[lock] Modernize to C++17 nested namespaces

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/auto-label-pr.yml

@@ -22,7 +22,7 @@ jobs:
     if: github.event.action != 'labeled' || github.event.sender.type != 'Bot'
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Generate a token
         id: generate-token

.github/workflows/ci-api-proto.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Set up Python
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:

.github/workflows/ci-clang-tidy-hash.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Set up Python
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0

.github/workflows/ci-docker.yml

@@ -43,7 +43,7 @@ jobs:
           - "docker"
           # - "lint"
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Set up Python
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:

.github/workflows/ci-memory-impact-comment.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Check out code from base repository
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           # Always check out from the base repository (esphome/esphome), never from forks
           # Use the PR's target branch to ensure we run trusted code from the main repo

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
       cache-key: ${{ steps.cache-key.outputs.key }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Generate cache-key
         id: cache-key
         run: echo key="${{ hashFiles('requirements.txt', 'requirements_test.txt', '.pre-commit-config.yaml') }}" >> $GITHUB_OUTPUT
@@ -70,7 +70,7 @@ jobs:
     if: needs.determine-jobs.outputs.python-linters == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -91,7 +91,7 @@ jobs:
       - common
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -132,7 +132,7 @@ jobs:
       - common
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Restore Python
         id: restore-python
         uses: ./.github/actions/restore-python
@@ -183,7 +183,7 @@ jobs:
       component-test-batches: ${{ steps.determine.outputs.component-test-batches }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           # Fetch enough history to find the merge base
           fetch-depth: 2
@@ -237,7 +237,7 @@ jobs:
     if: needs.determine-jobs.outputs.integration-tests == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Set up Python 3.13
         id: python
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
@@ -273,7 +273,7 @@ jobs:
     if: github.event_name == 'pull_request' && (needs.determine-jobs.outputs.cpp-unit-tests-run-all == 'true' || needs.determine-jobs.outputs.cpp-unit-tests-components != '[]')
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Restore Python
         uses: ./.github/actions/restore-python
@@ -321,7 +321,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -400,7 +400,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -489,7 +489,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -577,7 +577,7 @@ jobs:
           version: 1.0
 
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -662,7 +662,7 @@ jobs:
     if: github.event_name == 'pull_request' && !startsWith(github.base_ref, 'beta') && !startsWith(github.base_ref, 'release')
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -688,7 +688,7 @@ jobs:
       skip: ${{ steps.check-script.outputs.skip }}
     steps:
       - name: Check out target branch
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: ${{ github.base_ref }}
 
@@ -840,7 +840,7 @@ jobs:
       flash_usage: ${{ steps.extract.outputs.flash_usage }}
     steps:
       - name: Check out PR branch
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -908,7 +908,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Check out code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:

.github/workflows/codeql.yml

@@ -54,11 +54,11 @@ jobs:
             # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
+        uses: github/codeql-action/init@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -86,6 +86,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
+        uses: github/codeql-action/analyze@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
       branch_build: ${{ steps.tag.outputs.branch_build }}
       deploy_env: ${{ steps.tag.outputs.deploy_env }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Get tag
         id: tag
         # yamllint disable rule:line-length
@@ -60,7 +60,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Set up Python
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
@@ -92,7 +92,7 @@ jobs:
             os: "ubuntu-24.04-arm"
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Set up Python
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
@@ -168,7 +168,7 @@ jobs:
           - ghcr
           - dockerhub
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Download digests
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0

.github/workflows/sync-device-classes.yml

@@ -13,10 +13,10 @@ jobs:
     if: github.repository == 'esphome/esphome'
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Checkout Home Assistant
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           repository: home-assistant/core
           path: lib/home-assistant

esphome/components/bme68x_bsec2/bme68x_bsec2.cpp

@@ -70,6 +70,9 @@ void BME68xBSEC2Component::dump_config() {
   if (this->is_failed()) {
     ESP_LOGE(TAG, "Communication failed (BSEC2 status: %d, BME68X status: %d)", this->bsec_status_,
              this->bme68x_status_);
+    if (this->bsec_status_ == BSEC_I_SU_SUBSCRIBEDOUTPUTGATES) {
+      ESP_LOGE(TAG, "No sensors, add at least one sensor to the config");
+    }
   }
 
   if (this->algorithm_output_ != ALGORITHM_OUTPUT_IAQ) {

esphome/components/captive_portal/__init__.py

@@ -72,6 +72,16 @@ def _final_validate(config: ConfigType) -> ConfigType:
             "Add 'ap:' to your WiFi configuration to enable the captive portal."
         )
 
+    # Register socket needs for DNS server and additional HTTP connections
+    # - 1 UDP socket for DNS server
+    # - 3 additional TCP sockets for captive portal detection probes + configuration requests
+    #   OS captive portal detection makes multiple probe requests that stay in TIME_WAIT.
+    #   Need headroom for actual user configuration requests.
+    #   LRU purging will reclaim idle sockets to prevent exhaustion from repeated attempts.
+    from esphome.components import socket
+
+    socket.consume_sockets(4, "captive_portal")(config)
+
     return config
 
 

esphome/components/captive_portal/captive_portal.cpp

@@ -50,8 +50,8 @@ void CaptivePortal::handle_wifisave(AsyncWebServerRequest *request) {
   ESP_LOGI(TAG, "Requested WiFi Settings Change:");
   ESP_LOGI(TAG, "  SSID='%s'", ssid.c_str());
   ESP_LOGI(TAG, "  Password=" LOG_SECRET("'%s'"), psk.c_str());
-  wifi::global_wifi_component->save_wifi_sta(ssid, psk);
-  wifi::global_wifi_component->start_scanning();
+  // Defer save to main loop thread to avoid NVS operations from HTTP thread
+  this->defer([ssid, psk]() { wifi::global_wifi_component->save_wifi_sta(ssid, psk); });
   request->redirect(ESPHOME_F("/?save"));
 }
 
@@ -63,6 +63,12 @@ void CaptivePortal::start() {
   this->base_->init();
   if (!this->initialized_) {
     this->base_->add_handler(this);
+#ifdef USE_ESP32
+    // Enable LRU socket purging to handle captive portal detection probe bursts
+    // OS captive portal detection makes many simultaneous HTTP requests which can
+    // exhaust sockets. LRU purging automatically closes oldest idle connections.
+    this->base_->get_server()->set_lru_purge_enable(true);
+#endif
   }
 
   network::IPAddress ip = wifi::global_wifi_component->wifi_soft_ap_ip();

esphome/components/captive_portal/captive_portal.h

@@ -40,6 +40,10 @@ class CaptivePortal : public AsyncWebHandler, public Component {
   void end() {
     this->active_ = false;
     this->disable_loop();  // Stop processing DNS requests
+#ifdef USE_ESP32
+    // Disable LRU socket purging now that captive portal is done
+    this->base_->get_server()->set_lru_purge_enable(false);
+#endif
     this->base_->deinit();
     if (this->dns_server_ != nullptr) {
       this->dns_server_->stop();

esphome/components/dashboard_import/dashboard_import.cpp

@@ -3,10 +3,10 @@
 namespace esphome {
 namespace dashboard_import {
 
-static std::string g_package_import_url;  // NOLINT
+static const char *g_package_import_url = "";  // NOLINT
 
