Merge pull request #12293 from esphome/bump-2025.11.4

2025.11.4

.github/workflows/release.yml

@@ -219,10 +219,19 @@ jobs:
       - init
       - deploy-manifest
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+        with:
+          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          owner: esphome
+          repositories: home-assistant-addon
+
       - name: Trigger Workflow
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
-          github-token: ${{ secrets.DEPLOY_HA_ADDON_REPO_TOKEN }}
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             let description = "ESPHome";
             if (context.eventName == "release") {
@@ -245,10 +254,19 @@ jobs:
     needs: [init]
     environment: ${{ needs.init.outputs.deploy_env }}
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+        with:
+          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          owner: esphome
+          repositories: esphome-schema
+
       - name: Trigger Workflow
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
-          github-token: ${{ secrets.DEPLOY_ESPHOME_SCHEMA_REPO_TOKEN }}
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             github.rest.actions.createWorkflowDispatch({
               owner: "esphome",
@@ -259,3 +277,34 @@ jobs:
                 version: "${{ needs.init.outputs.tag }}",
               }
             })
+
+  version-notifier:
+    if: github.repository == 'esphome/esphome' && needs.init.outputs.branch_build == 'false'
+    runs-on: ubuntu-latest
+    needs:
+      - init
+      - deploy-manifest
+    steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+        with:
+          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          owner: esphome
+          repositories: version-notifier
+
+      - name: Trigger Workflow
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          script: |
+            github.rest.actions.createWorkflowDispatch({
+              owner: "esphome",
+              repo: "version-notifier",
+              workflow_id: "notify.yml",
+              ref: "main",
+              inputs: {
+                version: "${{ needs.init.outputs.tag }}",
+              }
+            })

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2025.11.2
+PROJECT_NUMBER         = 2025.11.4
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

esphome/components/ade7953_base/ade7953_base.cpp

@@ -25,7 +25,8 @@ void ADE7953::setup() {
     this->ade_write_8(PGA_V_8, pga_v_);
     this->ade_write_8(PGA_IA_8, pga_ia_);
     this->ade_write_8(PGA_IB_8, pga_ib_);
-    this->ade_write_32(AVGAIN_32, vgain_);
+    this->ade_write_32(AVGAIN_32, avgain_);
+    this->ade_write_32(BVGAIN_32, bvgain_);
     this->ade_write_32(AIGAIN_32, aigain_);
     this->ade_write_32(BIGAIN_32, bigain_);
     this->ade_write_32(AWGAIN_32, awgain_);
@@ -34,7 +35,8 @@ void ADE7953::setup() {
     this->ade_read_8(PGA_V_8, &pga_v_);
     this->ade_read_8(PGA_IA_8, &pga_ia_);
     this->ade_read_8(PGA_IB_8, &pga_ib_);
-    this->ade_read_32(AVGAIN_32, &vgain_);
+    this->ade_read_32(AVGAIN_32, &avgain_);
+    this->ade_read_32(BVGAIN_32, &bvgain_);
     this->ade_read_32(AIGAIN_32, &aigain_);
     this->ade_read_32(BIGAIN_32, &bigain_);
     this->ade_read_32(AWGAIN_32, &awgain_);
@@ -63,13 +65,14 @@ void ADE7953::dump_config() {
                 "  PGA_V_8: 0x%X\n"
                 "  PGA_IA_8: 0x%X\n"
                 "  PGA_IB_8: 0x%X\n"
-                "  VGAIN_32: 0x%08jX\n"
+                "  AVGAIN_32: 0x%08jX\n"
+                "  BVGAIN_32: 0x%08jX\n"
                 "  AIGAIN_32: 0x%08jX\n"
                 "  BIGAIN_32: 0x%08jX\n"
                 "  AWGAIN_32: 0x%08jX\n"
                 "  BWGAIN_32: 0x%08jX",
-                this->use_acc_energy_regs_, pga_v_, pga_ia_, pga_ib_, (uintmax_t) vgain_, (uintmax_t) aigain_,
-                (uintmax_t) bigain_, (uintmax_t) awgain_, (uintmax_t) bwgain_);
+                this->use_acc_energy_regs_, pga_v_, pga_ia_, pga_ib_, (uintmax_t) avgain_, (uintmax_t) bvgain_,
+                (uintmax_t) aigain_, (uintmax_t) bigain_, (uintmax_t) awgain_, (uintmax_t) bwgain_);
 }
 
 #define ADE_PUBLISH_(name, val, factor) \

esphome/components/ade7953_base/ade7953_base.h

@@ -46,7 +46,12 @@ class ADE7953 : public PollingComponent, public sensor::Sensor {
   void set_pga_ib(uint8_t pga_ib) { pga_ib_ = pga_ib; }
 
