diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 943a35b32a..e31e547b75 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -58,7 +58,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+        uses: github/codeql-action/init@303c0aef88fc2fe5ff6d63d3b1596bfd83dfa1f9 # v3.30.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -86,6 +86,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+        uses: github/codeql-action/analyze@303c0aef88fc2fe5ff6d63d3b1596bfd83dfa1f9 # v3.30.4
         with:
           category: "/language:${{matrix.language}}"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index cab433c7f9..818f360860 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -11,7 +11,7 @@ ci:
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.13.1
+    rev: v0.13.2
     hooks:
       # Run the linter.
       - id: ruff
diff --git a/esphome/components/esphome/ota/ota_esphome.cpp b/esphome/components/esphome/ota/ota_esphome.cpp
index 405633b990..6ffeeedb1a 100644
--- a/esphome/components/esphome/ota/ota_esphome.cpp
+++ b/esphome/components/esphome/ota/ota_esphome.cpp
@@ -15,6 +15,7 @@
 #include "esphome/components/ota/ota_backend_esp_idf.h"
 #include "esphome/core/application.h"
 #include "esphome/core/hal.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/util.h"
 
@@ -528,14 +529,6 @@ void ESPHomeOTAComponent::log_auth_warning_(const LogString *action, const LogSt
   ESP_LOGW(TAG, "Auth: %s %s failed", LOG_STR_ARG(action), LOG_STR_ARG(hash_name));
 }
 
-// Helper to convert uint32 to big-endian bytes
-static inline void uint32_to_bytes(uint32_t value, uint8_t *bytes) {
-  bytes[0] = (value >> 24) & 0xFF;
-  bytes[1] = (value >> 16) & 0xFF;
-  bytes[2] = (value >> 8) & 0xFF;
-  bytes[3] = value & 0xFF;
-}
-
 // Non-template function definition to reduce binary size
 bool ESPHomeOTAComponent::perform_hash_auth_(HashBase *hasher, const std::string &password, uint8_t auth_request,
                                              const LogString *name, char *buf) {
@@ -553,10 +546,10 @@ bool ESPHomeOTAComponent::perform_hash_auth_(HashBase *hasher, const std::string
 
   hasher->init();
 
-  // Generate nonce seed bytes
-  uint32_to_bytes(random_uint32(), nonce_bytes);
-  if (nonce_len > 4) {
-    uint32_to_bytes(random_uint32(), nonce_bytes + 4);
+  // Generate nonce seed bytes using random_bytes
+  if (!random_bytes(nonce_bytes, nonce_len)) {
+    this->log_auth_warning_(LOG_STR("Random bytes generation failed"), name);
+    return false;
   }
   hasher->add(nonce_bytes, nonce_len);
   hasher->calculate();
diff --git a/esphome/components/htu21d/htu21d.cpp b/esphome/components/htu21d/htu21d.cpp
index f2e7ae93cb..a7aae16f17 100644
--- a/esphome/components/htu21d/htu21d.cpp
+++ b/esphome/components/htu21d/htu21d.cpp
@@ -9,8 +9,8 @@ static const char *const TAG = "htu21d";
 
 static const uint8_t HTU21D_ADDRESS = 0x40;
 static const uint8_t HTU21D_REGISTER_RESET = 0xFE;
-static const uint8_t HTU21D_REGISTER_TEMPERATURE = 0xF3;
-static const uint8_t HTU21D_REGISTER_HUMIDITY = 0xF5;
+static const uint8_t HTU21D_REGISTER_TEMPERATURE = 0xE3;
+static const uint8_t HTU21D_REGISTER_HUMIDITY = 0xE5;
 static const uint8_t HTU21D_WRITERHT_REG_CMD = 0xE6; /**< Write RH/T User Register 1 */
 static const uint8_t HTU21D_REGISTER_STATUS = 0xE7;
 static const uint8_t HTU21D_WRITEHEATER_REG_CMD = 0x51; /**< Write Heater Control Register */
@@ -57,7 +57,6 @@ void HTU21DComponent::update() {
 
     if (this->temperature_ != nullptr)
       this->temperature_->publish_state(temperature);
-    this->status_clear_warning();
 
     if (this->write(&HTU21D_REGISTER_HUMIDITY, 1) != i2c::ERROR_OK) {
       this->status_set_warning();
@@ -79,10 +78,11 @@ void HTU21DComponent::update() {
       if (this->humidity_ != nullptr)
         this->humidity_->publish_state(humidity);
 
-      int8_t heater_level;
+      this->status_clear_warning();
 
       // HTU21D does have a heater module but does not have heater level
       // Setting heater level to 1 in case the heater is ON
+      uint8_t heater_level = 0;
       if (this->sensor_model_ == HTU21D_SENSOR_MODEL_HTU21D) {
         if (this->is_heater_enabled()) {
           heater_level = 1;
@@ -97,34 +97,30 @@ void HTU21DComponent::update() {
 
       if (this->heater_ != nullptr)
         this->heater_->publish_state(heater_level);
-      this->status_clear_warning();
     });
   });
 }
 
