Commit 6aa6abc
Upstream merge 11.21.0 (#296)
* Remove gulp-wrap dependency and clean up package files (#14846)
* Build: remove gulp-wrap dependency to eliminate consolidate
* Build: remove gulp-wrap usage from precompilation
* pass in imp.displaymanager and img.displaymanagerver (#14857)
Co-authored-by: Shuhao <shuhao.qgg.zhang@gmail.com>
* CI: fix coveralls base comparison for PR branches (#14813)
* CI: compute coveralls base commit from merge-base
* CI: fetch full base branch history for merge-base
* CI: isolate coveralls upload to dedicated coverage run
* remove additional test run
* Fix source maps
* remove unused variable
---------
Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
* Bump fast-xml-builder from 1.1.5 to 1.2.0 (#14862)
Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.5 to 1.2.0.
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.5...v1.2.0)
---
updated-dependencies:
- dependency-name: fast-xml-builder
dependency-version: 1.2.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump fast-uri from 3.1.0 to 3.1.2 (#14864)
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2)
---
updated-dependencies:
- dependency-name: fast-uri
dependency-version: 3.1.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump @babel/plugin-transform-modules-systemjs from 7.28.5 to 7.29.4 (#14865)
Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.28.5 to 7.29.4.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs)
---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-modules-systemjs"
dependency-version: 7.29.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bliink Adapter: replace long VAST event token fixture (#14848)
* mileRtdProvider initial commit (#14636)
* mileRtdProvider initial commit
* removing the isFlooringEnforcedForAuction gate
* converted to typescript and removed the flooringEnforcedCheck inside the RTD module
* using adUnit.adserverTargeting
---------
Co-authored-by: JP Mohan <jpmohan@MacBook-Pro-9.local>
* Core Typescript types: Add bidCacheFilterFunction to types (#14869)
* Add bidCacheFilterFunction to types
* Fix linting errors
* Native Agents Bid Adapter: add new adapter (#14755)
* New adapter: Native Agents
* NativeAgents Bid Adapter: add TypeScript BidderParams type augmentation
* NativeAgents Bid Adapter: rename bider code to ntvagents
* Abtshield id system prebid (#14861)
* ABTShield User ID Adapter: add ID system
* ABT Shield ID System: add SIVT segment
* ABT Shield ID System: scope credentialed requests
* Require storage config with 1-day minimum TTL in abtshieldIdSystem
Add validation to reject missing or incomplete storage configuration and enforce a 1-day minimum for `storage.expires` to bound MCR request volume. Update TypeScript definitions to make storage fields required with documentation. Add comprehensive test coverage for validation logic.
* Bump @wdio/browserstack-service from 9.19.1 to 9.23.3 (#14871)
Bumps [@wdio/browserstack-service](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-browserstack-service) from 9.19.1 to 9.23.3.
- [Release notes](https://github.com/webdriverio/webdriverio/releases)
- [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webdriverio/webdriverio/commits/v9.23.3/packages/wdio-browserstack-service)
---
updated-dependencies:
- dependency-name: "@wdio/browserstack-service"
dependency-version: 9.23.3
dependency-type: direct:development
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fluct Bid Adapter: add ortb2Imp.ext.data and rwdd signals (#14872)
* add instl support
* falseの場合も明示的に送信するようにした
* fluct Bid Adapter: add ortb2Imp.ext.data and rwdd signals
Pass impression-level custom targeting data (ortb2Imp.ext.data) and
rewarded ad flag (ortb2Imp.rwdd) to the fluct server to improve
signal coverage and enable rewarded inventory differentiation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: yosei-ito <ca01423@cartahd.com>
Co-authored-by: himu62 <ca00732@cartahd.com>
Co-authored-by: himu <himu62@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Clear Livewrapped analytics cache when pbjs.clearAllAuctions is called (#14870)
* feat(hypelabBidAdapter): migrate to OpenRTB 2.6 endpoint (#14863)
Migrate HypeLab bid adapter from custom /v1/prebid_requests format to
OpenRTB 2.6-compliant /v1/rtb_requests endpoint using Prebid's built-in
ortbConverter. Remove legacy event reporting callbacks (onTimeout,
onSetTargeting, onBidderError); keep onBidWon to fire burl pixel.
* Currency: fix bug where conversion rates are sometimes reset to defaultRates (#14878)
* Currency: fix bug where conversion rates are sometimes reset to defaultRates
* allow for multiple settings of defaultRates
* CI: do not auto-assign reviewers on draft PRs (#14876)
* CI: do not auto-assign reviewers on draft PRs
* add ready_for_review trigger
* reinstall to pick up package.json updates (#14731)
Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
* Tercept Analytics Adapter: make auction window configurable (#14858)
* Changing auction timer to configurable with a 5 secs default value since many BID_WON events were happening after 1.5 secs.
* Use nullish coalescing for analyticsBatchTimeout so 0 is treated as an explicit immediate flush rather than falling back to the default.
* Bump terceptAnalyticsAdapter version to v2.0.0
* Add TypeScript type definitions for terceptAnalyticsAdapter init options
* Reference TerceptAnalyticsAdapterOptions type in adapter via JSDoc typedef
* Update default analytics endpoint to b-s.tercept.com and fix pubKey type to number
* Build system: combine coverage results for coveralls (#14874)
* Build system: update source maps sourceRoot
* try finagling file name
* try combining coverage results
* install lcov
* Update test.yml
---------
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* tcfControl: enforce publisher restrictions (#14856)
* tcfControl: enforce publisher restrictions
* guard against empty consentData
* Build system: add strict type check during compilation and fix several types (#14879)
* Build system: add strict type check during compilation and fix several types
* lint
* skip type check on development builds
---------
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* Prebid 11.12.0 release
* Increment version to 11.13.0-pre
* Docs: add pgamdirectBidAdapter.md (missing companion to #14763) + note GVL 1353 (#14887)
* Add pgamdirectBidAdapter.md (missing module overview + GVL 1353)
* Update TCF to v2.3 per @patmmccann review
* Clarify COPPA forwarding (per codex review)
* Fix mangled maintainer email — replace email-obfuscation placeholder with real address
* Optimera RTD Module: Add pagelevel array to window (#14789)
* added feature for window.optimera.pagelevel to be accessible
* updated spec file to include use case where pagelevel is not in score file
* fix linting error
---------
Co-authored-by: Sami <sbeig@optimera.nyc>
* Make all properties in VideoMediaType optional, as specified in the docs (#14889)
* Core: further clean up of adpod from the code base (#14890)
* Removed adpod from the code base
* Remove some more adpod occurrences from the code base
* Build system: add linting on imports (#14892)
* add import linting
* eslint --fix
* fix imports
* fix pageInfosUtils tests
* fix hadron, imu
* lint the linting update
* only try different extensions for code extensions
* New adapter: Anzu SSP (#14894)
* new adapter
* bidder code changed
* js to ts
* Update adapter: Selectmedia (#14867)
* new adapter: selectmedia
* make region param required
* define region base on timezone
* pgamdirectBidAdapter: enrich meta, usersync, telemetry hooks (#14796)
* Add pgamdirect Analytics Adapter
Companion to modules/pgamdirectBidAdapter.ts (merged #14763).
Publishers install this alongside the bid adapter to forward auction
telemetry to the PGAM Direct SSP backend.
Forwards four Prebid events, deliberately narrow:
AUCTION_END — competitor CPMs seen in the auction
BID_WON — Prebid-layer winner + price
AD_RENDER_SUCCEEDED — client-confirmed impression
AD_RENDER_FAILED — with reason (exception / timeout / etc)
The value add over a server-side-only ledger: client-confirmed render
vs. "RTB said we won", plus visibility into what other bidders priced
the same auction at (we own server-side data for our own DSP calls,
but not for the ones other SSPs made through the same Prebid wrapper).
