Limelight: New alias Nuclion by quietPusher · Pull Request #14783 · prebid/Prebid.js

quietPusher · 2026-04-23T12:38:18Z

Type of change

Description of change

Other information

patmmccann · 2026-04-23T17:17:29Z

you have merge conflicts

quietPusher · 2026-04-24T08:09:55Z

you have merge conflicts

Thank you. Fixed

coveralls · 2026-04-24T08:22:01Z

Coverage Report for CI Build 24879280164

Coverage remained the same at 96.411%

Details

Coverage remained the same as the base build.
Patch coverage: No coverable lines changed in this PR.
1 coverage regression across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

1 previously-covered line in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
test/spec/modules/id5AnalyticsAdapter_spec.js	1	96.13%

Coverage Stats


Relevant Lines:	230330
Covered Lines:	222063
Line Coverage:	96.41%
Relevant Branches:	53468
Covered Branches:	43503
Branch Coverage:	81.36%
Branches in Coverage %:	No
Coverage Strength:	72.67 hits per line

💛 - Coveralls

Co-authored-by: mderevyanko <mderevyanko24@gmail.com>

* Remove gvlid from movingup bid adapter (#14749) * billow_rtb25: New adapter (#14690) * New adapter: billow_rtb25 * delete options * add public interface * Change the adapter type to a ts file --------- Co-authored-by: zepeng.yin <zp.yin@foxmail.com> * Prebid 11.7.0 release * Increment version to 11.8.0-pre * Showheroes Bid Adapter: rename showheroes bid adapter (#14644) * rename showheroes bid adapter * Showheroes: bring back old adapter * Impactify Bid Adapter: ensure compatible mediaType mapping (#14748) * Updated bid adapter to log errors * Remove onBidderError function and LOGGER_JS_URI Removed unused onBidderError function and LOGGER_JS_URI constant. * Apply suggestion from @Copilot Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix mediatypes * Add banner test * Add mediaType fallbacks --------- Co-authored-by: Filipe Neves <me@filipeneves.net> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * CriteoBidAdapter: Fix outstream video (#14753) * Update: Adding Device hardware version (hwv) in the adapter (#14757) * wurfl rtd: collect SUA via src/fpd/sua.js for high-entropy hints (#14758) Switch the SUA source from the bid request to direct calls to getHighEntropySUA from src/fpd/sua.js. This ensures wurfl.js and the analytics beacon receive high-entropy User-Agent Client Hints. Falls back to low-entropy SUA when high-entropy is unavailable (non-Chromium browsers, restrictive Permissions Policy). Refs prebid/Prebid.js#14574 * Msft Bid Adapter - Native request example in md updated to include eventtrackers (#14760) * Update msftBidAdapter.md * Minor update to the keyword format * Minor update to the keyword format * Update msftBidAdapter.md --------- Co-authored-by: Jason Crane <jasoncrane@microsoft.com> * Intenze Adapter: Europe support (#14658) * Intenze Adapter: Europe support * fix lint problem in intenzeBidAdapter.js * Bid Filter Module: Add option for bidResponseFilter handling for in-banner video on multi-format (#14542) * Add option for bidResponseFilter handling for in-banner video on multi-format * Format code for consistency in bidResponseFilter_spec.js --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> Co-authored-by: Patrick McCann <pmccann@cafemedia.com> * Core: fix typos in reducers comments (#14768) * IntimateMerger Analytics Adapter : initial release (#14726) * IntimateMerger Analytics Adapter : initial release * IntimateMerger Analytics Adapter : fix event overlap * IntimateMerger Analytics Adapter : refactoring * IntimateMerger Analytics Adapter : Update modules/imAnalyticsAdapter.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * IntimateMerger Analytics Adapter : Update waitTimeout Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * IntimateMerger Analytics Adapter : Update modules/imAnalyticsAdapter.js docs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * IntimateMerger Analytics Adapter : Update docs * IntimateMerger Analytics Adapter : cid optional --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Adquery Bid Adapter: userID usage refactor (#14692) * adquery_video_work9 * adquery_video_work9 * adquery_video_work9 * update onBidWon --------- Co-authored-by: Adrian Dzida <a.dzida@openmobi.pl> * New Bidder: PGAM Direct (#14763) * Add PGAM Direct bid adapter New SSP bidder (server-to-server, canonical OpenRTB 2.6) operated by PGAM Media LLC. Distinct from pgamssp (our legacy TeqBlaze-hosted adapter); we plan to migrate publishers from pgamssp to pgamdirect over 2026 and will submit a deprecation PR for pgamssp once migration completes. Both are actively maintained. GVL ID: 1353 Endpoint: https://rtb.pgammedia.com/rtb/v1/auction Media types: banner, video, native Supports: schain, TCF v2, USP, GPP, COPPA, EIDs, GPID, floors