-const std::string &get_package_import_url() { return g_package_import_url; }
-void set_package_import_url(std::string url) { g_package_import_url = std::move(url); }
+const char *get_package_import_url() { return g_package_import_url; }
+void set_package_import_url(const char *url) { g_package_import_url = url; }
 
 }  // namespace dashboard_import
 }  // namespace esphome

esphome/components/dashboard_import/dashboard_import.h

@@ -1,12 +1,10 @@
 #pragma once
 
-#include <string>
-
 namespace esphome {
 namespace dashboard_import {
 
-const std::string &get_package_import_url();
-void set_package_import_url(std::string url);
+const char *get_package_import_url();
+void set_package_import_url(const char *url);
 
 }  // namespace dashboard_import
 }  // namespace esphome

esphome/components/esp32/__init__.py

@@ -931,6 +931,12 @@ async def to_code(config):
         add_idf_sdkconfig_option("CONFIG_MBEDTLS_CERTIFICATE_BUNDLE", True)
         add_idf_sdkconfig_option("CONFIG_ESP_PHY_REDUCE_TX_POWER", True)
 
+        # ESP32-S2 Arduino: Disable USB Serial on boot to avoid TinyUSB dependency
+        if get_esp32_variant() == VARIANT_ESP32S2:
+            cg.add_build_unflag("-DARDUINO_USB_CDC_ON_BOOT=1")
+            cg.add_build_unflag("-DARDUINO_USB_CDC_ON_BOOT=0")
+            cg.add_build_flag("-DARDUINO_USB_CDC_ON_BOOT=0")
+
     cg.add_build_flag("-Wno-nonnull-compare")
 
     add_idf_sdkconfig_option(f"CONFIG_IDF_TARGET_{variant}", True)

esphome/components/esp32_improv/__init__.py

@@ -20,6 +20,10 @@ CONF_ON_STOP = "on_stop"
 CONF_STATUS_INDICATOR = "status_indicator"
 CONF_WIFI_TIMEOUT = "wifi_timeout"
 
+# Default WiFi timeout - aligned with WiFi component ap_timeout
+# Allows sufficient time to try all BSSIDs before starting provisioning mode
+DEFAULT_WIFI_TIMEOUT = "90s"
+
 
 improv_ns = cg.esphome_ns.namespace("improv")
 Error = improv_ns.enum("Error")
@@ -59,7 +63,7 @@ CONFIG_SCHEMA = (
                 CONF_AUTHORIZED_DURATION, default="1min"
             ): cv.positive_time_period_milliseconds,
             cv.Optional(
-                CONF_WIFI_TIMEOUT, default="1min"
+                CONF_WIFI_TIMEOUT, default=DEFAULT_WIFI_TIMEOUT
             ): cv.positive_time_period_milliseconds,
             cv.Optional(CONF_ON_PROVISIONED): automation.validate_automation(
                 {

esphome/components/esp32_improv/esp32_improv_component.cpp

@@ -127,6 +127,7 @@ void ESP32ImprovComponent::loop() {
           // Set initial state based on whether we have an authorizer
           this->set_state_(this->get_initial_state_(), false);
           this->set_error_(improv::ERROR_NONE);
+          this->should_start_ = false;  // Clear flag after starting
           ESP_LOGD(TAG, "Service started!");
         }
       }

esphome/components/esp32_improv/esp32_improv_component.h

@@ -45,6 +45,7 @@ class ESP32ImprovComponent : public Component, public improv_base::ImprovBase {
   void start();
   void stop();
   bool is_active() const { return this->state_ != improv::STATE_STOPPED; }
+  bool should_start() const { return this->should_start_; }
 
 #ifdef USE_ESP32_IMPROV_STATE_CALLBACK
   void add_on_state_callback(std::function<void(improv::State, improv::Error)> &&callback) {

esphome/components/ld2410/ld2410.cpp

@@ -13,8 +13,6 @@ namespace esphome {
 namespace ld2410 {
 
 static const char *const TAG = "ld2410";
-static const char *const UNKNOWN_MAC = "unknown";
-static const char *const VERSION_FMT = "%u.%02X.%02X%02X%02X%02X";
 
 enum BaudRate : uint8_t {
   BAUD_RATE_9600 = 1,
@@ -181,15 +179,15 @@ static inline bool validate_header_footer(const uint8_t *header_footer, const ui
 }
 
 void LD2410Component::dump_config() {
-  std::string mac_str =
-      mac_address_is_valid(this->mac_address_) ? format_mac_address_pretty(this->mac_address_) : UNKNOWN_MAC;
-  std::string version = str_sprintf(VERSION_FMT, this->version_[1], this->version_[0], this->version_[5],
-                                    this->version_[4], this->version_[3], this->version_[2]);
+  char mac_s[18];
+  char version_s[20];
+  const char *mac_str = ld24xx::format_mac_str(this->mac_address_, mac_s);
+  ld24xx::format_version_str(this->version_, version_s);
   ESP_LOGCONFIG(TAG,
                 "LD2410:\n"
                 "  Firmware version: %s\n"
                 "  MAC address: %s",
-                version.c_str(), mac_str.c_str());
+                version_s, mac_str);
 #ifdef USE_BINARY_SENSOR
   ESP_LOGCONFIG(TAG, "Binary Sensors:");
   LOG_BINARY_SENSOR("  ", "Target", this->target_binary_sensor_);
@@ -448,12 +446,12 @@ bool LD2410Component::handle_ack_data_() {
 
     case CMD_QUERY_VERSION: {
       std::memcpy(this->version_, &this->buffer_data_[12], sizeof(this->version_));
-      std::string version = str_sprintf(VERSION_FMT, this->version_[1], this->version_[0], this->version_[5],
-                                        this->version_[4], this->version_[3], this->version_[2]);
-      ESP_LOGV(TAG, "Firmware version: %s", version.c_str());
+      char version_s[20];
+      ld24xx::format_version_str(this->version_, version_s);
+      ESP_LOGV(TAG, "Firmware version: %s", version_s);
 #ifdef USE_TEXT_SENSOR
       if (this->version_text_sensor_ != nullptr) {
-        this->version_text_sensor_->publish_state(version);
+        this->version_text_sensor_->publish_state(version_s);
       }
 #endif
       break;
@@ -506,9 +504,9 @@ bool LD2410Component::handle_ack_data_() {
         std::memcpy(this->mac_address_, &this->buffer_data_[10], sizeof(this->mac_address_));
       }
 