Payload is normalised into a small fixed shape before POST — we
deliberately drop the raw Prebid event args, which carry full FPD /
user.eids / custom bidder params that we don't need and shouldn't
exfiltrate. Sink: https://app.pgammedia.com/api/analytics-events (one
POST per event; content-type text/plain to keep CORS simple).
Config:
pbjs.enableAnalytics({
provider: 'pgamdirect',
options: {
orgId: '<pgam org id>', // required
endpoint: 'https://...' // optional override
}
});
GVL ID 1353 (PGAM Media LLC, same as the bid adapter).
Tests: 12 covering registration, orgId validation, and the pure
normalise transform across all 4 forwarded event types (including
the 20-entry bidders_seen cap and filter-out of bidders with no
code). Event-emission path is not covered in this spec because the
sinon mock + AnalyticsAdapter async queue interact oddly in the
test harness — we export normalise() directly so the transform is
verifiable without the full event pipeline. The ajax call itself is
covered by upstream AnalyticsAdapter base-class tests.
* pgamdirectAnalytics: address Codex review on #14778
Two P1s flagged by Codex on the initial commit:
1. ad_unit_code semantic inconsistency
Original code pulled ad_unit_code from args.adUnitCode on BID_WON
but from args.adId on AD_RENDER_*, so the same field represented
different identifiers across event types. In auctions with multiple
ad units (or repeated wins from the same bidder), this prevented
reliable win → render reconciliation and could misattribute render
outcomes.
Fix: render events now read ad_unit_code from args.bid.adUnitCode
(stable across the BID_WON ↔ AD_RENDER_* join for the same slot).
adId moves to its own field `ad_id` so per-bid traceability is
preserved. Type definition updated with a comment explaining the
split so future contributors don't re-conflate them.
2. Missing fetch keepalive
Prebid AGENTS.md §71 requires low-priority telemetry calls to set
fetch keepalive. Without it, BID_WON + AD_RENDER_* events emitted
near page unload get dropped before reaching the endpoint — and
those are exactly the events that fire in that window.
Added `keepalive: true` to the ajax call. Prebid's ajax helper
already supports the flag (src/ajax.ts option); no adapter-side
polyfill needed.
Tests: +1 spec case covering "missing bid object on AD_RENDER_*
still captures ad_id cleanly." Existing render-event assertions
updated to verify the ad_unit_code-vs-ad_id split explicitly.
13/13 pass (was 12).
* pgamdirectBidAdapter: enrich meta, usersync, telemetry hooks
Brings the adapter in line with tier-1 bidders (PubMatic, IX, Magnite,
Insticator) and closes gaps that Kueez / Rise don't cover:
- getUserSyncs: prefer iframe, fall back to pixel; forward gdpr,
gdpr_consent, us_privacy, gpp, gpp_sid so the server-side
/rtb/v1/usersync endpoint can consent-gate the cookie correctly.
- bidResponse meta: populate advertiserDomains, primaryCatId +
secondaryCatIds, networkName / networkId (from seatbid.seat),
brandId / brandName / agencyId / buyerId / demandSource (reads
both snake_case and camelCase from bid.ext.meta), and pass
through ORTB 2.6 dsa + dchain blocks. Downstream ad servers
(AdX, Amazon Publisher Services) reject bids without
advertiserDomains, so this directly lifts fill.
- imp hook: set imp.displaymanager = 'Prebid.js' and
imp.displaymanagerver = $prebid.version$ on every imp. Some DSPs
shape bids on these fields; matches pubmatic/conversant/oms
convention.
- onBidWon: fire a win pixel from bid.ext.pgam.winurl (or bid.nurl
as fallback), with ${AUCTION_PRICE} / ${AUCTION_ID} macro
replacement. Swallows errors so a bad URL can't break the page.
- onTimeout: fire a pixel to /rtb/v1/metrics/timeout with tmax +
auction so publisher-side tmax misses show up on our Grafana.
Spec adds 6 new describe blocks (getUserSyncs, bidResponse meta
enrichment, imp displaymanager, onBidWon, onTimeout). 42/42 green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* pgamdirect: Phase 3 hooks (billable/render/PAAPI) + Codex P1 fix
Codex review on commit ed8f408 flagged one P1 against the analytics
adapter; addressed alongside three adapter enhancements that close
the remaining hook gap vs tier-1 bidders (APS, Yandex, Vidazoo).
Analytics:
- normalise(BID_WON) now emits ad_id (Prebid's per-bid adId). Prior
revision only had it on AD_RENDER_*; on refresh-heavy pages
multiple wins share the same ad_unit_code so reconciliation by
slot name alone is ambiguous. Addresses Codex P1 review.
Bid adapter:
- onBidBillable — fire pixel to /rtb/v1/metrics/billable with
cpm / auction / adid when Prebid counts the bid as billable.
Billable ≠ bid-won (ad-server can still swap in house ads); keeping
the counters separate is how APS / Yandex / Vidazoo report fill.
- onAdRenderSucceeded — fire pixel to /rtb/v1/metrics/render with
adid / auction so we can subtract render failures (captured on
the analytics side via EVENTS.AD_RENDER_FAILED) from inventory
KPIs and flag misbehaving creatives to blocklist.
- interpretResponse PAAPI passthrough — when the bidder returns
response.ext.paapi, surface it as { bids, paapi } so the Chrome
Privacy Sandbox / Protected Audience API flow works when the
publisher enables it in wrapper config. Accepts both bidId and
impid as the correlation key; filters entries with no config.
Tests:
- pgamdirectBidAdapter_spec.js: +11 tests. onBidWon / onTimeout now
stub triggerPixel to assert on URL + macro replacement (the old
tests only asserted no-throw, leaving some branches uncovered).
New describe blocks for onBidBillable, onAdRenderSucceeded, and
PAAPI passthrough. 53/53 green.
- pgamdirectAnalyticsAdapter_spec.js: BID_WON test asserts ad_id
carries through (verifies the Codex P1 fix).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* pgamdirect: low-priority telemetry via fetch + keepalive (Codex P1)
Codex review on 4b56ccf flagged that onBidBillable + onAdRenderSucceeded
used triggerPixel, violating AGENTS.md §Review guidelines:
"Low priority calls should be import ajax method and use fetch
keepalive; they shouldn't use trigger pixel when it can be avoided
or fail to specify keepalive."
The practical cost: pixel requests are first-to-drop on navigation /
unload — which is exactly when billable + render telemetry fires.
Dropped events undercount the KPIs this change is trying to fix, so
the reviewer is right.
- Add sendBeacon() helper: fetch(url, { method: 'GET', keepalive: true })
with a catch-all that swallows errors. Pattern matches kargo
sendTimeoutData + amx onTimeout + startioBidAdapter.
- Swap triggerPixel → sendBeacon on onTimeout, onBidBillable, and
onAdRenderSucceeded (the three hooks that fire our own metrics).
- Keep triggerPixel on onBidWon — that call targets the DSP's nurl /
winurl from the bid response, which is an OpenRTB-contract ImageBeacon
and DSPs expect pixel semantics there. Not our telemetry, not ours
to change to fetch.
- Spec tests updated to stub window.fetch instead of utils.triggerPixel
for the three hooks, and to assert keepalive=true on the init arg.
53/53 green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* pgamdirectAnalytics: Phase 4.2 — runner-up POST on AUCTION_END
Paired change to the bidder-edge's new /rtb/v1/shading/record
ingestion endpoint. When an AUCTION_END payload carries a pgamdirect
winner AND at least one competitor bid on the same adUnit, we POST
the competitor's highest CPM (the runner-up) plus the cell signature
from bid.ext.pgam.shade to the bidder-edge.
The backing Store learns per-cell runner-up distributions so a future
Part B activation can shade our outbound bid down toward the
runner-up + headroom, capturing the margin delta between "what our
DSP bid into us" and "what we needed to bid into Prebid to win."