   // Set input gains
-  void set_vgain(uint32_t vgain) { vgain_ = vgain; }
+  void set_vgain(uint32_t vgain) {
+    // Datasheet says: "to avoid discrepancies in other registers,
+    // if AVGAIN is set then BVGAIN should be set to the same value."
+    avgain_ = vgain;
+    bvgain_ = vgain;
+  }
   void set_aigain(uint32_t aigain) { aigain_ = aigain; }
   void set_bigain(uint32_t bigain) { bigain_ = bigain; }
   void set_awgain(uint32_t awgain) { awgain_ = awgain; }
@@ -100,7 +105,8 @@ class ADE7953 : public PollingComponent, public sensor::Sensor {
   uint8_t pga_v_;
   uint8_t pga_ia_;
   uint8_t pga_ib_;
-  uint32_t vgain_;
+  uint32_t avgain_;
+  uint32_t bvgain_;
   uint32_t aigain_;
   uint32_t bigain_;
   uint32_t awgain_;

esphome/components/analog_threshold/analog_threshold_binary_sensor.cpp

@@ -12,10 +12,11 @@ void AnalogThresholdBinarySensor::setup() {
   // TRUE state is defined to be when sensor is >= threshold
   // so when undefined sensor value initialize to FALSE
   if (std::isnan(sensor_value)) {
+    this->raw_state_ = false;
     this->publish_initial_state(false);
   } else {
-    this->publish_initial_state(sensor_value >=
-                                (this->lower_threshold_.value() + this->upper_threshold_.value()) / 2.0f);
+    this->raw_state_ = sensor_value >= (this->lower_threshold_.value() + this->upper_threshold_.value()) / 2.0f;
+    this->publish_initial_state(this->raw_state_);
   }
 }
 
@@ -25,8 +26,10 @@ void AnalogThresholdBinarySensor::set_sensor(sensor::Sensor *analog_sensor) {
   this->sensor_->add_on_state_callback([this](float sensor_value) {
     // if there is an invalid sensor reading, ignore the change and keep the current state
     if (!std::isnan(sensor_value)) {
-      this->publish_state(sensor_value >=
-                          (this->state ? this->lower_threshold_.value() : this->upper_threshold_.value()));
+      // Use raw_state_ for hysteresis logic, not this->state which is post-filter
+      this->raw_state_ =
+          sensor_value >= (this->raw_state_ ? this->lower_threshold_.value() : this->upper_threshold_.value());
+      this->publish_state(this->raw_state_);
     }
   });
 }

esphome/components/analog_threshold/analog_threshold_binary_sensor.h

@@ -20,6 +20,7 @@ class AnalogThresholdBinarySensor : public Component, public binary_sensor::Bina
   sensor::Sensor *sensor_{nullptr};
   TemplatableValue<float> upper_threshold_{};
   TemplatableValue<float> lower_threshold_{};
+  bool raw_state_{false};  // Pre-filter state for hysteresis logic
 };
 
 }  // namespace analog_threshold

esphome/components/es8311/audio_dac.py

@@ -22,7 +22,6 @@ ES8311_BITS_PER_SAMPLE_ENUM = {
 
 es8311_mic_gain = es8311_ns.enum("ES8311MicGain")
 ES8311_MIC_GAIN_ENUM = {
-    "MIN": es8311_mic_gain.ES8311_MIC_GAIN_MIN,
     "0DB": es8311_mic_gain.ES8311_MIC_GAIN_0DB,
     "6DB": es8311_mic_gain.ES8311_MIC_GAIN_6DB,
     "12DB": es8311_mic_gain.ES8311_MIC_GAIN_12DB,
@@ -31,7 +30,6 @@ ES8311_MIC_GAIN_ENUM = {
     "30DB": es8311_mic_gain.ES8311_MIC_GAIN_30DB,
     "36DB": es8311_mic_gain.ES8311_MIC_GAIN_36DB,
     "42DB": es8311_mic_gain.ES8311_MIC_GAIN_42DB,
-    "MAX": es8311_mic_gain.ES8311_MIC_GAIN_MAX,
 }
 