-      std::string mac_str =
-          mac_address_is_valid(this->mac_address_) ? format_mac_address_pretty(this->mac_address_) : UNKNOWN_MAC;
-      ESP_LOGV(TAG, "MAC address: %s", mac_str.c_str());
+      char mac_s[18];
+      const char *mac_str = ld24xx::format_mac_str(this->mac_address_, mac_s);
+      ESP_LOGV(TAG, "MAC address: %s", mac_str);
 #ifdef USE_TEXT_SENSOR
       if (this->mac_text_sensor_ != nullptr) {
         this->mac_text_sensor_->publish_state(mac_str);

esphome/components/ld2412/ld2412.cpp

@@ -14,8 +14,6 @@ namespace esphome {
 namespace ld2412 {
 
 static const char *const TAG = "ld2412";
-static const char *const UNKNOWN_MAC = "unknown";
-static const char *const VERSION_FMT = "%u.%02X.%02X%02X%02X%02X";
 
 enum BaudRate : uint8_t {
   BAUD_RATE_9600 = 1,
@@ -200,15 +198,15 @@ static inline bool validate_header_footer(const uint8_t *header_footer, const ui
 }
 
 void LD2412Component::dump_config() {
-  std::string mac_str =
-      mac_address_is_valid(this->mac_address_) ? format_mac_address_pretty(this->mac_address_) : UNKNOWN_MAC;
-  std::string version = str_sprintf(VERSION_FMT, this->version_[1], this->version_[0], this->version_[5],
-                                    this->version_[4], this->version_[3], this->version_[2]);
+  char mac_s[18];
+  char version_s[20];
+  const char *mac_str = ld24xx::format_mac_str(this->mac_address_, mac_s);
+  ld24xx::format_version_str(this->version_, version_s);
   ESP_LOGCONFIG(TAG,
                 "LD2412:\n"
                 "  Firmware version: %s\n"
                 "  MAC address: %s",
-                version.c_str(), mac_str.c_str());
+                version_s, mac_str);
 #ifdef USE_BINARY_SENSOR
   ESP_LOGCONFIG(TAG, "Binary Sensors:");
   LOG_BINARY_SENSOR("  ", "DynamicBackgroundCorrectionStatus",
@@ -492,12 +490,12 @@ bool LD2412Component::handle_ack_data_() {
 
     case CMD_QUERY_VERSION: {
       std::memcpy(this->version_, &this->buffer_data_[12], sizeof(this->version_));
-      std::string version = str_sprintf(VERSION_FMT, this->version_[1], this->version_[0], this->version_[5],
-                                        this->version_[4], this->version_[3], this->version_[2]);
-      ESP_LOGV(TAG, "Firmware version: %s", version.c_str());
+      char version_s[20];
+      ld24xx::format_version_str(this->version_, version_s);
+      ESP_LOGV(TAG, "Firmware version: %s", version_s);
 #ifdef USE_TEXT_SENSOR
       if (this->version_text_sensor_ != nullptr) {
-        this->version_text_sensor_->publish_state(version);
+        this->version_text_sensor_->publish_state(version_s);
       }
 #endif
       break;
@@ -544,9 +542,9 @@ bool LD2412Component::handle_ack_data_() {
         std::memcpy(this->mac_address_, &this->buffer_data_[10], sizeof(this->mac_address_));
       }
 
-      std::string mac_str =
-          mac_address_is_valid(this->mac_address_) ? format_mac_address_pretty(this->mac_address_) : UNKNOWN_MAC;
-      ESP_LOGV(TAG, "MAC address: %s", mac_str.c_str());
+      char mac_s[18];
+      const char *mac_str = ld24xx::format_mac_str(this->mac_address_, mac_s);
+      ESP_LOGV(TAG, "MAC address: %s", mac_str);
 #ifdef USE_TEXT_SENSOR
       if (this->mac_text_sensor_ != nullptr) {
         this->mac_text_sensor_->publish_state(mac_str);

esphome/components/ld2450/ld2450.cpp

@@ -17,8 +17,6 @@ namespace esphome {
 namespace ld2450 {
 
 static const char *const TAG = "ld2450";
-static const char *const UNKNOWN_MAC = "unknown";
-static const char *const VERSION_FMT = "%u.%02X.%02X%02X%02X%02X";
 
 enum BaudRate : uint8_t {
   BAUD_RATE_9600 = 1,
@@ -192,15 +190,15 @@ void LD2450Component::setup() {
 }
 
 void LD2450Component::dump_config() {
-  std::string mac_str =
-      mac_address_is_valid(this->mac_address_) ? format_mac_address_pretty(this->mac_address_) : UNKNOWN_MAC;
-  std::string version = str_sprintf(VERSION_FMT, this->version_[1], this->version_[0], this->version_[5],
-                                    this->version_[4], this->version_[3], this->version_[2]);
+  char mac_s[18];
+  char version_s[20];
+  const char *mac_str = ld24xx::format_mac_str(this->mac_address_, mac_s);
+  ld24xx::format_version_str(this->version_, version_s);
   ESP_LOGCONFIG(TAG,
                 "LD2450:\n"
                 "  Firmware version: %s\n"
                 "  MAC address: %s",
-                version.c_str(), mac_str.c_str());
+                version_s, mac_str);
 #ifdef USE_BINARY_SENSOR
   ESP_LOGCONFIG(TAG, "Binary Sensors:");
   LOG_BINARY_SENSOR("  ", "MovingTarget", this->moving_target_binary_sensor_);
@@ -642,12 +640,12 @@ bool LD2450Component::handle_ack_data_() {
 
     case CMD_QUERY_VERSION: {
       std::memcpy(this->version_, &this->buffer_data_[12], sizeof(this->version_));
-      std::string version = str_sprintf(VERSION_FMT, this->version_[1], this->version_[0], this->version_[5],
-                                        this->version_[4], this->version_[3], this->version_[2]);
-      ESP_LOGV(TAG, "Firmware version: %s", version.c_str());
+      char version_s[20];
+      ld24xx::format_version_str(this->version_, version_s);
+      ESP_LOGV(TAG, "Firmware version: %s", version_s);
 #ifdef USE_TEXT_SENSOR
       if (this->version_text_sensor_ != nullptr) {
-        this->version_text_sensor_->publish_state(version);
+        this->version_text_sensor_->publish_state(version_s);
       }
 #endif
       break;
@@ -663,9 +661,9 @@ bool LD2450Component::handle_ack_data_() {
         std::memcpy(this->mac_address_, &this->buffer_data_[10], sizeof(this->mac_address_));
       }
 
-      std::string mac_str =
-          mac_address_is_valid(this->mac_address_) ? format_mac_address_pretty(this->mac_address_) : UNKNOWN_MAC;
-      ESP_LOGV(TAG, "MAC address: %s", mac_str.c_str());
+      char mac_s[18];
+      const char *mac_str = ld24xx::format_mac_str(this->mac_address_, mac_s);
+      ESP_LOGV(TAG, "MAC address: %s", mac_str);
 #ifdef USE_TEXT_SENSOR
       if (this->mac_text_sensor_ != nullptr) {
         this->mac_text_sensor_->publish_state(mac_str);

esphome/components/ld24xx/ld24xx.h

@@ -1,11 +1,12 @@
 #pragma once
 
 #include "esphome/core/defines.h"
+#include "esphome/core/helpers.h"
 