Implementation:
- maybePostShading() exported for testability. Groups bidsReceived
by adUnitCode, identifies pgam winners per-adUnit (multi-imp
safe), computes runner-up as max non-pgam CPM on that adUnit.
- Skips when: <2 bids, no pgam winner, no ext.pgam.shade
(bidder-edge didn't populate it), or runner-up is 0 (one-bidder
auction — no signal for us).
- Uses ajax() with text/plain content-type (CORS-simple, no
preflight) and keepalive:true per AGENTS.md.
- Wrapped in try/catch — a malformed AUCTION_END payload can't
take down the main analytics POST that runs alongside it.
Spec: 7 new tests covering the happy path, multi-adUnit split,
missing-winner skip, missing-shade skip, one-bidder skip, and
malformed-input tolerance. 19/19 green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* pgamdirect: drop duplicate getUserSyncs; apply prior commit's missed renames
Two getUserSyncs definitions in the bid adapter spec object — the
ext.cookies reader silently shadowed the consent-passthrough version.
Removed the dead one and its test block; kept the version that matches
our PBS yaml and /rtb/v1/usersync endpoint.
Also applying the SHADING_ENDPOINT -> AUCTION_CONTEXT_ENDPOINT (and
related) renames the prior commit's message described but didn't
actually ship — those edits were made in the working tree before
the upstream merge but got overwritten during conflict resolution
when upstream's version of the analytics file was checked out.
Comment trim pass while in there.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* CriteoId: Add typescript types through a .d.ts file (#14902)
* Add typing for criteo id system
* Improved the typings a bit further
* Changed criteo to criteoId in the UserId and ProvidersToId interfaces
* Adelerate Bid Adapter: initial release (#14854)
Co-authored-by: Djole <djole@Djole.local>
* Attekmi: rename Adinify to Adlywise (#14910)
Co-authored-by: Victor <victor.banudz@smart-hub.io>
* Core: export more types (#14915)
* export more types
* fix comment
* debugging module: Added type definitions (#14911)
* Added type definitions for the debugging module
* Make intercept property optional
* Allow null to drop a bid
* Movingup Bid Adapter: add standalone adapter, drop nexx360 alias (#14855)
Promotes movingup from a nexx360 alias to its own bidder modeled on
mtcBidAdapter, with dedicated endpoint, storage namespace, spec, and docs.
Co-authored-by: Gabriel Chicoye <gabriel@macbookrogab24g.lan>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* New adapter: haloads (#14901)
* haloads initial addition
* review comments
* resolved content type comments and build error
* updated nurl handler
* mileAdapter revert
---------
Co-authored-by: Ritesh Ghodrao <riteshghodrao@Riteshs-MacBook-Air.local>
* Prebid 11.13.0 release
* Increment version to 11.14.0-pre
* Core: remove promise param lint exception in auctionmanager spec (#14735)
* add new integer-valued keys to mobian rtd module (#14917)
* Core: release polite user syncing option (#14802)
* Core: add politeTriggerPixel coverage
* Core: schedule polite pixel triggers in background
* Core: gate polite user sync transport methods
* Core: use requestIdleCallback fallback for polite iframe sync
* Core: extract background scheduler helper for polite syncs (#14898)
* Core: move polite sync helpers to utils (#14899)
* Core: add missing auctionDebug type definition (#14928)
* break out logging utilities
* add auctionDebug event type definition
* DebugEvent is a better name than LogEvent
* guard against null eventEmitter
* id5IdSystem: Add TypeScript declarations and tighten type imports (#14908)
* ID5 ID Module: add dedicated type definitions file
* ID5 ID Module: fix userId augmentation keys
* Add doc comments and fix capitalization
---------
Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
* Build system: enforce consistent naming of .d.ts files (#14932)
* Build system: enforce consistent names for .d.ts files
* do not compile .d.ts files
* update jsdoc imports
* Update filename.js
---------
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* APS Adapter: type public config interface (#14918)
* APS Adapter: type public config interface
* Rename apsBidAdapterTypes.d.ts to apsBidAdapter.d.ts
* Update ApsAdapterConfig type import path
---------
Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
* Pubmatic Adapter: re-enable RTD custom targeting test (#14725)
* lotame panorama, identitylink, and teads id systems: type the public interface (#14905)
* User ID: import typed provider names for lotame, identitylink, and teads
* Core: fix provider param typing for identityLink lotame teads
* Change clientId to required string in ProviderParams
* LiveIntent/Hadron/PairID/33AcrossId: add typescript types for id providers (#14934)
* Added typings for liveIntentId
* Added typings for HadronIdSystem
* Added typings for pairIdSystem
* Added typings for 33acrossIdSystem
* Switch to the correct properties in LiveIntent tests
* Added missing jsdoc
* Core: fix bug with accessRequestCredentials not controlling access to request credentials (#14927)
* Core: fix bug with accessRequestCredentials not controlling access to request credentials
* keep shallow copying in abtshieldIdSystem
* remove unused function
* lint
* Fix firefox losing keepalive flag
* Use module name in bidder's ajax
* Hubvisor Bid Adapter: initial release (#14754)
* Hubvisor Bid Adapter: initial release
Adds a new bid adapter for Hubvisor (GVL ID 1112).
* Hubvisor Bid Adapter: address review comments
- Fix site.publisher being overwritten with undefined when req.publisher is absent (only copy when present)
- Fix getUserSyncs assuming sync response is always at index 0 with exactly 2 responses; now identifies sync response by its shape (presence of bidders array), which handles out-of-order arrival and partial failures
---------
Co-authored-by: Vincent Barach <vincent@hubvisor.io>
* Bump qs, express and body-parser (#14938)
Bumps [qs](https://github.com/ljharb/qs) to 6.15.2 and updates ancestor dependencies [qs](https://github.com/ljharb/qs), [express](https://github.com/expressjs/express) and [body-parser](https://github.com/expressjs/body-parser). These dependencies need to be updated together.
Updates `qs` from 6.14.2 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/qs/compare/v6.14.2...v6.15.2)
Updates `express` from 4.22.1 to 4.22.2
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md)
- [Commits](https://github.com/expressjs/express/compare/v4.22.1...v4.22.2)
Updates `body-parser` from 1.20.4 to 1.20.5
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.5/HISTORY.md)
- [Commits](https://github.com/expressjs/body-parser/compare/1.20.4...1.20.5)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
- dependency-name: express
dependency-version: 4.22.2
dependency-type: direct:production
- dependency-name: body-parser
dependency-version: 1.20.5
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* Onetag Bid Adapter: fix inverted dealId condition in interpretResponse (#14937)
* fix(onetagBidAdapter): correct inverted dealId condition in interpretResponse
* chore: bump onetag adapter version to 1.1.7
---------
Co-authored-by: Diego Tomba <d.tomba@onetag.com>
* Core: pre-set GPT targeting on auction init (#14827)
* Build System: remove gulp-sourcemaps dependency
* Build System: preserve bundle sourcemaps through header/footer injection
* fix warning on creative renderers source map
* add test for no-bid targeting
* Core: pre-set partial targeting on auction init
* lint
---------
Co-authored-by: Patrick McCann <pmccann@cafemedia.com>
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* Yahoo Bid Adapter: upgrade to OpenRTB 2.6 (#14435)
* Yahoo Bid Adapter: upgrade to OpenRTB 2.6
Upgrades the Yahoo Ads bid adapter from OpenRTB 2.5 to OpenRTB 2.6 protocol.