 

esphome/components/esp32/__init__.py

@@ -860,6 +860,7 @@ async def to_code(config):
     )
     cg.set_cpp_standard("gnu++20")
     cg.add_build_flag("-DUSE_ESP32")
+    cg.add_build_flag("-Wl,-z,noexecstack")
     cg.add_define("ESPHOME_BOARD", config[CONF_BOARD])
     variant = config[CONF_VARIANT]
     cg.add_build_flag(f"-DUSE_ESP32_VARIANT_{variant}")

esphome/components/esp32_hosted/__init__.py

@@ -93,9 +93,9 @@ async def to_code(config):
     framework_ver: cv.Version = CORE.data[KEY_CORE][KEY_FRAMEWORK_VERSION]
     os.environ["ESP_IDF_VERSION"] = f"{framework_ver.major}.{framework_ver.minor}"
     if framework_ver >= cv.Version(5, 5, 0):
-        esp32.add_idf_component(name="espressif/esp_wifi_remote", ref="1.1.5")
+        esp32.add_idf_component(name="espressif/esp_wifi_remote", ref="1.2.2")
         esp32.add_idf_component(name="espressif/eppp_link", ref="1.1.3")
-        esp32.add_idf_component(name="espressif/esp_hosted", ref="2.6.1")
+        esp32.add_idf_component(name="espressif/esp_hosted", ref="2.7.0")
     else:
         esp32.add_idf_component(name="espressif/esp_wifi_remote", ref="0.13.0")
         esp32.add_idf_component(name="espressif/eppp_link", ref="0.2.0")

esphome/components/espnow/espnow_component.cpp

@@ -10,6 +10,7 @@
 
 #include <esp_event.h>
 #include <esp_mac.h>
+#include <esp_netif.h>
 #include <esp_now.h>
 #include <esp_random.h>
 #include <esp_wifi.h>
@@ -157,6 +158,12 @@ bool ESPNowComponent::is_wifi_enabled() {
 }
 
 void ESPNowComponent::setup() {
+#ifndef USE_WIFI
+  // Initialize LwIP stack for wake_loop_threadsafe() socket support
+  // When WiFi component is present, it handles esp_netif_init()
+  ESP_ERROR_CHECK(esp_netif_init());
+#endif
+
   if (this->enable_on_boot_) {
     this->enable_();
   } else {

esphome/components/hlk_fm22x/hlk_fm22x.h

@@ -189,7 +189,7 @@ template<typename... Ts> class EnrollmentAction : public Action<Ts...>, public P
   TEMPLATABLE_VALUE(std::string, name)
   TEMPLATABLE_VALUE(uint8_t, direction)
 
-  void play(Ts... x) override {
+  void play(const Ts &...x) override {
     auto name = this->name_.value(x...);
     auto direction = (HlkFm22xFaceDirection) this->direction_.value(x...);
     this->parent_->enroll_face(name, direction);
@@ -200,7 +200,7 @@ template<typename... Ts> class DeleteAction : public Action<Ts...>, public Paren
  public:
   TEMPLATABLE_VALUE(int16_t, face_id)
 
-  void play(Ts... x) override {
+  void play(const Ts &...x) override {
     auto face_id = this->face_id_.value(x...);
     this->parent_->delete_face(face_id);
   }
@@ -208,17 +208,17 @@ template<typename... Ts> class DeleteAction : public Action<Ts...>, public Paren
 
 template<typename... Ts> class DeleteAllAction : public Action<Ts...>, public Parented<HlkFm22xComponent> {
  public:
-  void play(Ts... x) override { this->parent_->delete_all_faces(); }
+  void play(const Ts &...x) override { this->parent_->delete_all_faces(); }
 };
 
 template<typename... Ts> class ScanAction : public Action<Ts...>, public Parented<HlkFm22xComponent> {
  public:
-  void play(Ts... x) override { this->parent_->scan_face(); }
+  void play(const Ts &...x) override { this->parent_->scan_face(); }
 };
 
 template<typename... Ts> class ResetAction : public Action<Ts...>, public Parented<HlkFm22xComponent> {
  public:
-  void play(Ts... x) override { this->parent_->reset(); }
+  void play(const Ts &...x) override { this->parent_->reset(); }
 };
 