 #include <memory>
+#include <span>
 
 #ifdef USE_SENSOR
-#include "esphome/core/helpers.h"
 #include "esphome/components/sensor/sensor.h"
 
 #define SUB_SENSOR_WITH_DEDUP(name, dedup_type) \
@@ -39,6 +40,27 @@
 namespace esphome {
 namespace ld24xx {
 
+static const char *const UNKNOWN_MAC = "unknown";
+static const char *const VERSION_FMT = "%u.%02X.%02X%02X%02X%02X";
+
+// Helper function to format MAC address with stack allocation
+// Returns pointer to UNKNOWN_MAC constant or formatted buffer
+// Buffer must be exactly 18 bytes (17 for "XX:XX:XX:XX:XX:XX" + null terminator)
+inline const char *format_mac_str(const uint8_t *mac_address, std::span<char, 18> buffer) {
+  if (mac_address_is_valid(mac_address)) {
+    format_mac_addr_upper(mac_address, buffer.data());
+    return buffer.data();
+  }
+  return UNKNOWN_MAC;
+}
+
+// Helper function to format firmware version with stack allocation
+// Buffer must be exactly 20 bytes (format: "x.xxXXXXXX" fits in 11 + null terminator, 20 for safety)
+inline void format_version_str(const uint8_t *version, std::span<char, 20> buffer) {
+  snprintf(buffer.data(), buffer.size(), VERSION_FMT, version[1], version[0], version[5], version[4], version[3],
+           version[2]);
+}
+
 #ifdef USE_SENSOR
 // Helper class to store a sensor with a deduplicator & publish state only when the value changes
 template<typename T> class SensorWithDedup {

esphome/components/lock/automation.h

@@ -4,8 +4,7 @@
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
 
-namespace esphome {
-namespace lock {
+namespace esphome::lock {
 
 template<typename... Ts> class LockAction : public Action<Ts...> {
  public:
@@ -72,5 +71,4 @@ class LockUnlockTrigger : public Trigger<> {
   }
 };
 
-}  // namespace lock
-}  // namespace esphome
+}  // namespace esphome::lock

esphome/components/lock/lock.cpp

@@ -3,8 +3,7 @@
 #include "esphome/core/controller_registry.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace lock {
+namespace esphome::lock {
 
 static const char *const TAG = "lock";
 
@@ -108,5 +107,4 @@ LockCall &LockCall::set_state(const std::string &state) {
 }
 const optional<LockState> &LockCall::get_state() const { return this->state_; }
 
-}  // namespace lock
-}  // namespace esphome
+}  // namespace esphome::lock

esphome/components/lock/lock.h

@@ -7,8 +7,7 @@
 #include "esphome/core/preferences.h"
 #include <initializer_list>
 
-namespace esphome {
-namespace lock {
+namespace esphome::lock {
 
 class Lock;
 
@@ -177,5 +176,4 @@ class Lock : public EntityBase {
   ESPPreferenceObject rtc_;
 };
 
-}  // namespace lock
-}  // namespace esphome
+}  // namespace esphome::lock

esphome/components/lvgl/widgets/spinbox.py

@@ -1,6 +1,7 @@
 from esphome import automation
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_RANGE_FROM, CONF_RANGE_TO, CONF_STEP, CONF_VALUE
+from esphome.cpp_generator import MockObj
 
 from ..automation import action_to_code
 from ..defines import (
@@ -114,7 +115,9 @@ class SpinboxType(WidgetType):
                 w.obj, digits, digits - config[CONF_DECIMAL_PLACES]
             )
         if (value := config.get(CONF_VALUE)) is not None:
-            lv.spinbox_set_value(w.obj, await lv_float.process(value))
+            lv.spinbox_set_value(
+                w.obj, MockObj(await lv_float.process(value)) * w.get_scale()
+            )
 
     def get_scale(self, config):
         return 10 ** config[CONF_DECIMAL_PLACES]

esphome/components/mdns/mdns_component.cpp

@@ -135,8 +135,7 @@ void MDNSComponent::compile_records_(StaticVector<MDNSService, MDNS_SERVICE_COUN
 
 #ifdef USE_DASHBOARD_IMPORT
     MDNS_STATIC_CONST_CHAR(TXT_PACKAGE_IMPORT_URL, "package_import_url");
-    txt_records.push_back(
-        {MDNS_STR(TXT_PACKAGE_IMPORT_URL), MDNS_STR(dashboard_import::get_package_import_url().c_str())});
+    txt_records.push_back({MDNS_STR(TXT_PACKAGE_IMPORT_URL), MDNS_STR(dashboard_import::get_package_import_url())});
 #endif
   }
 #endif  // USE_API

esphome/components/mipi_rgb/mipi_rgb.cpp

@@ -350,6 +350,7 @@ void MipiRgb::dump_config() {
                 "\n  Width: %u"
                 "\n  Height: %u"
                 "\n  Rotation: %d degrees"
+                "\n  PCLK Inverted: %s"
                 "\n  HSync Pulse Width: %u"
                 "\n  HSync Back Porch: %u"
                 "\n  HSync Front Porch: %u"
@@ -357,18 +358,18 @@ void MipiRgb::dump_config() {
                 "\n  VSync Back Porch: %u"
                 "\n  VSync Front Porch: %u"
                 "\n  Invert Colors: %s"
-                "\n  Pixel Clock: %dMHz"
+                "\n  Pixel Clock: %uMHz"
                 "\n  Reset Pin: %s"
                 "\n  DE Pin: %s"
                 "\n  PCLK Pin: %s"
                 "\n  HSYNC Pin: %s"
                 "\n  VSYNC Pin: %s",
-                this->model_, this->width_, this->height_, this->rotation_, this->hsync_pulse_width_,
-                this->hsync_back_porch_, this->hsync_front_porch_, this->vsync_pulse_width_, this->vsync_back_porch_,
-                this->vsync_front_porch_, YESNO(this->invert_colors_), this->pclk_frequency_ / 1000000,
-                get_pin_name(this->reset_pin_).c_str(), get_pin_name(this->de_pin_).c_str(),
-                get_pin_name(this->pclk_pin_).c_str(), get_pin_name(this->hsync_pin_).c_str(),
-                get_pin_name(this->vsync_pin_).c_str());
+                this->model_, this->width_, this->height_, this->rotation_, YESNO(this->pclk_inverted_),
+                this->hsync_pulse_width_, this->hsync_back_porch_, this->hsync_front_porch_, this->vsync_pulse_width_,
+                this->vsync_back_porch_, this->vsync_front_porch_, YESNO(this->invert_colors_),
+                (unsigned) (this->pclk_frequency_ / 1000000), get_pin_name(this->reset_pin_).c_str(),
+                get_pin_name(this->de_pin_).c_str(), get_pin_name(this->pclk_pin_).c_str(),
+                get_pin_name(this->hsync_pin_).c_str(), get_pin_name(this->vsync_pin_).c_str());
 
   if (this->madctl_ & MADCTL_BGR) {
     this->dump_pins_(8, 13, "Blue", 0);

esphome/components/mipi_rgb/models/guition.py

@@ -11,6 +11,7 @@ st7701s.extend(
     vsync_pin=17,
     pclk_pin=21,
     pclk_frequency="12MHz",
+    pclk_inverted=False,
     pixel_mode="18bit",
     mirror_x=True,
     mirror_y=True,

esphome/components/number/automation.cpp

@@ -1,8 +1,7 @@
 #include "automation.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace number {
+namespace esphome::number {
 
 static const char *const TAG = "number.automation";
 
