[ci] Soft-deprecate str_sprintf/str_snprintf to prevent hidden heap allocations

esphome/components/statsd/statsd.cpp

@@ -114,23 +114,14 @@ void StatsdComponent::update() {
     // This implies you can't explicitly set a gauge to a negative number without first setting it to zero.
     if (val < 0) {
       if (this->prefix_) {
-        out.append(this->prefix_);
-        out.append(".");
+        out.append(str_sprintf("%s.", this->prefix_));
       }
-      out.append(s.name);
-      out.append(":0|g\n");
+      out.append(str_sprintf("%s:0|g\n", s.name));
     }
     if (this->prefix_) {
-      out.append(this->prefix_);
-      out.append(".");
+      out.append(str_sprintf("%s.", this->prefix_));
     }
-    out.append(s.name);
-    // Buffer for ":" + value + "|g\n".
-    // %g uses max 13 chars for value (sign + 6 significant digits + e+xxx)
-    // Total: 1 + 13 + 4 = 18 chars + null, use 24 for safety
-    char val_buf[24];
-    snprintf(val_buf, sizeof(val_buf), ":%g|g\n", val);
-    out.append(val_buf);
+    out.append(str_sprintf("%s:%f|g\n", s.name, val));
 
     if (out.length() > SEND_THRESHOLD) {
       this->send_(&out);

esphome/core/helpers.h

@@ -563,9 +563,11 @@ inline uint32_t fnv1_hash_object_id(const char *str, size_t len) {
 }
 
 /// snprintf-like function returning std::string of maximum length \p len (excluding null terminator).
+/// @warning Allocates heap memory. Use snprintf() with a stack buffer instead.
 std::string __attribute__((format(printf, 1, 3))) str_snprintf(const char *fmt, size_t len, ...);
 
 /// sprintf-like function returning std::string.
+/// @warning Allocates heap memory. Use snprintf() with a stack buffer instead.
 std::string __attribute__((format(printf, 1, 2))) str_sprintf(const char *fmt, ...);
 
 /// Concatenate a name with a separator and suffix using an efficient stack-based approach.

script/ci-custom.py

@@ -690,6 +690,8 @@ HEAP_ALLOCATING_HELPERS = {
     "str_truncate": "removal (function is unused)",
     "str_upper_case": "removal (function is unused)",
     "str_snake_case": "removal (function is unused)",
+    "str_sprintf": "snprintf() with a stack buffer",
+    "str_snprintf": "snprintf() with a stack buffer",
 }
 
 
@@ -706,7 +708,9 @@ HEAP_ALLOCATING_HELPERS = {
     r"get_mac_address(?!_)|"
     r"str_truncate|"
     r"str_upper_case|"
-    r"str_snake_case"
+    r"str_snake_case|"
+    r"str_sprintf|"
+    r"str_snprintf"
     r")\s*\(" + CPP_RE_EOL,
     include=cpp_include,
     exclude=[