 }  // namespace esphome::hlk_fm22x

esphome/components/ld2420/ld2420.cpp

@@ -205,8 +205,10 @@ void LD2420Component::dump_config() {
   LOG_BUTTON("  ", "Factory Reset:", this->factory_reset_button_);
   LOG_BUTTON("  ", "Restart Module:", this->restart_module_button_);
 #endif
+#ifdef USE_SELECT
   ESP_LOGCONFIG(TAG, "Select:");
   LOG_SELECT("  ", "Operating Mode", this->operating_selector_);
+#endif
   if (ld2420::get_firmware_int(this->firmware_ver_) < CALIBRATE_VERSION_MIN) {
     ESP_LOGW(TAG, "Firmware version %s and older supports Simple Mode only", this->firmware_ver_);
   }
@@ -238,12 +240,20 @@ void LD2420Component::setup() {
   memcpy(&this->new_config, &this->current_config, sizeof(this->current_config));
   if (ld2420::get_firmware_int(this->firmware_ver_) < CALIBRATE_VERSION_MIN) {
     this->set_operating_mode(OP_SIMPLE_MODE_STRING);
-    this->operating_selector_->publish_state(OP_SIMPLE_MODE_STRING);
+#ifdef USE_SELECT
+    if (this->operating_selector_ != nullptr) {
+      this->operating_selector_->publish_state(OP_SIMPLE_MODE_STRING);
+    }
+#endif
     this->set_mode_(CMD_SYSTEM_MODE_SIMPLE);
     ESP_LOGW(TAG, "Firmware version %s and older supports Simple Mode only", this->firmware_ver_);
   } else {
     this->set_mode_(CMD_SYSTEM_MODE_ENERGY);
-    this->operating_selector_->publish_state(OP_NORMAL_MODE_STRING);
+#ifdef USE_SELECT
+    if (this->operating_selector_ != nullptr) {
+      this->operating_selector_->publish_state(OP_NORMAL_MODE_STRING);
+    }
+#endif
   }
 #ifdef USE_NUMBER
   this->init_gate_config_numbers();
@@ -383,8 +393,12 @@ void LD2420Component::set_operating_mode(const char *state) {
   // If unsupported firmware ignore mode select
   if (ld2420::get_firmware_int(firmware_ver_) >= CALIBRATE_VERSION_MIN) {
     this->current_operating_mode = find_uint8(OP_MODE_BY_STR, state);
-    // Entering Auto Calibrate we need to clear the privoiuos data collection
-    this->operating_selector_->publish_state(state);
+    // Entering Auto Calibrate we need to clear the previous data collection
+#ifdef USE_SELECT
+    if (this->operating_selector_ != nullptr) {
+      this->operating_selector_->publish_state(state);
+    }
+#endif
     if (current_operating_mode == OP_CALIBRATE_MODE) {
       this->set_calibration_(true);
       for (uint8_t gate = 0; gate < TOTAL_GATES; gate++) {
@@ -404,7 +418,11 @@ void LD2420Component::set_operating_mode(const char *state) {
     }
   } else {
     this->current_operating_mode = OP_SIMPLE_MODE;
-    this->operating_selector_->publish_state(OP_SIMPLE_MODE_STRING);
+#ifdef USE_SELECT
+    if (this->operating_selector_ != nullptr) {
+      this->operating_selector_->publish_state(OP_SIMPLE_MODE_STRING);
+    }
+#endif
   }
 }
 

esphome/components/mopeka_pro_check/mopeka_pro_check.cpp

@@ -116,7 +116,7 @@ bool MopekaProCheck::parse_device(const esp32_ble_tracker::ESPBTDevice &device)
 
   // Get temperature of sensor
   if (this->temperature_ != nullptr) {
-    uint8_t temp_in_c = this->parse_temperature_(manu_data.data);
+    int8_t temp_in_c = this->parse_temperature_(manu_data.data);
     this->temperature_->publish_state(temp_in_c);
   }
 
@@ -145,7 +145,7 @@ uint32_t MopekaProCheck::parse_distance_(const std::vector<uint8_t> &message) {
                      (MOPEKA_LPG_COEF[0] + MOPEKA_LPG_COEF[1] * raw_t + MOPEKA_LPG_COEF[2] * raw_t * raw_t));
 }
 
-uint8_t MopekaProCheck::parse_temperature_(const std::vector<uint8_t> &message) { return (message[2] & 0x7F) - 40; }
+int8_t MopekaProCheck::parse_temperature_(const std::vector<uint8_t> &message) { return (message[2] & 0x7F) - 40; }
 
 SensorReadQuality MopekaProCheck::parse_read_quality_(const std::vector<uint8_t> &message) {
   // Since a 8 bit value is being shifted and truncated to 2 bits all possible values are defined as enumeration

esphome/components/mopeka_pro_check/mopeka_pro_check.h

@@ -61,7 +61,7 @@ class MopekaProCheck : public Component, public esp32_ble_tracker::ESPBTDeviceLi
 
   uint8_t parse_battery_level_(const std::vector<uint8_t> &message);
   uint32_t parse_distance_(const std::vector<uint8_t> &message);
-  uint8_t parse_temperature_(const std::vector<uint8_t> &message);
+  int8_t parse_temperature_(const std::vector<uint8_t> &message);
   SensorReadQuality parse_read_quality_(const std::vector<uint8_t> &message);
 };
 

esphome/components/rtl87xx/__init__.py

@@ -6,10 +6,13 @@
 # in schema.py file in this directory.
 