@@ -52,5 +51,4 @@ void ValueRangeTrigger::on_state_(float state) {
   this->rtc_.save(&in_range);
 }
 
-}  // namespace number
-}  // namespace esphome
+}  // namespace esphome::number

esphome/components/number/automation.h

@@ -4,8 +4,7 @@
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
 
-namespace esphome {
-namespace number {
+namespace esphome::number {
 
 class NumberStateTrigger : public Trigger<float> {
  public:
@@ -91,5 +90,4 @@ template<typename... Ts> class NumberInRangeCondition : public Condition<Ts...>
   float max_{NAN};
 };
 
-}  // namespace number
-}  // namespace esphome
+}  // namespace esphome::number

esphome/components/number/number.cpp

@@ -3,8 +3,7 @@
 #include "esphome/core/controller_registry.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace number {
+namespace esphome::number {
 
 static const char *const TAG = "number";
 
@@ -43,5 +42,4 @@ void Number::add_on_state_callback(std::function<void(float)> &&callback) {
   this->state_callback_.add(std::move(callback));
 }
 
-}  // namespace number
-}  // namespace esphome
+}  // namespace esphome::number

esphome/components/number/number.h

@@ -6,8 +6,7 @@
 #include "number_call.h"
 #include "number_traits.h"
 
-namespace esphome {
-namespace number {
+namespace esphome::number {
 
 class Number;
 void log_number(const char *tag, const char *prefix, const char *type, Number *obj);
@@ -53,5 +52,4 @@ class Number : public EntityBase {
   CallbackManager<void(float)> state_callback_;
 };
 
-}  // namespace number
-}  // namespace esphome
+}  // namespace esphome::number

esphome/components/number/number_call.cpp

@@ -2,8 +2,7 @@
 #include "number.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace number {
+namespace esphome::number {
 
 static const char *const TAG = "number";
 
@@ -125,5 +124,4 @@ void NumberCall::perform() {
   this->parent_->control(target_value);
 }
 
-}  // namespace number
-}  // namespace esphome
+}  // namespace esphome::number

esphome/components/number/number_call.h

@@ -4,8 +4,7 @@
 #include "esphome/core/log.h"
 #include "number_traits.h"
 
-namespace esphome {
-namespace number {
+namespace esphome::number {
 
 class Number;
 
@@ -44,5 +43,4 @@ class NumberCall {
   bool cycle_;
 };
 
-}  // namespace number
-}  // namespace esphome
+}  // namespace esphome::number

esphome/components/number/number_traits.cpp

@@ -1,10 +1,8 @@
 #include "esphome/core/log.h"
 #include "number_traits.h"
 
-namespace esphome {
-namespace number {
+namespace esphome::number {
 
 static const char *const TAG = "number";
 
-}  // namespace number
-}  // namespace esphome
+}  // namespace esphome::number

esphome/components/number/number_traits.h

@@ -3,8 +3,7 @@
 #include "esphome/core/entity_base.h"
 #include "esphome/core/helpers.h"
 
-namespace esphome {
-namespace number {
+namespace esphome::number {
 
 enum NumberMode : uint8_t {
   NUMBER_MODE_AUTO = 0,
@@ -35,5 +34,4 @@ class NumberTraits : public EntityBase_DeviceClass, public EntityBase_UnitOfMeas
   NumberMode mode_{NUMBER_MODE_AUTO};
 };
 
-}  // namespace number
-}  // namespace esphome
+}  // namespace esphome::number

esphome/components/sfa30/sfa30.cpp

@@ -73,17 +73,17 @@ void SFA30Component::update() {
     }
 
     if (this->formaldehyde_sensor_ != nullptr) {
-      const float formaldehyde = raw_data[0] / 5.0f;
+      const float formaldehyde = static_cast<int16_t>(raw_data[0]) / 5.0f;
       this->formaldehyde_sensor_->publish_state(formaldehyde);
     }
 
     if (this->humidity_sensor_ != nullptr) {
-      const float humidity = raw_data[1] / 100.0f;
+      const float humidity = static_cast<int16_t>(raw_data[1]) / 100.0f;
       this->humidity_sensor_->publish_state(humidity);
     }
 
     if (this->temperature_sensor_ != nullptr) {
-      const float temperature = raw_data[2] / 200.0f;
+      const float temperature = static_cast<int16_t>(raw_data[2]) / 200.0f;
       this->temperature_sensor_->publish_state(temperature);
     }
 

esphome/components/web_server_idf/web_server_idf.cpp

@@ -94,6 +94,18 @@ void AsyncWebServer::end() {
   }
 }
 
+void AsyncWebServer::set_lru_purge_enable(bool enable) {
+  if (this->lru_purge_enable_ == enable) {
+    return;  // No change needed
+  }
+  this->lru_purge_enable_ = enable;
+  // If server is already running, restart it with new config
+  if (this->server_) {
+    this->end();
+    this->begin();
+  }
+}
+
 void AsyncWebServer::begin() {
   if (this->server_) {
     this->end();
@@ -101,6 +113,8 @@ void AsyncWebServer::begin() {
   httpd_config_t config = HTTPD_DEFAULT_CONFIG();
   config.server_port = this->port_;
   config.uri_match_fn = [](const char * /*unused*/, const char * /*unused*/, size_t /*unused*/) { return true; };
+  // Enable LRU purging if requested (e.g., by captive portal to handle probe bursts)
+  config.lru_purge_enable = this->lru_purge_enable_;
   if (httpd_start(&this->server_, &config) == ESP_OK) {
     const httpd_uri_t handler_get = {
         .uri = "",
@@ -242,6 +256,7 @@ void AsyncWebServerRequest::send(int code, const char *content_type, const char
 void AsyncWebServerRequest::redirect(const std::string &url) {
   httpd_resp_set_status(*this, "302 Found");
   httpd_resp_set_hdr(*this, "Location", url.c_str());
+  httpd_resp_set_hdr(*this, "Connection", "close");
   httpd_resp_send(*this, nullptr, 0);
 }
 

esphome/components/web_server_idf/web_server_idf.h

@@ -199,9 +199,13 @@ class AsyncWebServer {
     return *handler;
   }
 
+  void set_lru_purge_enable(bool enable);
+  httpd_handle_t get_server() { return this->server_; }
+
  protected:
   uint16_t port_{};
   httpd_handle_t server_{};
+  bool lru_purge_enable_{false};
   static esp_err_t request_handler(httpd_req_t *r);
   static esp_err_t request_post_handler(httpd_req_t *r);
   esp_err_t request_handler_(AsyncWebServerRequest *request) const;

esphome/components/wifi/__init__.py

@@ -69,6 +69,12 @@ CONF_MIN_AUTH_MODE = "min_auth_mode"
 # Limited to 127 because selected_sta_index_ is int8_t in C++
 MAX_WIFI_NETWORKS = 127
 