 bool HTU21DComponent::is_heater_enabled() {
   uint8_t raw_heater;
-  if (this->read_register(HTU21D_REGISTER_STATUS, reinterpret_cast<uint8_t *>(&raw_heater), 2) != i2c::ERROR_OK) {
+  if (this->read_register(HTU21D_REGISTER_STATUS, &raw_heater, 1) != i2c::ERROR_OK) {
     this->status_set_warning();
     return false;
   }
-  raw_heater = i2c::i2ctohs(raw_heater);
-  return (bool) (((raw_heater) >> (HTU21D_REG_HTRE_BIT)) & 0x01);
+  return (bool) ((raw_heater >> HTU21D_REG_HTRE_BIT) & 0x01);
 }
 
 void HTU21DComponent::set_heater(bool status) {
   uint8_t raw_heater;
-  if (this->read_register(HTU21D_REGISTER_STATUS, reinterpret_cast<uint8_t *>(&raw_heater), 2) != i2c::ERROR_OK) {
+  if (this->read_register(HTU21D_REGISTER_STATUS, &raw_heater, 1) != i2c::ERROR_OK) {
     this->status_set_warning();
     return;
   }
-  raw_heater = i2c::i2ctohs(raw_heater);
   if (status) {
-    raw_heater |= (1 << (HTU21D_REG_HTRE_BIT));
+    raw_heater |= (1 << HTU21D_REG_HTRE_BIT);
   } else {
-    raw_heater &= ~(1 << (HTU21D_REG_HTRE_BIT));
+    raw_heater &= ~(1 << HTU21D_REG_HTRE_BIT);
   }
-
   if (this->write_register(HTU21D_WRITERHT_REG_CMD, &raw_heater, 1) != i2c::ERROR_OK) {
     this->status_set_warning();
     return;
@@ -138,14 +134,13 @@ void HTU21DComponent::set_heater_level(uint8_t level) {
   }
 }
 
-int8_t HTU21DComponent::get_heater_level() {
-  int8_t raw_heater;
-  if (this->read_register(HTU21D_READHEATER_REG_CMD, reinterpret_cast<uint8_t *>(&raw_heater), 2) != i2c::ERROR_OK) {
+uint8_t HTU21DComponent::get_heater_level() {
+  uint8_t raw_heater;
+  if (this->read_register(HTU21D_READHEATER_REG_CMD, &raw_heater, 1) != i2c::ERROR_OK) {
     this->status_set_warning();
     return 0;
   }
-  raw_heater = i2c::i2ctohs(raw_heater);
-  return raw_heater;
+  return raw_heater & 0xF;
 }
 
 float HTU21DComponent::get_setup_priority() const { return setup_priority::DATA; }
diff --git a/esphome/components/htu21d/htu21d.h b/esphome/components/htu21d/htu21d.h
index 8533875d43..9b3831b784 100644
--- a/esphome/components/htu21d/htu21d.h
+++ b/esphome/components/htu21d/htu21d.h
@@ -26,7 +26,7 @@ class HTU21DComponent : public PollingComponent, public i2c::I2CDevice {
   bool is_heater_enabled();
   void set_heater(bool status);
   void set_heater_level(uint8_t level);
-  int8_t get_heater_level();
+  uint8_t get_heater_level();
 
   float get_setup_priority() const override;
 
diff --git a/esphome/core/defines.h b/esphome/core/defines.h
index ef93fd0b65..067ef4a4d0 100644
--- a/esphome/core/defines.h
+++ b/esphome/core/defines.h
@@ -123,7 +123,9 @@
 #define USE_ONLINE_IMAGE_PNG_SUPPORT
 #define USE_ONLINE_IMAGE_JPEG_SUPPORT
 #define USE_OTA
+#define USE_OTA_MD5
 #define USE_OTA_PASSWORD
+#define USE_OTA_SHA256
 #define USE_OTA_STATE_CALLBACK
 #define USE_OTA_VERSION 2
 #define USE_TIME_TIMEZONE
diff --git a/esphome/dashboard/web_server.py b/esphome/dashboard/web_server.py
index e3a0013e2f..b5601c9e0f 100644
--- a/esphome/dashboard/web_server.py
+++ b/esphome/dashboard/web_server.py
@@ -283,11 +283,23 @@ class EsphomeCommandWebSocket(tornado.websocket.WebSocketHandler):
     def _stdout_thread(self) -> None:
         if not self._use_popen:
             return
+        line = b""
+        cr = False
         while True:
-            data = self._proc.stdout.readline()
+            data = self._proc.stdout.read(1)
             if data:
-                data = data.replace(b"\r", b"")
-                self._queue.put_nowait(data)
+                if data == b"\r":
+                    cr = True
+                elif data == b"\n":
+                    self._queue.put_nowait(line + b"\n")
+                    line = b""
+                    cr = False
+                elif cr:
+                    self._queue.put_nowait(line + b"\r")
+                    line = data
+                    cr = False
+                else:
+                    line += data
             if self._proc.poll() is not None:
                 break
         self._proc.wait(1.0)
diff --git a/requirements_test.txt b/requirements_test.txt
index 2c78eadf45..59ea77fd2d 100644
--- a/requirements_test.txt
+++ b/requirements_test.txt
@@ -1,6 +1,6 @@
 pylint==3.3.8
 flake8==7.3.0  # also change in .pre-commit-config.yaml when updating
-ruff==0.13.1  # also change in .pre-commit-config.yaml when updating
+ruff==0.13.2  # also change in .pre-commit-config.yaml when updating
 pyupgrade==3.20.0  # also change in .pre-commit-config.yaml when updating
 pre-commit