module, deals, first-party data 37 spec cases covering isBidRequestValid, buildRequests across banner video and native, multi-imp, consent forwarding for GDPR/USP/GPP/COPPA, EIDs and schain passthrough, interpretResponse across all media types including VAST XML/URL variants and native JSON parsing, malformed- input rejection, ext.meta merge, and metadata assertions. Coverage: 100% functions, 100% lines, 82% branches. * pgamdirect: address Codex review Three P1s from the Codex automated review: 1. Floors module integration — imp.bidfloor now comes from bid.getFloor() when the Floors module is enabled, falling back to params.bidfloor and then 0. Currency is carried from the Floors-returned currency, not hard-coded to USD. Resolves the regression where publishers on floor rules were silently sending their static params.bidfloor. 2. schain lookup precedence — buildSource() now reads ortb2.source.ext.schain first (the modern FPD path), falling back to the legacy bid.schain. Resolves the drop for publishers who configure schain through FPD rather than per-bidder params. 3. CORS preflight — removed the x-openrtb-version custom header. The request is now CORS-simple enough to avoid a browser preflight on every auction, reducing perceived auction latency by one RTT. Server accepts OpenRTB 2.6 as default regardless. Tests updated: 6 new cases covering the two P1 behaviour changes (getFloor used, fallback to params, fallback when getFloor throws, fallback to 0, currency preserved, ortb2 schain wins over bid.schain, bid.schain fallback when ortb2 empty). The removed "forwards schain from first bid" test is covered by the new "falls back to bid.schain" case. Existing CORS assertion updated to expect absent customHeaders. 43/43 tests green in Karma/ChromeHeadless. Lint clean. * pgamdirect: convert to TypeScript, use ortbConverter Addresses patmmccann review on #14763: - Convert pgamdirectBidAdapter.js → .ts with typed public interface. - Replace the hand-rolled imp/device/user/source builders with libraries/ortbConverter, keeping only the pgam-specific fields (imp.ext.pgam.orgId, imp.tagid from params.placementId, meta.networkName from seatbid.seat) as converter hooks. - Drop the contentType: 'application/json' header entirely — JSON is NOT a CORS-simple content-type, so setting it forces a browser preflight on every auction. Omitting it keeps the POST preflight-free (saves one RTT per request). The converter inherits Prebid's standard handling of: - priceFloors module (imp.bidfloor / bidfloorcur via bid.getFloor) - schain via FPD normalisation (source.ext.schain) - source.tid, user.eids, site/device/regs (GDPR, USP, GPP, COPPA) - media types (banner sizes → format[], video player size passthrough, native request serialisation) - bidResponse cpm/currency/ttl/netRevenue/mediaType/advertiserDomains So this change: - Removes ~200 lines of custom plumbing. - Means future ORTB spec updates (2.7, new privacy fields) flow through automatically when Prebid updates the converter. Also: - Register GVL ID 1353 on spec (PGAM Media LLC, registered with IAB). - Keep params.bidfloor as a legacy fallback when the priceFloors module has not populated imp.bidfloor. - Force at=1 (first-price) and cur=['USD'] via a request hook. Spec tests: trimmed to cover only the adapter-owned behaviour (isBidRequestValid, CORS-simple options, imp hook custom fields, request hook, bidResponse.meta.networkName, onBidWon). Library-owned behaviour (floors / schain / GDPR / media types / VAST parsing) is not re-asserted here; those are covered by ortbConverter's own specs and by every other adapter that uses it. 26/26 pass locally. * Core: remove deprecated wretry usage (#14772) * CI: replace wretry artifact flow with cache save/restore * CI: use artifact handoff without deprecated retry wrapper * Core: reduce allocations in metrics.getMetrics (#14769) * Core: cleanup adloader callback/listener references (#14767) * Core: tighten apntag shim typing (#14766) * Core: tighten apntag shim typing * Core: tighten apntag shim typing ### Motivation - TypeScript compilation failed when core code accessed `window.apntag.getTag().keywords` because `window.apntag` was typed as `any` and `getTag` returned `unknown` properties. - Provide a focused, maintainable shim for the `apntag` global so core targeting logic can rely on well-typed properties without losing runtime extensibility. ### Description - Added an `ApnTag` interface in `src/types/local/shim.d.ts` with explicit method signatures for `getTag`, `modifyTag`, `setKeywords`, `anq`, and `onEvent` and preserved an index signature for extra runtime fields (see `src/types/local/shim.d.ts` 【F:src/types/local/shim.d.ts†L7-L18】). - Typed `getTag` to return an object that may include `keywords` (`{ keywords?: Record<string,string> } | undefined`) so property access like `.keywords` is accepted by the TypeScript compiler. - Made the global `Window.apntag` optional (`apntag?: ApnTag`) to reflect pages where the integration is absent. ### Testing - Ran `npx eslint src/types/local/shim.d.ts --cache --cache-strategy content` which completed successfully. - Ran `npx gulp test --nolint --file test/spec/unit/core/targeting_spec.js` which completed successfully (all relevant tests passed). - Ran `npx tsc --noEmit` which completed successfully with no type errors. * Core: use window crypto reference for UUID random data (#14764) * Permutive RTD: iterate bidders configured via params.bidders (#14774) * Permutive RTD: iterate bidders configured via params.bidders Previously setBidderRtb only wrote ortb2 for the union of acBidders and Permutive's SSP list. A bidder declared under params.bidders with a customCohorts mapping was iterated only if it was also present in one of those lists, leaving publishers' configuration silently inert. Include Object.keys(params.bidders) in the iterated set so an explicit per-bidder customCohorts mapping is always honored. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Permutive RTD: type the public params interface Add a `.d.ts` declaring `PermutiveRtdProviderParams` / `PermutiveRtdProviderConfig` and wire them into the module via JSDoc typedef imports (follows the pattern from prebid/Prebid.js#14773). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * 51Degrees RTD: use highEntropySUAAccessor for HEV retrieval (#14746) * CI: add manual retry for artifact downloads (#14776) * Prebid 11.8.0 release * Increment version to 11.9.0-pre * Bump @xmldom/xmldom from 0.8.12 to 0.8.13 (#14779) Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.12 to 0.8.13. - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13) --- updated-dependencies: - dependency-name: "@xmldom/xmldom" dependency-version: 0.8.13 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump fast-xml-parser from 5.5.7 to 5.7.1 (#14780) Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.5.7 to 5.7.1. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.7...v5.7.1) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.7.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * aceex and yandex bidders: type the public interface (#14773) * Aceex Adapter: type public params via d.ts * Aceex/Yandex Adapter: refine bidder params typing * GPP control modules: add option to restrict more activities (#14762) * Core: add TCF 2.3 tcData coverage to consent tests (#14788) * New Bid Adapter: tne_catalyst (#14738) * New Bid Adapter: tne_catalyst * tne_catalyst: normalize video playerSize to handle flat [w,h] and nested [[w,h]] forms * tne_catalyst: use getFloor() for dynamic floors with currency passthrough, fallback to params.bidfloor * tne_catalystBidAdapter: convert to TypeScript and switch request to text/plain - Migrate adapter from JS to TS with typed BidderParams (per repo TS migration guidance). - Change request contentType from application/json to text/plain to avoid the CORS preflight that was flagged by CodeQL and noted in review. --------- Co-authored-by: StreetsDigital <45595449+StreetsDigital@users.noreply.github.com> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * pgamdirect: add getUserSyncs for cookie-sync pixel support (#14777) * pgamdirect: add getUserSyncs for cookie-based retargeting DSPs Follow-up to #14763. Our bid adapter previously declared no user- sync pixels, which blocked cookie-based retargeting DSPs from matching our users to their own — they need the browser-side sync step to correlate, and without it their bids come back heavily suppressed for "user not matched." Implementation routes sync URLs through the OpenRTB response from our bidder at `response.ext.cookies[]`. Each entry carries: { type: 'image' | 'iframe', url: string } The per-DSP sync URL list lives server-side (one entry per downstream DSP we integrate), so this adapter stays stable even as we add / rotate DSPs. Behaviour: - Empty serverResponses or no ext.cookies → return [] - Respects syncOptions.iframeEnabled / pixelEnabled (publisher- controlled — some publishers disallow iframe syncs) - Drops malformed entries (missing url or unknown type) - Caps at 5 pixels per response to avoid cookie floods Consent note: Prebid passes parsed GDPR / USP / GPP state, but we don't filter server-side. Each DSP's sync URL already encodes its own consent handling (appending ?gdpr=1&gdpr_consent=... as each requires). Future revision can add per-DSP consent framework declarations + server-side suppression if a DSP fails to register handling for the caller's framework. Tests: +6 spec cases covering empty, malformed, caps, and consent- driven filtering. 