+# Default AP timeout - allows sufficient time to try all BSSIDs during initial connection
+# After AP starts, WiFi scanning is skipped to avoid disrupting the AP, so we only
+# get best-effort connection attempts. Longer timeout ensures we exhaust all options
+# before falling back to AP mode. Aligned with improv wifi_timeout default.
+DEFAULT_AP_TIMEOUT = "90s"
+
 wifi_ns = cg.esphome_ns.namespace("wifi")
 EAPAuth = wifi_ns.struct("EAPAuth")
 ManualIP = wifi_ns.struct("ManualIP")
@@ -177,7 +183,7 @@ CONF_AP_TIMEOUT = "ap_timeout"
 WIFI_NETWORK_AP = WIFI_NETWORK_BASE.extend(
     {
         cv.Optional(
-            CONF_AP_TIMEOUT, default="1min"
+            CONF_AP_TIMEOUT, default=DEFAULT_AP_TIMEOUT
         ): cv.positive_time_period_milliseconds,
     }
 )
@@ -479,11 +485,14 @@ async def to_code(config):
         cg.add(var.set_min_auth_mode(config[CONF_MIN_AUTH_MODE]))
     if config[CONF_FAST_CONNECT]:
         cg.add_define("USE_WIFI_FAST_CONNECT")
-    cg.add(var.set_passive_scan(config[CONF_PASSIVE_SCAN]))
+    # passive_scan defaults to false in C++ - only set if true
+    if config[CONF_PASSIVE_SCAN]:
+        cg.add(var.set_passive_scan(True))
     if CONF_OUTPUT_POWER in config:
         cg.add(var.set_output_power(config[CONF_OUTPUT_POWER]))
-
-    cg.add(var.set_enable_on_boot(config[CONF_ENABLE_ON_BOOT]))
+    # enable_on_boot defaults to true in C++ - only set if false
+    if not config[CONF_ENABLE_ON_BOOT]:
+        cg.add(var.set_enable_on_boot(False))
 
     if CORE.is_esp8266:
         cg.add_library("ESP8266WiFi", None)

esphome/components/wifi/wifi_component.cpp

@@ -199,7 +199,12 @@ static constexpr uint8_t WIFI_RETRY_COUNT_PER_AP = 1;
 
 /// Cooldown duration in milliseconds after adapter restart or repeated failures
 /// Allows WiFi hardware to stabilize before next connection attempt
-static constexpr uint32_t WIFI_COOLDOWN_DURATION_MS = 1000;
+static constexpr uint32_t WIFI_COOLDOWN_DURATION_MS = 500;
+
+/// Cooldown duration when fallback AP is active and captive portal may be running
+/// Longer interval gives users time to configure WiFi without constant connection attempts
+/// While connecting, WiFi can't beacon the AP properly, so needs longer cooldown
+static constexpr uint32_t WIFI_COOLDOWN_WITH_AP_ACTIVE_MS = 30000;
 
 static constexpr uint8_t get_max_retries_for_phase(WiFiRetryPhase phase) {
   switch (phase) {
@@ -275,7 +280,9 @@ int8_t WiFiComponent::find_next_hidden_sta_(int8_t start_index) {
       }
     }
 
-    if (!this->ssid_was_seen_in_scan_(sta.get_ssid())) {
+    // If we didn't scan this cycle, treat all networks as potentially hidden
+    // Otherwise, only retry networks that weren't seen in the scan
+    if (!this->did_scan_this_cycle_ || !this->ssid_was_seen_in_scan_(sta.get_ssid())) {
       ESP_LOGD(TAG, "Hidden candidate " LOG_SECRET("'%s'") " at index %d", sta.get_ssid().c_str(), static_cast<int>(i));
       return static_cast<int8_t>(i);
     }
@@ -417,10 +424,6 @@ void WiFiComponent::start() {
 void WiFiComponent::restart_adapter() {
   ESP_LOGW(TAG, "Restarting adapter");
   this->wifi_mode_(false, {});
-  // Enter cooldown state to allow WiFi hardware to stabilize after restart
-  // Don't set retry_phase_ or num_retried_ here - state machine handles transitions
-  this->state_ = WIFI_COMPONENT_STATE_COOLDOWN;
-  this->action_started_ = millis();
   this->error_from_callback_ = false;
 }
 
@@ -441,7 +444,16 @@ void WiFiComponent::loop() {
     switch (this->state_) {
       case WIFI_COMPONENT_STATE_COOLDOWN: {
         this->status_set_warning(LOG_STR("waiting to reconnect"));
-        if (now - this->action_started_ > WIFI_COOLDOWN_DURATION_MS) {
+        // Skip cooldown if new credentials were provided while connecting
+        if (this->skip_cooldown_next_cycle_) {
+          this->skip_cooldown_next_cycle_ = false;
+          this->check_connecting_finished();
+          break;
+        }
+        // Use longer cooldown when captive portal/improv is active to avoid disrupting user config
+        bool portal_active = this->is_captive_portal_active_() || this->is_esp32_improv_active_();
+        uint32_t cooldown_duration = portal_active ? WIFI_COOLDOWN_WITH_AP_ACTIVE_MS : WIFI_COOLDOWN_DURATION_MS;
+        if (now - this->action_started_ > cooldown_duration) {
           // After cooldown we either restarted the adapter because of
           // a failure, or something tried to connect over and over
           // so we entered cooldown. In both cases we call
@@ -495,7 +507,8 @@ void WiFiComponent::loop() {
 #endif  // USE_WIFI_AP
 
 #ifdef USE_IMPROV
-    if (esp32_improv::global_improv_component != nullptr && !esp32_improv::global_improv_component->is_active()) {
+    if (esp32_improv::global_improv_component != nullptr && !esp32_improv::global_improv_component->is_active() &&
+        !esp32_improv::global_improv_component->should_start()) {
       if (now - this->last_connected_ > esp32_improv::global_improv_component->get_wifi_timeout()) {
         if (this->wifi_mode_(true, {}))
           esp32_improv::global_improv_component->start();
@@ -605,6 +618,8 @@ void WiFiComponent::set_sta(const WiFiAP &ap) {
   this->init_sta(1);
   this->add_sta(ap);
   this->selected_sta_index_ = 0;
+  // When new credentials are set (e.g., from improv), skip cooldown to retry immediately
+  this->skip_cooldown_next_cycle_ = true;
 }
 