Core OpenRTB 2.6 Compliance Changes:
- Restructure regs object: move gdpr/gpp/gpp_sid from ext to top-level (yahooAdsBidAdapter.js:282-289)
- Restructure user object: move consent/eids from ext to top-level (yahooAdsBidAdapter.js:302-307)
- Restructure source object: move schain from ext to top-level (yahooAdsBidAdapter.js:337-341)
- Add fallback pattern to support both 2.5 and 2.6 field locations
- Update request options to use text/plain content type (yahooAdsBidAdapter.js:599-601)
Additional OpenRTB 2.6 Fields:
- Add cattax and wlangb top-level request fields (yahooAdsBidAdapter.js:271-272)
- Add device.sua for User-Agent Client Hints (yahooAdsBidAdapter.js:281)
- Add video pod fields: podid, podseq, maxseq, poddur, slotinpod, mincpmpersec (yahooAdsBidAdapter.js:383-395)
- Move imp.data from ext to top-level with fallback (yahooAdsBidAdapter.js:407-410)
- Add site.inventorypartnerdomain support (yahooAdsBidAdapter.js:439)
- Add user.kwarray support (yahooAdsBidAdapter.js:498)
- Transform content.network and content.channel from strings to objects (yahooAdsBidAdapter.js:463-485)
Test Updates:
- Update 8 existing tests to expect 2.6 structure
- Add 5 new OpenRTB 2.6 compliance tests
- Total: 229/229 tests passing
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* Yahoo Bid Adapter: update documentation for OpenRTB 2.6
Add documentation for OpenRTB 2.6 features:
- Video pod support (podid, podseq, maxseq, poddur, slotinpod, mincpmpersec)
- Category taxonomy (cattax)
- Blocked languages (wlangb)
- User-Agent Client Hints (device.sua)
- Enhanced content metadata (network/channel as objects)
- Inventory partner domain
- User keyword arrays (kwarray)
- Global Privacy Platform (GPP)
Updated feature list and added configuration examples.
Fixed test expectation for user.eids (removed duplicate ext.eids check).
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* added all 2.6 params and tests
* fix the tests
* fix the gap for fallback
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* Adkernel Bid Adapter: add ReLoad alias (#14921)
* Adform Bid Adapter: Use ortb converter (#14923)
* adf adapter migrated to openrtb converter
* unit tests updated
* rewrite adf adapter to typescript
* file naming
* keep single file
* Bump protobufjs from 7.5.7 to 7.6.1 (#14940)
Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 7.5.7 to 7.6.1.
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.1/CHANGELOG.md)
- [Commits](https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.7...protobufjs-v7.6.1)
---
updated-dependencies:
- dependency-name: protobufjs
dependency-version: 7.6.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* Bump ws, engine.io and socket.io-adapter (#14939)
Bumps [ws](https://github.com/websockets/ws), [engine.io](https://github.com/socketio/socket.io) and [socket.io-adapter](https://github.com/socketio/socket.io). These dependencies needed to be updated together.
Updates `ws` from 8.18.3 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.18.3...8.21.0)
Updates `ws` from 8.17.1 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.18.3...8.21.0)
Updates `engine.io` from 6.6.2 to 6.6.8
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.8)
Updates `socket.io-adapter` from 2.5.5 to 2.5.7
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io-adapter@2.5.5...socket.io-adapter@2.5.7)
---
updated-dependencies:
- dependency-name: ws
dependency-version: 8.21.0
dependency-type: indirect
- dependency-name: ws
dependency-version: 8.20.1
dependency-type: indirect
- dependency-name: engine.io
dependency-version: 6.6.8
dependency-type: indirect
- dependency-name: socket.io-adapter
dependency-version: 2.5.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* LiveIntentId: added fireEventDelay to the typings (#14944)
* CI: move Safari testing to browserstack (#14946)
* move Safari latest to browserstack
* try quotes
* move filtering into matrix
* typo
* fix outputs
* more fixes
* Core: Safe renderer (#14756)
* introducing custom renderer
* comments
* example adjustments
* clear ctx object
* removing script string
* renaming to safe-frame renderer
* renaming to frame renderer
* moving condition layer higher
* adding frameRendererUrl to adUnit
* fix
* translation
* dir renaming
* renderer refactor
* short circuit for video bids prevention
* unit tests
* renaming to safe renderer
* safe renderer on ad unit and media types
* null safety
* fixing test
* allowTopWindowRenderers flag
* lint
* Renaming
* lint
* docs comments
* getBidRequest optimization
* prepareRenderingData
* updating reference script
* new test cases
* Core & multiple modules: do not run userId when CMP is expected and not found; rerun userId hook on consent changes (#14886)
* refactor consentHandler
* add error condition to consentHandler
* cancel userId lookup on missing CMP
* add onChange to consentHandler
* Refresh userId on consent change
* lint
* gppControl: fix missing transmitEids activity check (#14947)
* Core: exclude Chromium from Safari browser detection (#14804)
* Matterfull Bid Adapter: initial release (#14922)
* Matterfull Bid Adapter: initial release
* Matterfull Bid Adapter: fix endpoint
* Matterfull Bid Adapter: make params.env field required
* AnzuDSP Bid Adapter: initial release (#14924)
* AnzuDSP Bid Adapter: initial release
* AnzuDSP Bid Adapter: make params.env field required
* Bliink: Remove GVL_ID from bliinkBidAdapter.js (#14949)
* Remove GVL_ID from bliinkBidAdapter.js
* Delete gvlid exposure test from bliinkBidAdapter_spec
Removed test case for exposing gvlid.
* RhythmOne Adapter: remove lint exception for size parsing (#14765)
* RhythmOne Adapter: remove lint exception for size parsing
* Marsmedia Bid Adapter: remove coffee-style lint suppression (#14771)
* Core: fix typos in reducers comments (#14768)
* Marsmedia Bid Adapter: remove coffee-style lint suppression
* Update marsmediaBidAdapter.js
* Prebid 11.14.0 release
* Increment version to 11.15.0-pre
* Bump tmp from 0.2.4 to 0.2.6 (#14953)
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.4 to 0.2.6.
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/raszi/node-tmp/compare/v0.2.4...v0.2.6)
---
updated-dependencies:
- dependency-name: tmp
dependency-version: 0.2.6
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* SSPF-3301: Kargo Adapter: use gppString for GPP consent (fix Prebid API) (#65) (#14954)
* Kargo Adapter: use gppString for GPP consent (fix Prebid API)
* remove comment
Co-authored-by: Julian Gan <juliangan07@gmail.com>
* Core: complete enforcement of accessRequestCredentials (#14935)
* Core: fix bug with accessRequestCredentials not controlling access to request credentials
* keep shallow copying in abtshieldIdSystem
* remove unused function
* lint
* Fix firefox losing keepalive flag
* Use module name in bidder's ajax
* add withCallers plumbing
* Build-time determination of moduleType/moduleName
* fix undetermined callers
* fix undetermined callers
* fix multi-gvlid that are not asking for credentials
* fix adapterManager tests
* fix adelerate tests
* fix asterio tests
* chunk 3 test fixes
* chunk 4 test fixes
* chunk 4 test fixes
* Chunk 5 test fixes
* chunk 6 fixes
* chunk 7 test fixes
* chunk 8 test fixes
* remove redundant hasDeviceAccess check
* lint
* Potential fix for pull request finding 'Semicolon insertion'
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* Potential fix for pull request finding 'Semicolon insertion'
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* Potential fix for pull request finding 'Semicolon insertion'
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* Improve comments
---------
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* Core: fix bug where hb_cache_host is sometimes not set to the right host (#14806)
* TNE Catalyst Bid Adapter: optional params + ortb2 passthrough (#14941)
Combines the AMX-style permissive-params refactor with full ortb2.*
passthrough so the adapter integrates with a single
'{ bidder: tne_catalyst }' entry while honouring everything the
wrapper already populates.
Permissive params (AMX-style)
- All bid params optional. isBidRequestValid accepts a bid with no
params; rejects bids with wrong-typed values via a nullOrType helper.
- slot defaults to bid.adUnitCode and is mirrored into imp.tagid.
- site.publisher.id omitted when no override; exchange resolves
publisher from site.domain via sellers.json.