32/32 pass (was 26). * pgamdirect: remove in-adapter sync cap (address Codex review) Codex pointed out on #14777 that the hard-cap at 5 pixels bypassed Prebid's `userSync.syncsPerBidder` control in src/userSync.ts. Core already enforces the per-bidder sync limit based on publisher configuration; an additional cap inside the adapter silently drops valid sync URLs when a publisher raises the limit (or sets 0 = unlimited), reducing match coverage for downstream DSPs. Fix: remove the break on length >= 5 so getUserSyncs returns the full filtered list. Prebid core does the right thing from here. Updated the corresponding test to assert the full list comes back with a comment pointing to where the authoritative cap lives. 32/32 tests still pass. --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Nexx360 Utils Library: add shared getGzipSetting helper (#14781) * Nexx360 Utils Library: add shared getGzipSetting helper Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Gabriel Chicoye <gabriel@macbookrogab24g.lan> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Rename agenticAudienceAdapter to agenticAudienceRtdProvider (#14729) * Core: fix additional typo occurrences (#14770) * new alias nuclion (#14783) Co-authored-by: mderevyanko <mderevyanko24@gmail.com> * enable compression and remove callbacks (#14643) * Add pgamdirect Analytics Adapter (#14778) * Add pgamdirect Analytics Adapter Companion to modules/pgamdirectBidAdapter.ts (merged #14763). Publishers install this alongside the bid adapter to forward auction telemetry to the PGAM Direct SSP backend. Forwards four Prebid events, deliberately narrow: AUCTION_END — competitor CPMs seen in the auction BID_WON — Prebid-layer winner + price AD_RENDER_SUCCEEDED — client-confirmed impression AD_RENDER_FAILED — with reason (exception / timeout / etc) The value add over a server-side-only ledger: client-confirmed render vs. "RTB said we won", plus visibility into what other bidders priced the same auction at (we own server-side data for our own DSP calls, but not for the ones other SSPs made through the same Prebid wrapper). Payload is normalised into a small fixed shape before POST — we deliberately drop the raw Prebid event args, which carry full FPD / user.eids / custom bidder params that we don't need and shouldn't exfiltrate. Sink: https://app.pgammedia.com/api/analytics-events (one POST per event; content-type text/plain to keep CORS simple). Config: pbjs.enableAnalytics({ provider: 'pgamdirect', options: { orgId: '<pgam org id>', // required endpoint: 'https://...' // optional override } }); GVL ID 1353 (PGAM Media LLC, same as the bid adapter). Tests: 12 covering registration, orgId validation, and the pure normalise transform across all 4 forwarded event types (including the 20-entry bidders_seen cap and filter-out of bidders with no code). Event-emission path is not covered in this spec because the sinon mock + AnalyticsAdapter async queue interact oddly in the test harness — we export normalise() directly so the transform is verifiable without the full event pipeline. The ajax call itself is covered by upstream AnalyticsAdapter base-class tests. * pgamdirectAnalytics: address Codex review on #14778 Two P1s flagged by Codex on the initial commit: 1. ad_unit_code semantic inconsistency Original code pulled ad_unit_code from args.adUnitCode on BID_WON but from args.adId on AD_RENDER_*, so the same field represented different identifiers across event types. In auctions with multiple ad units (or repeated wins from the same bidder), this prevented reliable win → render reconciliation and could misattribute render outcomes. Fix: render events now read ad_unit_code from args.bid.adUnitCode (stable across the BID_WON ↔ AD_RENDER_* join for the same slot). adId moves to its own field `ad_id` so per-bid traceability is preserved. Type definition updated with a comment explaining the split so future contributors don't re-conflate them. 2. Missing fetch keepalive Prebid AGENTS.md §71 requires low-priority telemetry calls to set fetch keepalive. Without it, BID_WON + AD_RENDER_* events emitted near page unload get dropped before reaching the endpoint — and those are exactly the events that fire in that window. Added `keepalive: true` to the ajax call. Prebid's ajax helper already supports the flag (src/ajax.ts option); no adapter-side polyfill needed. Tests: +1 spec case covering "missing bid object on AD_RENDER_* still captures ad_id cleanly." Existing render-event assertions updated to verify the ad_unit_code-vs-ad_id split explicitly. 