[web_server_idf] Reduce heap allocations by using stack buffers

esphome/components/mhz19/mhz19.cpp

@@ -155,6 +155,9 @@ void MHZ19Component::dump_config() {
     case MHZ19_DETECTION_RANGE_0_10000PPM:
       range_str = "0 to 10000ppm";
       break;
+    default:
+      range_str = "default";
+      break;
   }
   ESP_LOGCONFIG(TAG, "  Detection range: %s", range_str);
 }

esphome/components/web_server/web_server.cpp

@@ -531,19 +531,7 @@ static void set_json_id(JsonObject &root, EntityBase *obj, const char *prefix, J
   memcpy(p, name.c_str(), name_len);
   p[name_len] = '\0';
 
-  // name_id: new format {prefix}/{device?}/{name} - frontend should prefer this
-  // Remove in 2026.8.0 when id switches to new format permanently
-  root[ESPHOME_F("name_id")] = id_buf;
-
-  // id: old format {prefix}-{object_id} for backward compatibility
-  // Will switch to new format in 2026.8.0
-  char legacy_buf[ESPHOME_DOMAIN_MAX_LEN + 1 + OBJECT_ID_MAX_LEN];
-  char *lp = legacy_buf;
-  memcpy(lp, prefix, prefix_len);
-  lp += prefix_len;
-  *lp++ = '-';
-  obj->write_object_id_to(lp, sizeof(legacy_buf) - (lp - legacy_buf));
-  root[ESPHOME_F("id")] = legacy_buf;
+  root[ESPHOME_F("id")] = id_buf;
 
   if (start_config == DETAIL_ALL) {
     root[ESPHOME_F("domain")] = prefix;

esphome/components/web_server_idf/utils.cpp

@@ -78,11 +78,8 @@ optional<std::string> query_key_value(const std::string &query_url, const std::s
     return {};
   }
 
-  auto val = std::unique_ptr<char[]>(new char[query_url.size()]);
-  if (!val) {
-    ESP_LOGE(TAG, "Not enough memory to the query key value");
-    return {};
-  }
+  // Use stack buffer for typical query strings, heap fallback for large ones
+  SmallBufferWithHeapFallback<256, char> val(query_url.size());
 
   if (httpd_query_key_value(query_url.c_str(), key.c_str(), val.get(), query_url.size()) != ESP_OK) {
     return {};

esphome/components/web_server_idf/web_server_idf.cpp

@@ -352,14 +352,15 @@ bool AsyncWebServerRequest::authenticate(const char *username, const char *passw
   memcpy(user_info + user_len + 1, password, pass_len);
   user_info[user_info_len] = '\0';
 
-  size_t n = 0, out;
-  esp_crypto_base64_encode(nullptr, 0, &n, reinterpret_cast<const uint8_t *>(user_info), user_info_len);
-
-  auto digest = std::unique_ptr<char[]>(new char[n + 1]);
-  esp_crypto_base64_encode(reinterpret_cast<uint8_t *>(digest.get()), n, &out,
+  // Base64 output size is ceil(input_len * 4/3) + 1, with input bounded to 256 bytes
+  // max output is ceil(256 * 4/3) + 1 = 343 bytes, use 350 for safety
+  constexpr size_t max_digest_len = 350;
+  char digest[max_digest_len];
+  size_t out;
+  esp_crypto_base64_encode(reinterpret_cast<uint8_t *>(digest), max_digest_len, &out,
                            reinterpret_cast<const uint8_t *>(user_info), user_info_len);
 
-  return strcmp(digest.get(), auth_str + auth_prefix_len) == 0;
+  return strcmp(digest, auth_str + auth_prefix_len) == 0;
 }
 
 void AsyncWebServerRequest::requestAuthentication(const char *realm) const {
@@ -869,12 +870,12 @@ esp_err_t AsyncWebServer::handle_multipart_upload_(httpd_req_t *r, const char *c
     }
   });
 
-  // Process data
-  std::unique_ptr<char[]> buffer(new char[MULTIPART_CHUNK_SIZE]);
+  // Process data - use stack buffer to avoid heap allocation
+  char buffer[MULTIPART_CHUNK_SIZE];
   size_t bytes_since_yield = 0;
 
   for (size_t remaining = r->content_len; remaining > 0;) {
-    int recv_len = httpd_req_recv(r, buffer.get(), std::min(remaining, MULTIPART_CHUNK_SIZE));
+    int recv_len = httpd_req_recv(r, buffer, std::min(remaining, MULTIPART_CHUNK_SIZE));
 
     if (recv_len <= 0) {
       httpd_resp_send_err(r, recv_len == HTTPD_SOCK_ERR_TIMEOUT ? HTTPD_408_REQ_TIMEOUT : HTTPD_400_BAD_REQUEST,
@@ -882,7 +883,7 @@ esp_err_t AsyncWebServer::handle_multipart_upload_(httpd_req_t *r, const char *c
       return recv_len == HTTPD_SOCK_ERR_TIMEOUT ? ESP_ERR_TIMEOUT : ESP_FAIL;
     }
 
-    if (reader->parse(buffer.get(), recv_len) != static_cast<size_t>(recv_len)) {
+    if (reader->parse(buffer, recv_len) != static_cast<size_t>(recv_len)) {
       ESP_LOGW(TAG, "Multipart parser error");
       httpd_resp_send_err(r, HTTPD_400_BAD_REQUEST, nullptr);
       return ESP_FAIL;