 from esphome import pins
+import esphome.codegen as cg
 from esphome.components import libretiny
 from esphome.components.libretiny.const import (
     COMPONENT_RTL87XX,
+    FAMILY_RTL8710B,
     KEY_COMPONENT_DATA,
+    KEY_FAMILY,
     KEY_LIBRETINY,
     LibreTinyComponent,
 )
@@ -45,6 +48,11 @@ CONFIG_SCHEMA.prepend_extra(_set_core_data)
 
 
 async def to_code(config):
+    # Use FreeRTOS 8.2.3+ for xTaskNotifyGive/ulTaskNotifyTake required by AsyncTCP 3.4.3+
+    # https://github.com/esphome/esphome/issues/10220
+    # Only for RTL8710B (ambz) - RTL8720C (ambz2) requires FreeRTOS 10.x
+    if CORE.data[KEY_LIBRETINY][KEY_FAMILY] == FAMILY_RTL8710B:
+        cg.add_platformio_option("custom_versions.freertos", "8.2.3")
     return await libretiny.component_to_code(config)
 
 

esphome/components/usb_uart/__init__.py

@@ -1,4 +1,5 @@
 import esphome.codegen as cg
+from esphome.components import socket
 from esphome.components.uart import (
     CONF_DATA_BITS,
     CONF_PARITY,
@@ -17,7 +18,7 @@ from esphome.const import (
 )
 from esphome.cpp_types import Component
 
-AUTO_LOAD = ["uart", "usb_host", "bytebuffer"]
+AUTO_LOAD = ["uart", "usb_host", "bytebuffer", "socket"]
 CODEOWNERS = ["@clydebarrow"]
 
 usb_uart_ns = cg.esphome_ns.namespace("usb_uart")
@@ -116,6 +117,10 @@ CONFIG_SCHEMA = cv.ensure_list(
 
 
 async def to_code(config):
+    # Enable wake_loop_threadsafe for low-latency USB data processing
+    # The USB task queues data events that need immediate processing
+    socket.require_wake_loop_threadsafe()
+
     for device in config:
         var = await register_usb_client(device)
         for index, channel in enumerate(device[CONF_CHANNELS]):

esphome/components/usb_uart/usb_uart.cpp

@@ -2,6 +2,7 @@
 #if defined(USE_ESP32_VARIANT_ESP32S2) || defined(USE_ESP32_VARIANT_ESP32S3) || defined(USE_ESP32_VARIANT_ESP32P4)
 #include "usb_uart.h"
 #include "esphome/core/log.h"
+#include "esphome/core/application.h"
 #include "esphome/components/uart/uart_debugger.h"
 
 #include <cinttypes>
@@ -262,6 +263,11 @@ void USBUartComponent::start_input(USBUartChannel *channel) {
       // Push to lock-free queue for main loop processing
       // Push always succeeds because pool size == queue size
       this->usb_data_queue_.push(chunk);
+
+      // Wake main loop immediately to process USB data instead of waiting for select() timeout
+#if defined(USE_SOCKET_SELECT_SUPPORT) && defined(USE_WAKE_LOOP_THREADSAFE)
+      App.wake_loop_threadsafe();
+#endif
     }
 
     // On success, restart input immediately from USB task for performance

esphome/config_validation.py

@@ -740,9 +740,10 @@ def has_at_most_one_key(*keys):
         if not isinstance(obj, dict):
             raise Invalid("expected dictionary")
 
-        number = sum(k in keys for k in obj)
-        if number > 1:
-            raise Invalid(f"Cannot specify more than one of {', '.join(keys)}.")
+        used = set(obj) & set(keys)
+        if len(used) > 1:
+            msg = "Cannot specify more than one of '" + "', '".join(used) + "'."
+            raise MultipleInvalid([Invalid(msg, path=[k]) for k in used])
         return obj
 
     return validate

esphome/const.py

@@ -4,7 +4,7 @@ from enum import Enum
 
 from esphome.enum import StrEnum
 
-__version__ = "2025.11.2"
+__version__ = "2025.11.4"
 
 ALLOWED_NAME_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789-_"
 VALID_SUBSTITUTIONS_CHARACTERS = (

esphome/core/helpers.h

@@ -225,6 +225,9 @@ template<typename T> class FixedVector {
     other.reset_();
   }
 
+  // Allow conversion to std::vector
+  operator std::vector<T>() const { return {data_, data_ + size_}; }
+
   FixedVector &operator=(FixedVector &&other) noexcept {
     if (this != &other) {
       // Delete our current data

esphome/core/scheduler.cpp

@@ -315,7 +315,7 @@ void Scheduler::full_cleanup_removed_items_() {
       valid_items.push_back(std::move(item));
     } else {
       // Recycle removed items
-      this->recycle_item_(std::move(item));
+      this->recycle_item_main_loop_(std::move(item));
     }
   }
 
