cast<uint8_t>(input[4] - '!');
+
+  // Each digit must be 0-84. Since uint8_t wraps, chars below '!' become > 84
+  if (c0 > 84 || c1 > 84 || c2 > 84 || c3 > 84 || c4 > 84)
+    return false;
+
+  // 85^4 = 52200625, 85^3 = 614125, 85^2 = 7225, 85^1 = 85
+  out = static_cast<int32_t>(c0 * 52200625u + c1 * 614125u + c2 * 7225u + c3 * 85u + c4);
+  return true;
+}
+
+/// Decode base85 string directly into vector (no intermediate buffer)
+bool base85_decode_int32_vector(const std::string &base85, std::vector<int32_t> &out) {
+  size_t len = base85.size();
+  if (len % 5 != 0)
+    return false;
 
   out.clear();
+  const char *ptr = base85.data();
+  const char *end = ptr + len;
 
-  const uint8_t *input = reinterpret_cast<const uint8_t *>(base64.data());
-  size_t remaining = base64.size();
-  size_t pos = 0;
-
-  while (remaining > 0) {
-    size_t chars_to_decode = std::min(remaining, chunk_chars);
-    size_t decoded_len = base64_decode(input + pos, chars_to_decode, chunk, chunk_bytes);
-
-    if (decoded_len == 0)
+  while (ptr < end) {
+    int32_t value;
+    if (!base85_decode_int32(ptr, value))
       return false;
-
-    // Parse little-endian int32 values
-    for (size_t i = 0; i + 3 < decoded_len; i += 4) {
-      int32_t timing = static_cast<int32_t>(encode_uint32(chunk[i + 3], chunk[i + 2], chunk[i + 1], chunk[i]));
-      out.push_back(timing);
-    }
-
-    // Check for incomplete int32 in last chunk
-    if (remaining <= chunk_chars && (decoded_len % 4) != 0)
-      return false;
-
-    pos += chars_to_decode;
-    remaining -= chars_to_decode;
+    out.push_back(value);
+    ptr += 5;
   }
-
-  return !out.empty();
+  return true;
 }
 
 // Colors

esphome/core/helpers.h

@@ -1137,11 +1137,13 @@ std::vector<uint8_t> base64_decode(const std::string &encoded_string);
 size_t base64_decode(std::string const &encoded_string, uint8_t *buf, size_t buf_len);
 size_t base64_decode(const uint8_t *encoded_data, size_t encoded_len, uint8_t *buf, size_t buf_len);
 
-/// Decode base64/base64url string directly into vector of little-endian int32 values
-/// @param base64 Base64 or base64url encoded string (both +/ and -_ accepted)
-/// @param out Output vector (cleared and filled with decoded int32 values)
-/// @return true if successful, false if decode failed or invalid size
-bool base64_decode_int32_vector(const std::string &base64, std::vector<int32_t> &out);
+/// Size of buffer needed for base85 encoded int32 (5 chars + null terminator)
+static constexpr size_t BASE85_INT32_ENCODED_SIZE = 6;
+
+void base85_encode_int32(int32_t value, std::span<char, BASE85_INT32_ENCODED_SIZE> output);
+
+bool base85_decode_int32(const char *input, int32_t &out);
+bool base85_decode_int32_vector(const std::string &base85, std::vector<int32_t> &out);
 
 ///@}
 

esphome/idf_component.yml

@@ -28,8 +28,8 @@ dependencies:
     rules:
       - if: "target in [esp32s2, esp32s3, esp32p4]"
   esphome/esp-hub75:
-    version: 0.3.0
+    version: 0.2.2
     rules:
-      - if: "target in [esp32, esp32s2, esp32s3, esp32c6, esp32p4]"
+      - if: "target in [esp32, esp32s2, esp32s3, esp32p4]"
   esp32async/asynctcp:
     version: 3.4.91