- New optional params.endpoint and params.testMode (the latter is
resolved per-imp so individual placements can be marked as test).
ortb2 passthrough
- ortb2.user / regs / device / app flow through to the outbound.
- bid.userIdAsEids still read and merged with ortb2.user.eids
(de-duped by source).
- Per the module rules, wrapper-set fields are authoritative;
derived signals (gdprConsent, uspConsent, gppConsent) only fill
gaps the wrapper hasn't already populated.
site / app mutex
- OpenRTB 2.6 §3.2.1: site and app are mutually exclusive. When
ortb2.app is present, site is omitted entirely; publisherId stamps
onto app.publisher.id. Site is also omitted when no site fields
would be populated.
schain
- Read from ortb2.source.ext.schain (Prebid 9.x normalized location)
with fallback to ortb2.source.schain (OpenRTB 2.6 top-level) and
finally legacy bid.schain for older wrapper builds. Outbound goes
on source.schain so modern adapters don't need to ext-fish.
101 tests passing.
Co-authored-by: thenexusengine <250033251+thenexusengine@users.noreply.github.com>
* Core: migrate from deprecated GPT getTargeting/setTargeting to getConfig/setConfig (#14816)
* Core: migrate from deprecated GPT getTargeting/setTargeting to getConfig/setConfig
* use gptUtils/setKeyValue instead of setPageTargeting when possible; fix incorrect test setup
* update types
* lint
* Add methods to fetch entire targeting map
* Update relaido to use getTargetingMap methods
* update relaido to use getTargetingMap methods
* Update src/utils/gptTargeting.ts
Co-authored-by: derdeka <derdeka@users.noreply.github.com>
* update mock data to use arrays
---------
Co-authored-by: derdeka <derdeka@users.noreply.github.com>
* Removed alias from appnexus and add it to microsoft adapter (#14965)
Co-authored-by: Andy <arezitopedia@gmail.com>
* 51Degrees RTD: enrich ORTB with IP/geo, 51DiD eids, preference/TCF/GPP consent forwarding (#14914)
* 51Degrees RTD: enrich ORTB with IP/geo, 51DiD eids, and PMP-aware id.usage
Adds device.ip/ipv6/geo from the cloud ip vendor, a 51d.es user.eids entry from fodid, and id.usage forwarding sourced from module params or PMP localStorage.
* configure PMP in the example
* proper casing
* improve example with debug bids
* set device.geo.region
* reload PMP button
* correct shape of user.eids[].uids
* guard publisher set device.ip
* warn on legacy ext.fiftyonedegrees_deviceId write
The module writes the 51Degrees device id to both
ortb2.device.ext.fod.deviceId (canonical) and
ortb2.device.ext.fiftyonedegrees_deviceId (legacy mirror kept for
adapters that read the older path, e.g. gumgumBidAdapter).
Emit a one-shot logWarn the first time the legacy mirror is written
so adapter authors can spot the duplication and migrate. Output is
unchanged.
* populate geo if locationconfidence is high/medium
also set correct ipservice value
* 51Degrees RTD: forward TCF/GPP consent strings to the cloud as evidence
* update doc
* update doc and remove params.idUsage
* update configurator link
* fix lint errors
* migrate consumers to ext.fod.deviceId
(formerly fiftyonedegrees_deviceId)
---------
Co-authored-by: YaroslavVlasenko <yaroslavvlasenko@gmail.com>
Co-authored-by: James Rosewell <james@51degrees.com>
* Acxiom's realid userID prebid module (GCD-559) (#14948)
* Add Acxiom Real ID Submodule to User ID system
* Update Acxiom Real ID Submodule to use POST requests with JSON payload and simplify API URL handling
* Simplify Acxiom Real ID Submodule by removing unused log prefix and redundant logInfo calls
* Update Acxiom Real ID API endpoint
* Refactor Acxiom Real ID Submodule to handle stored IDs and improve decode logic
* Expand Acxiom Real ID Submodule to enforce consent-based suppression and add GPP (US privacy) handling
* Update Acxiom Real ID to delete tokens with all suffixes for better consent compliance
* Update Acxiom Real ID to handle userAgent retrieval using `getWindowSelf` for improved compatibility
* Add detailed typedefs for Acxiom Real ID configuration and parameters
* Migrate Acxiom Real ID Submodule to TypeScript for improved type safety and module clarity
---------
Co-authored-by: Rameez Israr <rameez@govassist.com>
* Ogury Bid Adapter: add instream video support (#14962)
* Vidazoo utils: Additional validation for request (#14952)
* adding devicetype value validation to prevent errors from request in bidder
* make a deep clone in order to validate value without changing device info in the initial object
---------
Co-authored-by: Anna Yablonsky <annay+perion@perion.com>
* Adnow & DistroScale Adapters: remove deleted GVL IDs (#14966)
### Motivation
- The IAB vendor list marks GVL IDs `1210` and `754` as deleted, so adapters must not advertise those vendor IDs.
- Keep adapter runtime behavior unchanged while preventing Prebid from registering deleted TCF vendors.
- Ensure module metadata and per-module disclosure entries no longer reference deleted vendor IDs or disclosure URLs.
### Description
- Remove the `GVLID` constants and the `gvlid` fields from `modules/adnowBidAdapter.js` and `modules/distroscaleBidAdapter.js` so adapters no longer expose `1210` or `754`.
- Update generated metadata files `metadata/modules.json`, `metadata/modules/adnowBidAdapter.json`, and `metadata/modules/distroscaleBidAdapter.json` to set the corresponding `gvlid` values to `null` and clear `disclosures`/`disclosureURL` entries.
- Preserve the `ds` alias for DistroScale and leave all other adapter behaviour and supported media types unchanged.
### Testing
- Ran `npx eslint modules/adnowBidAdapter.js modules/distroscaleBidAdapter.js --cache --cache-strategy content` and it completed successfully.
- Ran the adapter unit tests with `npx gulp test --nolint --file test/spec/modules/adnowBidAdapter_spec.js` and `npx gulp test --nolint --file test/spec/modules/distroscaleBidAdapter_spec.js` and both test runs passed.
- Performed metadata validation and JSON parse checks (build-time GVL/metadata checks) and they passed without errors.