 WiFiAP WiFiComponent::build_params_for_current_phase_() {
@@ -666,6 +681,17 @@ void WiFiComponent::save_wifi_sta(const std::string &ssid, const std::string &pa
   sta.set_ssid(ssid);
   sta.set_password(password);
   this->set_sta(sta);
+
+  // Trigger connection attempt (exits cooldown if needed, no-op if already connecting/connected)
+  this->connect_soon_();
+}
+
+void WiFiComponent::connect_soon_() {
+  // Only trigger retry if we're in cooldown - if already connecting/connected, do nothing
+  if (this->state_ == WIFI_COMPONENT_STATE_COOLDOWN) {
+    ESP_LOGD(TAG, "Exiting cooldown early due to new WiFi credentials");
+    this->retry_connect();
+  }
 }
 
 void WiFiComponent::start_connecting(const WiFiAP &ap) {
@@ -963,6 +989,7 @@ void WiFiComponent::check_scanning_finished() {
     return;
   }
   this->scan_done_ = false;
+  this->did_scan_this_cycle_ = true;
 
   if (this->scan_result_.empty()) {
     ESP_LOGW(TAG, "No networks found");
@@ -1229,9 +1256,16 @@ WiFiRetryPhase WiFiComponent::determine_next_phase_() {
       return WiFiRetryPhase::RESTARTING_ADAPTER;
 
     case WiFiRetryPhase::RESTARTING_ADAPTER:
-      // After restart, go back to explicit hidden if we went through it initially, otherwise scan
-      return this->went_through_explicit_hidden_phase_() ? WiFiRetryPhase::EXPLICIT_HIDDEN
-                                                         : WiFiRetryPhase::SCAN_CONNECTING;
+      // After restart, go back to explicit hidden if we went through it initially
+      if (this->went_through_explicit_hidden_phase_()) {
+        return WiFiRetryPhase::EXPLICIT_HIDDEN;
+      }
+      // Skip scanning when captive portal/improv is active to avoid disrupting AP
+      // Even passive scans can cause brief AP disconnections on ESP32
+      if (this->is_captive_portal_active_() || this->is_esp32_improv_active_()) {
+        return WiFiRetryPhase::RETRY_HIDDEN;
+      }
+      return WiFiRetryPhase::SCAN_CONNECTING;
   }
 
   // Should never reach here
@@ -1319,6 +1353,12 @@ bool WiFiComponent::transition_to_phase_(WiFiRetryPhase new_phase) {
       if (!this->is_captive_portal_active_() && !this->is_esp32_improv_active_()) {
         this->restart_adapter();
       }
+      // Clear scan flag - we're starting a new retry cycle
+      this->did_scan_this_cycle_ = false;
+      // Always enter cooldown after restart (or skip-restart) to allow stabilization
+      // Use extended cooldown when AP is active to avoid constant scanning that blocks DNS
+      this->state_ = WIFI_COMPONENT_STATE_COOLDOWN;
+      this->action_started_ = millis();
       // Return true to indicate we should wait (go to COOLDOWN) instead of immediately connecting
       return true;
 

esphome/components/wifi/wifi_component.h

@@ -291,6 +291,7 @@ class WiFiComponent : public Component {
   void set_passive_scan(bool passive);
 
   void save_wifi_sta(const std::string &ssid, const std::string &password);
+
   // ========== INTERNAL METHODS ==========
   // (In most use cases you won't need these)
   /// Setup WiFi interface.
@@ -424,6 +425,8 @@ class WiFiComponent : public Component {
     return true;
   }
 
+  void connect_soon_();
+
   void wifi_loop_();
   bool wifi_mode_(optional<bool> sta, optional<bool> ap);
   bool wifi_sta_pre_setup_();
@@ -526,9 +529,11 @@ class WiFiComponent : public Component {
   bool btm_{false};
   bool rrm_{false};
 #endif
-  bool enable_on_boot_;
+  bool enable_on_boot_{true};
   bool got_ipv4_address_{false};
   bool keep_scan_results_{false};
+  bool did_scan_this_cycle_{false};
+  bool skip_cooldown_next_cycle_{false};
 
   // Pointers at the end (naturally aligned)
   Trigger<> *connect_trigger_{new Trigger<>()};

esphome/core/scheduler.cpp

@@ -154,8 +154,8 @@ void HOT Scheduler::set_timer_common_(Component *component, SchedulerItem::Type
 
   // For retries, check if there's a cancelled timeout first
   if (is_retry && name_cstr != nullptr && type == SchedulerItem::TIMEOUT &&
-      (has_cancelled_timeout_in_container_(this->items_, component, name_cstr, /* match_retry= */ true) ||
-       has_cancelled_timeout_in_container_(this->to_add_, component, name_cstr, /* match_retry= */ true))) {
+      (has_cancelled_timeout_in_container_locked_(this->items_, component, name_cstr, /* match_retry= */ true) ||
+       has_cancelled_timeout_in_container_locked_(this->to_add_, component, name_cstr, /* match_retry= */ true))) {
     // Skip scheduling - the retry was cancelled
 #ifdef ESPHOME_DEBUG_SCHEDULER
     ESP_LOGD(TAG, "Skipping retry '%s' - found cancelled item", name_cstr);
@@ -556,7 +556,8 @@ bool HOT Scheduler::cancel_item_locked_(Component *component, const char *name_c
 #ifndef ESPHOME_THREAD_SINGLE
   // Mark items in defer queue as cancelled (they'll be skipped when processed)
   if (type == SchedulerItem::TIMEOUT) {
-    total_cancelled += this->mark_matching_items_removed_(this->defer_queue_, component, name_cstr, type, match_retry);
+    total_cancelled +=
+        this->mark_matching_items_removed_locked_(this->defer_queue_, component, name_cstr, type, match_retry);
   }
 #endif /* not ESPHOME_THREAD_SINGLE */
 
@@ -565,19 +566,20 @@ bool HOT Scheduler::cancel_item_locked_(Component *component, const char *name_c
   // (removing the last element doesn't break heap structure)
   if (!this->items_.empty()) {
     auto &last_item = this->items_.back();
-    if (this->matches_item_(last_item, component, name_cstr, type, match_retry)) {
+    if (this->matches_item_locked_(last_item, component, name_cstr, type, match_retry)) {
       this->recycle_item_(std::move(this->items_.back()));
       this->items_.pop_back();
       total_cancelled++;
     }
     // For other items in heap, we can only mark for removal (can't remove from middle of heap)
-    size_t heap_cancelled = this->mark_matching_items_removed_(this->items_, component, name_cstr, type, match_retry);
+    size_t heap_cancelled =
+        this->mark_matching_items_removed_locked_(this->items_, component, name_cstr, type, match_retry);
     total_cancelled += heap_cancelled;
     this->to_remove_ += heap_cancelled;  // Track removals for heap items
   }
 