@@ -400,7 +400,7 @@ void HOT Scheduler::call(uint32_t now) {
     // Don't run on failed components
     if (item->component != nullptr && item->component->is_failed()) {
       LockGuard guard{this->lock_};
-      this->recycle_item_(this->pop_raw_locked_());
+      this->recycle_item_main_loop_(this->pop_raw_locked_());
       continue;
     }
 
@@ -413,7 +413,7 @@ void HOT Scheduler::call(uint32_t now) {
     {
       LockGuard guard{this->lock_};
       if (is_item_removed_(item.get())) {
-        this->recycle_item_(this->pop_raw_locked_());
+        this->recycle_item_main_loop_(this->pop_raw_locked_());
         this->to_remove_--;
         continue;
       }
@@ -422,7 +422,7 @@ void HOT Scheduler::call(uint32_t now) {
     // Single-threaded or multi-threaded with atomics: can check without lock
     if (is_item_removed_(item.get())) {
       LockGuard guard{this->lock_};
-      this->recycle_item_(this->pop_raw_locked_());
+      this->recycle_item_main_loop_(this->pop_raw_locked_());
       this->to_remove_--;
       continue;
     }
@@ -449,7 +449,7 @@ void HOT Scheduler::call(uint32_t now) {
     if (executed_item->remove) {
       // We were removed/cancelled in the function call, recycle and continue
       this->to_remove_--;
-      this->recycle_item_(std::move(executed_item));
+      this->recycle_item_main_loop_(std::move(executed_item));
       continue;
     }
 
@@ -460,7 +460,7 @@ void HOT Scheduler::call(uint32_t now) {
       this->to_add_.push_back(std::move(executed_item));
     } else {
       // Timeout completed - recycle it
-      this->recycle_item_(std::move(executed_item));
+      this->recycle_item_main_loop_(std::move(executed_item));
     }
 
     has_added_items |= !this->to_add_.empty();
@@ -475,7 +475,7 @@ void HOT Scheduler::process_to_add() {
   for (auto &it : this->to_add_) {
     if (is_item_removed_(it.get())) {
       // Recycle cancelled items
-      this->recycle_item_(std::move(it));
+      this->recycle_item_main_loop_(std::move(it));
       continue;
     }
 
@@ -509,7 +509,7 @@ size_t HOT Scheduler::cleanup_() {
     if (!item->remove)
       break;
     this->to_remove_--;
-    this->recycle_item_(this->pop_raw_locked_());
+    this->recycle_item_main_loop_(this->pop_raw_locked_());
   }
   return this->items_.size();
 }
@@ -562,20 +562,15 @@ bool HOT Scheduler::cancel_item_locked_(Component *component, const char *name_c
 #endif /* not ESPHOME_THREAD_SINGLE */
 
   // Cancel items in the main heap
-  // Special case: if the last item in the heap matches, we can remove it immediately
-  // (removing the last element doesn't break heap structure)
+  // We only mark items for removal here - never recycle directly.
+  // The main loop may be executing an item's callback right now, and recycling
+  // would destroy the callback while it's running (use-after-free).
+  // Only the main loop in call() should recycle items after execution completes.
   if (!this->items_.empty()) {
-    auto &last_item = this->items_.back();
-    if (this->matches_item_locked_(last_item, component, name_cstr, type, match_retry)) {
-      this->recycle_item_(std::move(this->items_.back()));
-      this->items_.pop_back();
-      total_cancelled++;
-    }
-    // For other items in heap, we can only mark for removal (can't remove from middle of heap)
     size_t heap_cancelled =
         this->mark_matching_items_removed_locked_(this->items_, component, name_cstr, type, match_retry);
     total_cancelled += heap_cancelled;
-    this->to_remove_ += heap_cancelled;  // Track removals for heap items
+    this->to_remove_ += heap_cancelled;
   }
 
   // Cancel items in to_add_
@@ -749,7 +744,7 @@ bool HOT Scheduler::SchedulerItem::cmp(const std::unique_ptr<SchedulerItem> &a,
                                                               : (a->next_execution_high_ > b->next_execution_high_);
 }
 
-void Scheduler::recycle_item_(std::unique_ptr<SchedulerItem> item) {
+void Scheduler::recycle_item_main_loop_(std::unique_ptr<SchedulerItem> item) {
   if (!item)
     return;
 

esphome/core/scheduler.h

@@ -272,8 +272,10 @@ class Scheduler {
     return is_item_removed_(item) || (item->component != nullptr && item->component->is_failed());
   }
 
-  // Helper to recycle a SchedulerItem
-  void recycle_item_(std::unique_ptr<SchedulerItem> item);
+  // Helper to recycle a SchedulerItem back to the pool.
+  // IMPORTANT: Only call from main loop context! Recycling clears the callback,
+  // so calling from another thread while the callback is executing causes use-after-free.
+  void recycle_item_main_loop_(std::unique_ptr<SchedulerItem> item);
 