* 🐛 Criteo Id System: store raw bidId values (#14973)
Co-authored-by: v.raybaud <v.raybaud@criteo.com>
* Core: add deprecated GPT targeting CodeQL check (#14967)
* UnifiedId Adapter: add typed userId mappings (#14904)
* UnifiedId Adapter: add typed userId mappings
* UnifiedId Adapter: align tdid typing with runtime shapes
* UnifiedId Adapter: require partner or url in types (#14961)
---------
Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
* Goldbach Bid Adapter: server-driven syncs and identity rework (#14925)
* Goldbach Bid Adapter: Endpoint adjustment, server-side cookie sync
* Goldbach Bid Adapter: adjusted consent check, player size tuple check
* New Adapter: ferio (#14896)
* Add ferio bid adapter
* fix: isolate fallback response media type, include types
* refactor: convert adapter and utilities to ts
* refactor: rely on ORTB converter for request signals
---------
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* fluct Bid Adapter: add device.ext.vpw/vph viewport size signals (#14957)
* add instl support
* falseの場合も明示的に送信するようにした
* fluct Bid Adapter: allow wrapper to inject its name via x-fluct-prebid-wrapper header
Read `fluct.wrapperName` from Prebid config and, when set, attach it as the
`x-fluct-prebid-wrapper` HTTP header on every bid request so the fluct bidder
can identify which wrapper the request originates from.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: move customHeaders construction outside _each loop
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: add device.ext.vpw/vph viewport size signals
Pass viewport dimensions (vpw, vph) from ortb2.device.ext to the
fluct server. Viewability prediction by DSPs uses viewport size to
differentiate between screen size (w/h) and actual visible area,
which directly affects bid prices.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: yosei-ito <ca01423@cartahd.com>
Co-authored-by: himu62 <ca00732@cartahd.com>
Co-authored-by: himu <himu62@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* Core: Avoid keepalive for >64KiB request bodies and log warning (#14916)
* Core: warn when keepalive is skipped for oversized payload
* Potential fix for pull request finding 'Unused variable, import, function or class'
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* use blob() to calculate size
* Potential fix for pull request finding 'Semicolon insertion'
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* lint
* Fix firefox losing keepalive, not supporting body
* Safari fix
* update comment
---------
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
* ResetDigital Bid Adapter: Forward user EIDs (#14975)
* ResetDigital: Forward user EIDs
* ResetDigital: Aggregate user EIDs
* ResetDigital: Simplify EID forwarding
* acxiomRtd: fix tests (#14974)
* feat: add hubvisor analytics adapter (#14976)
* Bump actions/github-script from 8 to 9 (#14980)
Bumps [actions/github-script](https://github.com/actions/github-script) from 8 to 9.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v8...v9)
---
updated-dependencies:
- dependency-name: actions/github-script
dependency-version: '9'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Aps Bid Adapter: map bidder metadata (#14977)
* Core: bidDesirabilityAdjustment (#14860)
* adding bidderDesirabilityAdjusments to bidderSettings
* adding bid desirability sort to bidLimit path
* adding bid desirability to reducers
* sharing bidRequest between cpm and desirability adjustments
* sortByDealAndPriceBucketOrDesirability
* fixing multibid & removing bidRequest fallback
---------
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* fluct Bid Adapter: add remaining missing bid request signals (#14958)
* add instl support
* falseの場合も明示的に送信するようにした
* fluct Bid Adapter: allow wrapper to inject its name via x-fluct-prebid-wrapper header
Read `fluct.wrapperName` from Prebid config and, when set, attach it as the
`x-fluct-prebid-wrapper` HTTP header on every bid request so the fluct bidder
can identify which wrapper the request originates from.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: move customHeaders construction outside _each loop
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: add remaining missing bid request signals
Forward all outstanding signals from Prebid.js to the fluct server:
Regulation/privacy:
- regs.ext.dsa (Digital Services Act) — EU DSPs skip bids without it
- regs.ext.gpc (Global Privacy Control)
User attributes:
- user.yob, user.gender, user.keywords — demographic/interest targeting
- user.ext.data (all fields, not just im_segments)
Site metadata:
- site.name, site.search, site.publisher.domain
Auction context:
- refererInfo.canonicalUrl — more reliable than raw page URL
- refererInfo.isAmp, reachedTop, numIframes — page environment signals
- timeout — lets fluct server optimize response time
- source.tid — auction-level transaction ID
Floor model metadata:
- floorData.modelVersion, location, floorProvider
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: fix guard inconsistencies found in code review
- yob: use != null guard (consistent with gender)
- numIframes: use != null guard so top-level pages (numIframes=0) are forwarded
- site.publisher: gate on publisher object existence instead of domain,
and forward id in addition to domain
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: remove floorData metadata fields
Floor model metadata (modelVersion, location, floorProvider) has unclear
server-side use. Removing to keep the PR focused; floor price itself
(bidfloor/bidfloorcur) is already forwarded by existing code.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: fix duplicate instl assignment after rebase
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: remove extra blank line (lint fix)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: fix padded-blocks lint error in spec
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fluct Bid Adapter: remove CORS preflight by switching to text/plain
Replace custom request headers with body fields to eliminate the ~400ms
OPTIONS preflight on every bid request:
- Remove Content-Type: application/json and custom headers
(x-fluct-app, x-fluct-version, x-openrtb-version, x-fluct-prebid-wrapper)
- Move adapter metadata to request body:
- adapterVersion (was x-fluct-version)
- wrapperName (was x-fluct-prebid-wrapper, set only when configured)
- Default content type becomes text/plain (Prebid ajax default),
which is a CORS simple request and requires no preflight
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Revert "fluct Bid Adapter: remove CORS preflight by switching to text/plain"
This reverts commit 5c129058b1dfab4ab9fcb69aa376b474f96420df.
---------
Co-authored-by: yosei-ito <ca01423@cartahd.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Asterio Bid Adapter: Add native support (#14929)
* Zeta Global Analytics Adapter: extra events (#14964)
* Zeta Global SSP Analytics Adapter: track extra events
* Zeta Global SSP Analytics Adapter: harden payload helpers and fallbacks
Extract shared site-context, floor, mediaType, and device helpers so analytics
events send complete fields (including auctionId on bidsReceived) with robust
page/domain fallbacks and bounded bidder error payloads.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Zeta SSP Analytics Adapter: code style fixes.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* tcfControl: use the GVL to determine legal basis (#14979)
* fetch purposes during build
* Update metadata
* include purpose metadata in adapters
* add warning on bidders without p2 LI
* add --no-fetch option to compile-metadata
* add warning on undeclared flexible purposes
* getPublicUrl
* Update metadata
* cleanup
* Better purpose declaration warnings
* do not double include purpose metadata
* update metadata including specialFeatures
* add build time validation
* update tcfControl to check purpose declarations
* lint
* do not use intersection/difference
* New Adapter: Vuukle Bid Adapter (banner, video, native) (#14981)
* Build: remove unused @wdio/concise-reporter dev dependency (#14956)
* IntentIq ID Module & Analytical Adapter: A/B percentage passing, CMP consent improvements (#14936)
* AGT-817 Group change for module (#70)
Co-authored-by: Alex <alex@MacBook-Pro-Alex.local>
* AGT-843 Module documentation (#71)
Co-authored-by: Alex <alex@MacBook-Pro-Alex.local>
* AGT-751 AB% passing
* Merge master into 0.36 (#75)
* Remove gvlid from movingup bid adapter (#14749)
* billow_rtb25: New adapter (#14690)
* New adapter: billow_rtb25
* delete options
* add public interface
* Change the adapter type to a ts file
---------
Co-authored-by: zepeng.yin <zp.yin@foxmail.com>
* Prebid 11.7.0 release
* Increment version to 11.8.0-pre
* Showheroes Bid Adapter: rename showheroes bid adapter (#14644)
* rename showheroes bid adapter
* Showheroes: bring back old adapter
* Impactify Bid Adapter: ensure compatible mediaType mapping (#14748)
* Updated bid adapter to log errors
* Remove onBidderError function and LOGGER_JS_URI
Removed unused onBidderError function and LOGGER_JS_URI constant.
* Apply suggestion from @Copilot
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Fix mediatypes
* Add banner test
* Add mediaType fallbacks
---------
Co-authored-by: Filipe Neves <me@filipeneves.net>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* CriteoBidAdapter: Fix outstream video (#14753)
* Update: Adding Device hardware version (hwv) in the adapter (#14757)
* wurfl rtd: collect SUA via src/fpd/sua.js for high-entropy hints (#14758)
Switch the SUA source from the bid request to direct calls to
getHighEntropySUA from src/fpd/sua.js. This ensures wurfl.js and the
analytics beacon receive high-entropy User-Agent Client Hints. Falls
back to low-entropy SUA when high-entropy is unavailable (non-Chromium
browsers, restrictive Permissions Policy).