   // Cancel items in to_add_
-  total_cancelled += this->mark_matching_items_removed_(this->to_add_, component, name_cstr, type, match_retry);
+  total_cancelled += this->mark_matching_items_removed_locked_(this->to_add_, component, name_cstr, type, match_retry);
 
   return total_cancelled > 0;
 }

esphome/core/scheduler.h

@@ -243,8 +243,18 @@ class Scheduler {
   }
 
   // Helper function to check if item matches criteria for cancellation
-  inline bool HOT matches_item_(const std::unique_ptr<SchedulerItem> &item, Component *component, const char *name_cstr,
-                                SchedulerItem::Type type, bool match_retry, bool skip_removed = true) const {
+  // IMPORTANT: Must be called with scheduler lock held
+  inline bool HOT matches_item_locked_(const std::unique_ptr<SchedulerItem> &item, Component *component,
+                                       const char *name_cstr, SchedulerItem::Type type, bool match_retry,
+                                       bool skip_removed = true) const {
+    // THREAD SAFETY: Check for nullptr first to prevent LoadProhibited crashes. On multi-threaded
+    // platforms, items can be moved out of defer_queue_ during processing, leaving nullptr entries.
+    // PR #11305 added nullptr checks in callers (mark_matching_items_removed_locked_() and
+    // has_cancelled_timeout_in_container_locked_()), but this check provides defense-in-depth: helper
+    // functions should be safe regardless of caller behavior.
+    // Fixes: https://github.com/esphome/esphome/issues/11940
+    if (!item)
+      return false;
     if (item->component != component || item->type != type || (skip_removed && item->remove) ||
         (match_retry && !item->is_retry)) {
       return false;
@@ -304,8 +314,8 @@ class Scheduler {
         // SAFETY: Moving out the unique_ptr leaves a nullptr in the vector at defer_queue_front_.
         // This is intentional and safe because:
         // 1. The vector is only cleaned up by cleanup_defer_queue_locked_() at the end of this function
-        // 2. Any code iterating defer_queue_ MUST check for nullptr items (see mark_matching_items_removed_
-        //    and has_cancelled_timeout_in_container_ in scheduler.h)
+        // 2. Any code iterating defer_queue_ MUST check for nullptr items (see mark_matching_items_removed_locked_
+        //    and has_cancelled_timeout_in_container_locked_ in scheduler.h)
         // 3. The lock protects concurrent access, but the nullptr remains until cleanup
         item = std::move(this->defer_queue_[this->defer_queue_front_]);
         this->defer_queue_front_++;
@@ -393,10 +403,10 @@ class Scheduler {
 
   // Helper to mark matching items in a container as removed
   // Returns the number of items marked for removal
-  // IMPORTANT: Caller must hold the scheduler lock before calling this function.
+  // IMPORTANT: Must be called with scheduler lock held
   template<typename Container>
-  size_t mark_matching_items_removed_(Container &container, Component *component, const char *name_cstr,
-                                      SchedulerItem::Type type, bool match_retry) {
+  size_t mark_matching_items_removed_locked_(Container &container, Component *component, const char *name_cstr,
+                                             SchedulerItem::Type type, bool match_retry) {
     size_t count = 0;
     for (auto &item : container) {
       // Skip nullptr items (can happen in defer_queue_ when items are being processed)
@@ -405,7 +415,7 @@ class Scheduler {
       // the vector can still contain nullptr items from the processing loop. This check prevents crashes.
       if (!item)
         continue;
-      if (this->matches_item_(item, component, name_cstr, type, match_retry)) {
+      if (this->matches_item_locked_(item, component, name_cstr, type, match_retry)) {
         // Mark item for removal (platform-specific)
         this->set_item_removed_(item.get(), true);
         count++;
@@ -415,9 +425,10 @@ class Scheduler {
   }
 
   // Template helper to check if any item in a container matches our criteria
+  // IMPORTANT: Must be called with scheduler lock held
   template<typename Container>
-  bool has_cancelled_timeout_in_container_(const Container &container, Component *component, const char *name_cstr,
-                                           bool match_retry) const {
+  bool has_cancelled_timeout_in_container_locked_(const Container &container, Component *component,
+                                                  const char *name_cstr, bool match_retry) const {
     for (const auto &item : container) {
       // Skip nullptr items (can happen in defer_queue_ when items are being processed)
       // The defer_queue_ uses index-based processing: items are std::moved out but left in the
@@ -426,8 +437,8 @@ class Scheduler {
       if (!item)
         continue;
       if (is_item_removed_(item.get()) &&
-          this->matches_item_(item, component, name_cstr, SchedulerItem::TIMEOUT, match_retry,
-                              /* skip_removed= */ false)) {
+          this->matches_item_locked_(item, component, name_cstr, SchedulerItem::TIMEOUT, match_retry,
+                                     /* skip_removed= */ false)) {
         return true;
       }
     }

esphome/writer.py

@@ -121,7 +121,7 @@ def update_storage_json() -> None:
             )
         else:
             _LOGGER.info("Core config or version changed, cleaning build files...")
-        clean_build()
+        clean_build(clear_pio_cache=False)
     elif storage_should_update_cmake_cache(old, new):
         _LOGGER.info("Integrations changed, cleaning cmake cache...")
         clean_cmake_cache()
@@ -301,7 +301,7 @@ def clean_cmake_cache():
             pioenvs_cmake_path.unlink()
 
 
-def clean_build():
+def clean_build(clear_pio_cache: bool = True):
     import shutil
 
     # Allow skipping cache cleaning for integration tests
@@ -322,6 +322,9 @@ def clean_build():
         _LOGGER.info("Deleting %s", dependencies_lock)
         dependencies_lock.unlink()
 
+    if not clear_pio_cache:
+        return
+
     # Clean PlatformIO cache to resolve CMake compiler detection issues
     # This helps when toolchain paths change or get corrupted
     try:

requirements.txt

@@ -10,13 +10,13 @@ tzdata>=2021.1  # from time
 pyserial==3.5
 platformio==6.1.18  # When updating platformio, also update /docker/Dockerfile
 esptool==5.1.0
-click==8.3.1
+click==8.1.7
 esphome-dashboard==20251013.0
 aioesphomeapi==42.7.0
 zeroconf==0.148.0
 puremagic==1.30
 ruamel.yaml==0.18.16 # dashboard_import
-ruamel.yaml.clib==0.2.14 # dashboard_import
+ruamel.yaml.clib==0.2.15 # dashboard_import
 esphome-glyphsets==0.2.0
 pillow==11.3.0
 cairosvg==2.8.2

tests/components/lvgl/lvgl-package.yaml

@@ -703,7 +703,9 @@ lvgl:
             on_value:
               - lvgl.spinbox.update:
                   id: spinbox_id
-                  value: !lambda return x;
+                  value: !lambda |-
+                      static float yyy = 83.0;
+                      return yyy + .8;
         - button:
             styles: spin_button
             id: spin_up