   // Helper to perform full cleanup when too many items are cancelled
   void full_cleanup_removed_items_();
@@ -329,7 +331,7 @@ class Scheduler {
         now = this->execute_item_(item.get(), now);
       }
       // Recycle the defer item after execution
-      this->recycle_item_(std::move(item));
+      this->recycle_item_main_loop_(std::move(item));
     }
 
     // If we've consumed all items up to the snapshot point, clean up the dead space

esphome/writer.py

@@ -1,8 +1,12 @@
+from collections.abc import Callable
 import importlib
 import logging
 import os
 from pathlib import Path
 import re
+import shutil
+import stat
+from types import TracebackType
 
 from esphome import loader
 from esphome.config import iter_component_configs, iter_components
@@ -121,7 +125,7 @@ def update_storage_json() -> None:
             )
         else:
             _LOGGER.info("Core config or version changed, cleaning build files...")
-        clean_build()
+        clean_build(clear_pio_cache=False)
     elif storage_should_update_cmake_cache(old, new):
         _LOGGER.info("Integrations changed, cleaning cmake cache...")
         clean_cmake_cache()
@@ -301,9 +305,24 @@ def clean_cmake_cache():
             pioenvs_cmake_path.unlink()
 
 
-def clean_build():
-    import shutil
+def _rmtree_error_handler(
+    func: Callable[[str], object],
+    path: str,
+    exc_info: tuple[type[BaseException], BaseException, TracebackType | None],
+) -> None:
+    """Error handler for shutil.rmtree to handle read-only files on Windows.
 
+    On Windows, git pack files and other files may be marked read-only,
+    causing shutil.rmtree to fail with "Access is denied". This handler
+    removes the read-only flag and retries the deletion.
+    """
+    if os.access(path, os.W_OK):
+        raise exc_info[1].with_traceback(exc_info[2])
+    os.chmod(path, stat.S_IWUSR | stat.S_IRUSR)
+    func(path)
+
+
+def clean_build(clear_pio_cache: bool = True):
     # Allow skipping cache cleaning for integration tests
     if os.environ.get("ESPHOME_SKIP_CLEAN_BUILD"):
         _LOGGER.warning("Skipping build cleaning (ESPHOME_SKIP_CLEAN_BUILD set)")
@@ -312,16 +331,19 @@ def clean_build():
     pioenvs = CORE.relative_pioenvs_path()
     if pioenvs.is_dir():
         _LOGGER.info("Deleting %s", pioenvs)
-        shutil.rmtree(pioenvs)
+        shutil.rmtree(pioenvs, onerror=_rmtree_error_handler)
     piolibdeps = CORE.relative_piolibdeps_path()
     if piolibdeps.is_dir():
         _LOGGER.info("Deleting %s", piolibdeps)
-        shutil.rmtree(piolibdeps)
+        shutil.rmtree(piolibdeps, onerror=_rmtree_error_handler)
     dependencies_lock = CORE.relative_build_path("dependencies.lock")
     if dependencies_lock.is_file():
         _LOGGER.info("Deleting %s", dependencies_lock)
         dependencies_lock.unlink()
 
+    if not clear_pio_cache:
+        return
+
     # Clean PlatformIO cache to resolve CMake compiler detection issues
     # This helps when toolchain paths change or get corrupted
     try:
@@ -334,12 +356,10 @@ def clean_build():
         cache_dir = Path(config.get("platformio", "cache_dir"))
         if cache_dir.is_dir():
             _LOGGER.info("Deleting PlatformIO cache %s", cache_dir)
-            shutil.rmtree(cache_dir)
+            shutil.rmtree(cache_dir, onerror=_rmtree_error_handler)
 
 
 def clean_all(configuration: list[str]):
-    import shutil
-
     data_dirs = []
     for config in configuration:
         item = Path(config)
@@ -361,7 +381,7 @@ def clean_all(configuration: list[str]):
                 if item.is_file() and not item.name.endswith(".json"):
                     item.unlink()
                 elif item.is_dir() and item.name != "storage":
-                    shutil.rmtree(item)
+                    shutil.rmtree(item, onerror=_rmtree_error_handler)
 
     # Clean PlatformIO project files
     try:
@@ -375,7 +395,7 @@ def clean_all(configuration: list[str]):
             path = Path(config.get("platformio", pio_dir))
             if path.is_dir():
                 _LOGGER.info("Deleting PlatformIO %s %s", pio_dir, path)
-                shutil.rmtree(path)
+                shutil.rmtree(path, onerror=_rmtree_error_handler)
 