Refs prebid/Prebid.js#14574
* Msft Bid Adapter - Native request example in md updated to include eventtrackers (#14760)
* Update msftBidAdapter.md
* Minor update to the keyword format
* Minor update to the keyword format
* Update msftBidAdapter.md
---------
Co-authored-by: Jason Crane <jasoncrane@microsoft.com>
* Intenze Adapter: Europe support (#14658)
* Intenze Adapter: Europe support
* fix lint problem in intenzeBidAdapter.js
* Bid Filter Module: Add option for bidResponseFilter handling for in-banner video on multi-format (#14542)
* Add option for bidResponseFilter handling for in-banner video on multi-format
* Format code for consistency in bidResponseFilter_spec.js
---------
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
Co-authored-by: Patrick McCann <pmccann@cafemedia.com>
* Core: fix typos in reducers comments (#14768)
* IntimateMerger Analytics Adapter : initial release (#14726)
* IntimateMerger Analytics Adapter : initial release
* IntimateMerger Analytics Adapter : fix event overlap
* IntimateMerger Analytics Adapter : refactoring
* IntimateMerger Analytics Adapter : Update modules/imAnalyticsAdapter.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* IntimateMerger Analytics Adapter : Update waitTimeout
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* IntimateMerger Analytics Adapter : Update modules/imAnalyticsAdapter.js docs
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* IntimateMerger Analytics Adapter : Update docs
* IntimateMerger Analytics Adapter : cid optional
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Adquery Bid Adapter: userID usage refactor (#14692)
* adquery_video_work9
* adquery_video_work9
* adquery_video_work9
* update onBidWon
---------
Co-authored-by: Adrian Dzida <a.dzida@openmobi.pl>
* New Bidder: PGAM Direct (#14763)
* Add PGAM Direct bid adapter
New SSP bidder (server-to-server, canonical OpenRTB 2.6) operated by
PGAM Media LLC. Distinct from pgamssp (our legacy TeqBlaze-hosted
adapter); we plan to migrate publishers from pgamssp to pgamdirect
over 2026 and will submit a deprecation PR for pgamssp once migration
completes. Both are actively maintained.
GVL ID: 1353
Endpoint: https://rtb.pgammedia.com/rtb/v1/auction
Media types: banner, video, native
Supports: schain, TCF v2, USP, GPP, COPPA, EIDs, GPID, floors module,
deals, first-party data
37 spec cases covering isBidRequestValid, buildRequests across banner
video and native, multi-imp, consent forwarding for GDPR/USP/GPP/COPPA,
EIDs and schain passthrough, interpretResponse across all media types
including VAST XML/URL variants and native JSON parsing, malformed-
input rejection, ext.meta merge, and metadata assertions. Coverage:
100% functions, 100% lines, 82% branches.
* pgamdirect: address Codex review
Three P1s from the Codex automated review:
1. Floors module integration — imp.bidfloor now comes from bid.getFloor()
when the Floors module is enabled, falling back to params.bidfloor and
then 0. Currency is carried from the Floors-returned currency, not
hard-coded to USD. Resolves the regression where publishers on floor
rules were silently sending their static params.bidfloor.
2. schain lookup precedence — buildSource() now reads
ortb2.source.ext.schain first (the modern FPD path), falling back to
the legacy bid.schain. Resolves the drop for publishers who configure
schain through FPD rather than per-bidder params.
3. CORS preflight — removed the x-openrtb-version custom header. The
request is now CORS-simple enough to avoid a browser preflight on
every auction, reducing perceived auction latency by one RTT.
Server accepts OpenRTB 2.6 as default regardless.
Tests updated: 6 new cases covering the two P1 behaviour changes
(getFloor used, fallback to params, fallback when getFloor throws,
fallback to 0, currency preserved, ortb2 schain wins over bid.schain,
bid.schain fallback when ortb2 empty). The removed "forwards schain
from first bid" test is covered by the new "falls back to bid.schain"
case. Existing CORS assertion updated to expect absent customHeaders.
43/43 tests green in Karma/ChromeHeadless. Lint clean.
* pgamdirect: convert to TypeScript, use ortbConverter
Addresses patmmccann review on #14763:
- Convert pgamdirectBidAdapter.js → .ts with typed public interface.
- Replace the hand-rolled imp/device/user/source builders with
libraries/ortbConverter, keeping only the pgam-specific fields
(imp.ext.pgam.orgId, imp.tagid from params.placementId,
meta.networkName from seatbid.seat) as converter hooks.
- Drop the contentType: 'application/json' header entirely — JSON
is NOT a CORS-simple content-type, so setting it forces a
browser preflight on every auction. Omitting it keeps the POST
preflight-free (saves one RTT per request).
The converter inherits Prebid's standard handling of:
- priceFloors module (imp.bidfloor / bidfloorcur via bid.getFloor)
- schain via FPD normalisation (source.ext.schain)
- source.tid, user.eids, site/device/regs (GDPR, USP, GPP, COPPA)
- media types (banner sizes → format[], video player size passthrough,
native request serialisation)
- bidResponse cpm/currency/ttl/netRevenue/mediaType/advertiserDomains
So this change:
- Removes ~200 lines of custom plumbing.
- Means future ORTB spec updates (2.7, new privacy fields) flow
through automatically when Prebid updates the converter.
Also:
- Register GVL ID 1353 on spec (PGAM Media LLC, registered with IAB).
- Keep params.bidfloor as a legacy fallback when the priceFloors
module has not populated imp.bidfloor.
- Force at=1 (first-price) and cur=['USD'] via a request hook.
Spec tests: trimmed to cover only the adapter-owned behaviour
(isBidRequestValid, CORS-simple options, imp hook custom fields,
request hook, bidResponse.meta.networkName, onBidWon). Library-owned
behaviour (floors / schain / GDPR / media types / VAST parsing) is
not re-asserted here; those are covered by ortbConverter's own specs
and by every other adapter that uses it. 26/26 pass locally.
* Core: remove deprecated wretry usage (#14772)
* CI: replace wretry artifact flow with cache save/restore
* CI: use artifact handoff without deprecated retry wrapper
* Core: reduce allocations in metrics.getMetrics (#14769)
* Core: cleanup adloader callback/listener references (#14767)
* Core: tighten apntag shim typing (#14766)
* Core: tighten apntag shim typing
* Core: tighten apntag shim typing
### Motivation
- TypeScript compilation failed when core code accessed `window.apntag.getTag().keywords` because `window.apntag` was typed as `any` and `getTag` returned `unknown` properties.
- Provide a focused, maintainable shim for the `apntag` global so core targeting logic can rely on well-typed properties without losing runtime extensibility.
### Description
- Added an `ApnTag` interface in `src/types/local/shim.d.ts` with explicit method signatures for `getTag`, `modifyTag`, `setKeywords`, `anq`, and `onEvent` and preserved an index signature for extra runtime fields (see `src/types/local/shim.d.ts` 【F:src/types/local/shim.d.ts†L7-L18】).
- Typed `getTag` to return an object that may include `keywords` (`{ keywords?: Record<string,string> } | undefined`) so property access like `.keywords` is accepted by the TypeScript compiler.
- Made the global `Window.apntag` optional (`apntag?: ApnTag`) to reflect pages where the integration is absent.
### Testing
- Ran `npx eslint src/types/local/shim.d.ts --cache --cache-strategy content` which completed successfully.
- Ran `npx gulp test --nolint --file test/spec/unit/core/targeting_spec.js` which completed successfully (all relevant tests passed).
- Ran `npx tsc --noEmit` which completed successfully with no type errors.
* Core: use window crypto reference for UUID random data (#14764)
* Permutive RTD: iterate bidders configured via params.bidders (#14774)
* Permutive RTD: iterate bidders configured via params.bidders
Previously setBidderRtb only wrote ortb2 for the union of acBidders and
Permutive's SSP list. A bidder declared under params.bidders with a
customCohorts mapping was iterated only if it was also present in one of
those lists, leaving publishers' configuration silently inert.
Include Object.keys(params.bidders) in the iterated set so an explicit
per-bidder customCohorts mapping is always honored.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Permutive RTD: type the public params interface
Add a `.d.ts` declaring `PermutiveRtdProviderParams` / `PermutiveRtdProviderConfig`
and wire them into the module via JSDoc typedef imports (follows the pattern
from prebid/Prebid.js#14773).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* 51Degrees RTD: use highEntropySUAAccessor for HEV retrieval (#14746)
* CI: add manual retry for artifact downloads (#14776)
* Prebid 11.8.0 release
* Increment version to 11.9.0-pre
* Bump @xmldom/xmldom from 0.8.12 to 0.8.13 (#14779)
Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.12 to 0.8.13.