 
 GITIGNORE_CONTENT = """# Gitignore settings for ESPHome

tests/unit_tests/test_writer.py

@@ -1,7 +1,9 @@
 """Test writer module functionality."""
 
 from collections.abc import Callable
+import os
 from pathlib import Path
+import stat
 from typing import Any
 from unittest.mock import MagicMock, patch
 
@@ -15,6 +17,7 @@ from esphome.writer import (
     CPP_INCLUDE_BEGIN,
     CPP_INCLUDE_END,
     GITIGNORE_CONTENT,
+    clean_all,
     clean_build,
     clean_cmake_cache,
     storage_should_clean,
@@ -1062,3 +1065,103 @@ def test_clean_all_preserves_json_files(
     # Verify logging mentions cleaning
     assert "Cleaning" in caplog.text
     assert str(build_dir) in caplog.text
+
+
+@patch("esphome.writer.CORE")
+def test_clean_build_handles_readonly_files(
+    mock_core: MagicMock,
+    tmp_path: Path,
+) -> None:
+    """Test clean_build handles read-only files (e.g., git pack files on Windows)."""
+    # Create directory structure with read-only files
+    pioenvs_dir = tmp_path / ".pioenvs"
+    pioenvs_dir.mkdir()
+    git_dir = pioenvs_dir / ".git" / "objects" / "pack"
+    git_dir.mkdir(parents=True)
+
+    # Create a read-only file (simulating git pack files on Windows)
+    readonly_file = git_dir / "pack-abc123.pack"
+    readonly_file.write_text("pack data")
+    os.chmod(readonly_file, stat.S_IRUSR)  # Read-only
+
+    # Setup mocks
+    mock_core.relative_pioenvs_path.return_value = pioenvs_dir
+    mock_core.relative_piolibdeps_path.return_value = tmp_path / ".piolibdeps"
+    mock_core.relative_build_path.return_value = tmp_path / "dependencies.lock"
+
+    # Verify file is read-only
+    assert not os.access(readonly_file, os.W_OK)
+
+    # Call the function - should not crash
+    clean_build()
+
+    # Verify directory was removed despite read-only files
+    assert not pioenvs_dir.exists()
+
+
+@patch("esphome.writer.CORE")
+def test_clean_all_handles_readonly_files(
+    mock_core: MagicMock,
+    tmp_path: Path,
+) -> None:
+    """Test clean_all handles read-only files."""
+    # Create config directory
+    config_dir = tmp_path / "config"
+    config_dir.mkdir()
+
+    build_dir = config_dir / ".esphome"
+    build_dir.mkdir()
+
+    # Create a subdirectory with read-only files
+    subdir = build_dir / "subdir"
+    subdir.mkdir()
+    readonly_file = subdir / "readonly.txt"
+    readonly_file.write_text("content")
+    os.chmod(readonly_file, stat.S_IRUSR)  # Read-only
+
+    # Verify file is read-only
+    assert not os.access(readonly_file, os.W_OK)
+
+    # Call the function - should not crash
+    clean_all([str(config_dir)])
+
+    # Verify directory was removed despite read-only files
+    assert not subdir.exists()
+    assert build_dir.exists()  # .esphome dir itself is preserved
+
+
+@patch("esphome.writer.CORE")
+def test_clean_build_reraises_for_other_errors(
+    mock_core: MagicMock,
+    tmp_path: Path,
+) -> None:
+    """Test clean_build re-raises errors that are not read-only permission issues."""
+    # Create directory structure with a read-only subdirectory
+    # This prevents file deletion and triggers the error handler
+    pioenvs_dir = tmp_path / ".pioenvs"
+    pioenvs_dir.mkdir()
+    subdir = pioenvs_dir / "subdir"
+    subdir.mkdir()
+    test_file = subdir / "test.txt"
+    test_file.write_text("content")
+
+    # Make subdir read-only so files inside can't be deleted
+    os.chmod(subdir, stat.S_IRUSR | stat.S_IXUSR)
+
+    # Setup mocks
+    mock_core.relative_pioenvs_path.return_value = pioenvs_dir
+    mock_core.relative_piolibdeps_path.return_value = tmp_path / ".piolibdeps"
+    mock_core.relative_build_path.return_value = tmp_path / "dependencies.lock"
+
+    try:
+        # Mock os.access in writer module to return True (writable)
+        # This simulates a case where the error is NOT due to read-only permissions
+        # so the error handler should re-raise instead of trying to fix permissions
+        with (
+            patch("esphome.writer.os.access", return_value=True),
+            pytest.raises(PermissionError),
+        ):
+            clean_build()
+    finally:
+        # Cleanup - restore write permission so tmp_path cleanup works
+        os.chmod(subdir, stat.S_IRWXU)