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13)
---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
dependency-version: 0.8.13
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump fast-xml-parser from 5.5.7 to 5.7.1 (#14780)
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.5.7 to 5.7.1.
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.7...v5.7.1)
---
updated-dependencies:
- dependency-name: fast-xml-parser
dependency-version: 5.7.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* aceex and yandex bidders: type the public interface (#14773)
* Aceex Adapter: type public params via d.ts
* Aceex/Yandex Adapter: refine bidder params typing
* GPP control modules: add option to restrict more activities (#14762)
* Core: add TCF 2.3 tcData coverage to consent tests (#14788)
* New Bid Adapter: tne_catalyst (#14738)
* New Bid Adapter: tne_catalyst
* tne_catalyst: normalize video playerSize to handle flat [w,h] and nested [[w,h]] forms
* tne_catalyst: use getFloor() for dynamic floors with currency passthrough, fallback to params.bidfloor
* tne_catalystBidAdapter: convert to TypeScript and switch request to text/plain
- Migrate adapter from JS to TS with typed BidderParams (per repo TS migration guidance).
- Change request contentType from application/json to text/plain to avoid the
CORS preflight that was flagged by CodeQL and noted in review.
---------
Co-authored-by: StreetsDigital <45595449+StreetsDigital@users.noreply.github.com>
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* pgamdirect: add getUserSyncs for cookie-sync pixel support (#14777)
* pgamdirect: add getUserSyncs for cookie-based retargeting DSPs
Follow-up to #14763. Our bid adapter previously declared no user-
sync pixels, which blocked cookie-based retargeting DSPs from
matching our users to their own — they need the browser-side sync
step to correlate, and without it their bids come back heavily
suppressed for "user not matched."
Implementation routes sync URLs through the OpenRTB response from
our bidder at `response.ext.cookies[]`. Each entry carries:
{ type: 'image' | 'iframe', url: string }
The per-DSP sync URL list lives server-s…1 parent 73366a8 commit 6aa6abc
654 files changed
Lines changed: 7751 additions & 9746 deletions
File tree
- integrationExamples/gpt/x-domain
- libraries
- intentIqConstants
- medianetUtils
- pbsExtensions/processors
- uniquestUtils
- metadata
- modules
- modules
- bidResponseFilter
- prebidServerBidAdapter
- plugins
- eslint
- test
- src
- test
- build-logic
- fake-server
- helpers
- spec
- integration/faker
- libraries
- greedy
- mspa
- precisoUtils
- pubmaticUtils/plugins
- modules
- videoModule
- submodules
- ortbConverter/pbsExtensions
- unit
- core
- utils
- utils
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
71 | 71 | | |
72 | 72 | | |
73 | 73 | | |
| 74 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
8 | 8 | | |
9 | 9 | | |
10 | 10 | | |
11 | | - | |
| 11 | + | |
12 | 12 | | |
13 | 13 | | |
14 | 14 | | |
| |||
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
| 32 | + | |
32 | 33 | | |
33 | 34 | | |
34 | 35 | | |
| |||
48 | 49 | | |
49 | 50 | | |
50 | 51 | | |
| 52 | + | |
51 | 53 | | |
52 | 54 | | |
53 | 55 | | |
| |||
75 | 77 | | |
76 | 78 | | |
77 | 79 | | |
78 | | - | |
| 80 | + | |
79 | 81 | | |
80 | 82 | | |
81 | 83 | | |
| |||
143 | 145 | | |
144 | 146 | | |
145 | 147 | | |
146 | | - | |
| 148 | + | |
147 | 149 | | |
148 | 150 | | |
149 | 151 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
380 | 380 | | |
381 | 381 | | |
382 | 382 | | |
383 | | - | |
| 383 | + | |
384 | 384 | | |
385 | 385 | | |
386 | 386 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
114 | 114 | | |
115 | 115 | | |
116 | 116 | | |
| 117 | + | |
| 118 | + | |
117 | 119 | | |
| 120 | + | |
118 | 121 | | |
119 | 122 | | |
120 | 123 | | |
| |||
124 | 127 | | |
125 | 128 | | |
126 | 129 | | |
| 130 | + | |
127 | 131 | | |
128 | 132 | | |
129 | 133 | | |
| |||
283 | 287 | | |
284 | 288 | | |
285 | 289 | | |
286 | | - | |
287 | 290 | | |
288 | 291 | | |
289 | 292 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
10 | 10 | | |
11 | 11 | | |
12 | 12 | | |
| 13 | + | |
| 14 | + | |
13 | 15 | | |
14 | 16 | | |
15 | 17 | | |
| |||
128 | 130 | | |
129 | 131 | | |
130 | 132 | | |
131 | | - | |
| 133 | + | |
132 | 134 | | |
133 | 135 | | |
134 | 136 | | |
| |||
148 | 150 | | |
149 | 151 | | |
150 | 152 | | |
151 | | - | |
| 153 | + | |
152 | 154 | | |
153 | 155 | | |
154 | 156 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | | - | |
2 | | - | |
| 1 | + | |
3 | 2 | | |
4 | 3 | | |
5 | 4 | | |
6 | | - | |
| 5 | + | |
7 | 6 | | |
8 | 7 | | |
9 | 8 | | |
| |||
129 | 128 | | |
130 | 129 | | |
131 | 130 | | |
132 | | - | |
| 131 | + | |
133 | 132 | | |
134 | 133 | | |
135 | 134 | | |
| |||
174 | 173 | | |
175 | 174 | | |
176 | 175 | | |
177 | | - | |
178 | | - | |
179 | | - | |
180 | | - | |
| 176 | + | |
| 177 | + | |
| 178 | + | |
| 179 | + | |
| 180 | + | |
| 181 | + | |
| 182 | + | |
181 | 183 | | |
182 | 184 | | |
183 | 185 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
8 | | - | |
| 8 | + | |
| 9 | + | |
9 | 10 | | |
10 | 11 | | |
11 | 12 | | |
| |||
17 | 18 | | |
18 | 19 | | |
19 | 20 | | |
20 | | - | |
| 21 | + | |
21 | 22 | | |
22 | 23 | | |
23 | 24 | | |
| |||
179 | 180 | | |
180 | 181 | | |
181 | 182 | | |
182 | | - | |
183 | | - | |
184 | | - | |
| 183 | + | |
| 184 | + | |
| 185 | + | |
| 186 | + | |
| 187 | + | |
| 188 | + | |
| 189 | + | |
185 | 190 | | |
186 | | - | |
187 | 191 | | |
188 | 192 | | |
189 | 193 | | |
| |||
211 | 215 | | |
212 | 216 | | |
213 | 217 | | |
214 | | - | |
| 218 | + | |
215 | 219 | | |
216 | 220 | | |
217 | 221 | | |
| |||
241 | 245 | | |
242 | 246 | | |
243 | 247 | | |
244 | | - | |
| 248 | + | |
245 | 249 | | |
246 | 250 | | |
247 | 251 | | |
| |||
295 | 299 | | |
296 | 300 | | |
297 | 301 | | |
298 | | - | |
299 | | - | |
300 | | - | |
301 | | - | |
| 302 | + | |
| 303 | + | |
| 304 | + | |
| 305 | + | |
302 | 306 | | |
303 | 307 | | |
304 | 308 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2 | 2 | | |
3 | 3 | | |
4 | 4 | | |
5 | | - | |
| 5 | + | |
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
8 | | - | |
9 | 8 | | |
10 | 9 | | |
11 | 10 | | |
12 | | - | |
| 11 | + | |
13 | 12 | | |
14 | 13 | | |
15 | 14 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
7 | 7 | | |
8 | 8 | | |
9 | 9 | | |
| 10 | + | |
10 | 11 | | |
11 | 12 | | |
12 | 13 | | |
| |||
0 commit comments