13/13 pass (was 12). * fix: add upstream_partner KV to GAM (#14743) Co-authored-by: Shashank <=> * Vidazoo adapter: support host bidder param (#14784) * align spec on all adapters that we manage; add coverage to libraries/vidazooUtils/bidderUtils.js; changes are backward-compatible * more coverage * more coverage for vidazoo bidder utilities * more coverage; utils function full coverage * remove comments * fix tests after the code removal in new master code: check of bidderRequest.paapi.enabled * fixing get headers * fixing single request * adding burl to createInterpretResponseFn * adding more tests for coverage * fixing latest changes to support the right data * fixing tests * fix missing map of a host param * fix missing map of a host param * adding test for the new data params map * adding type files for adapter to define params in bid object * code imp --------- Co-authored-by: Anna Yablonsky <annay+perion@perion.com> * Build System: replace source-map-loader with webpack native source-map loading (#14797) * Mtc Bid Adapter: initial release (#14782) * Nexx360 Utils Library: add shared getGzipSetting helper Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Mtc Bid Adapter: initial release Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Update mtcBidAdapter.ts Bid Params guard fix * Update mtcBidAdapter.md * Nexx360 Bid Adapter: make requestCounter assertion order-independent The shared module-level requestCounter in libraries/nexx360Utils is incremented by every consuming adapter, so when mtcBidAdapter tests run in the same chunk before nexx360 tests, the counter is no longer 0. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gabriel Chicoye <gabriel@macbookrogab24g.lan> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * New Bid Adapter - goadserver (#14701) * New Bid Adapter - goadserver Multi-tenant Prebid.js adapter for the goadserver platform. One bidder code ("goadserver") serves every deployment — publishers pass the deployment-specific host + SSP campaign token per ad unit via params.host and params.token. The adapter POSTs to https://{host}/openrtb2/auction (goadserver's Prebid Server-compatible endpoint) and supports banner, video, and native via ortbConverter. GVL ID is not yet registered with IAB Europe and is commented out in the adapter for now; will be populated once the TCF registration lands. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: use real maintainer email Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: support params.subid Emits an optional per-impression subid in imp.ext.goadserver.subid so goadserver can attribute bids to a sub-identifier (page section, article bucket, A/B test group, etc.) without requiring a separate HB campaign per variation. Server-side normalization strips unsafe characters and caps the length at 1024. Test coverage: 22 → 24 tests (adds "emits params.subid" and "omits imp.ext.goadserver.subid when no subid is set" cases). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: getUserSyncs from ext.goadserver.usersync Implements the getUserSyncs hook so publishers using this adapter drop the goadserver persistent cookie after each auction. The sync URL is published per-deployment at response.body.ext.goadserver.usersync by the server (/openrtb2/auction), so the same adapter picks up the right pixel for every goadserver system without hardcoding hosts. Returns image or iframe syncs per syncOptions; falls back to empty when either the response has no sync entry or the publisher has disabled sync types globally. Test coverage: 24 → 29 tests (5 new getUserSyncs cases covering empty responses, missing ext, type filtering, and iframe path). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: params.deals[] + outstream video docs Two Tier 2 additions: 1. params.deals[] support. Publishers can now attach private marketplace deal objects per ad unit; the adapter's ortbConverter imp hook translates them into imp.pmp.deals[] in the outgoing BidRequest. Each deal object accepts id (required), bidfloor, bidfloorcur, at, wseat[], wadomain[] — matching the OpenRTB 2.5 imp.pmp.deals spec. 2. Outstream video documentation. The adapter already forwards video imps untouched via ortbConverter (including context='outstream') so no code change is needed on the request side. Added an .md section showing the standard Prebid.js ad-unit-level renderer pattern for publishers who want outstream. Test coverage: 29 → 32 tests (emits deals, omits when unset, outstream video imp shape preserved). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: outstream video renderer + cached VAST URL Attaches a Prebid.js Renderer for video bids whose ad unit requested mediaTypes.video.context = 'outstream'. The renderer loads the deployment-hosted player at https://{params.host}/prebid-outstream.js which parses the VAST XML and injects a muted autoplay <video> element into the slot with impression + click tracking. Publishers can override the hosted script via params.outstreamRendererUrl, or fall back to a standard ad-unit-level renderer which takes precedence. Also prefers the Prebid Cache URL (exposed via ext.prebid.targeting .hb_cache_url) over inline VAST XML when both are present, so large VAST blobs don't have to live in Prebid's in-memory targeting store. The bidRequests array is now stashed on the ServerRequest so interpretResponse can correlate bids back to their originating ad unit (needed to detect outstream context). All 32 existing unit tests still pass. * goadserverBidAdapter: split per (host, token); plain-text POST Addresses codex-connector review on PR #14701: - buildRequests now groups bids by (host, token) and emits one ServerRequest per group, so pages mixing multiple goadserver deployments route each ad unit to the correct endpoint + token. - POST uses contentType 'text/plain' instead of 'application/json' so the browser skips the CORS preflight (same JSON body, one round-trip instead of two). - getUserSyncs JSDoc @returns {UserSync[]} -> {Object[]} to clear the lint warning from an undefined type reference. New specs cover multi-tenant splitting, same-tenant bundling, and the text/plain content-type assertion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: migrate to TypeScript Per the prebid/Prebid.js TS migration guidance from the bot review on PR #14701: convert the adapter to .ts with typed BidderSpec and a GoadserverBidParams type registered via `declare module '../src/adUnits'`. Runtime behavior unchanged — spec passes 33/33. --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Blazo <blazo@goadserver.com> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Build system: Switch to native Gulp v5 sourcemap handling and remove `gulp-sourcemaps` (#14805) * Build System: remove gulp-sourcemaps dependency * Build System: preserve bundle sourcemaps through header/footer injection * fix warning on creative renderers source map --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Core: disable user syncs in Firefox and Webkit Chrome (#14803) * Core: disable user syncs in Firefox * Core: block user syncs for Chrome iOS * Livewrapped Adapter: align cookieSupport browser gating * Livewrapped Adapter: stabilize cookieSupport tests across browsers * ADTS-661-send-video-pos-value-from-Prebid-JS-adapter (#14808) * CI: use app password for notification emails (#14817) * CI: use app password for notification emails * update workflow file; fix validation * Core: limit mergeConfig notifications to updated topics (#14741) * mergeConfig trigger only merged topic listeners & write test * Avoid prototype inheritance in merged config * Encypher RTD Provider: C2PA content provenance signals (#14807) * feat: add Encypher RTD provider for C2PA content provenance Injects C2PA content provenance signals into OpenRTB bid requests at site.ext.data.c2pa, enabling DSPs to factor verified publisher identity and content integrity into bidding decisions. Three execution paths in strict priority: - Path A (Manifest shortcut): reads <meta name="c2pa-manifest-url"> - Path B (Cache): serves from localStorage, no network call - Path C (API): extracts text, sends to Encypher API which detects existing embedded provenance markers or signs fresh content Content signed at CMS/CDN level carries invisible C2PA markers that survive DOM rendering. The API detects and verifies these server-side, returning the publisher's authenticated signer tier. This differentiates publisher-signed inventory from third-party-attested inventory in bids. Extracts JSON-LD metadata (author, dates, section, keywords, publisher, language) for analytics when structured data is available. No external scripts loaded. Every code path calls callback(). The module never blocks an auction. GDPR-compliant via Prebid storageManager. Free tier: 1,000 unique content signatures per domain per month. Verification of already-signed content does not count against quota. Deduped by content hash. Quota exceeded fails open gracefully. * fix(encypherRtd): add security guards from code review - Add callback-once guard to prevent double-invocation - Add 2s safety timeout so module never blocks auction - Add GDPR consent gate before transmitting page content - Add API host allowlist (api.encypher.com, staging-api.encypher.com) - Add tests for consent, allowlist, and HTTP-rejection scenarios - Update test apiBase to use allowed host * docs(encypherRtd): note security guards in module README * fix(encypherRtd): address review feedback, migrate to TypeScript - Extract getCanonicalUrl/hashUrl to libraries/encypherUtils - Remove application/json content type to avoid CORS preflight - Broaden consent gate to check COPPA, USP/CCPA opt-out, and GDPR - Migrate module to TypeScript with typed public interface (EncypherRtdParams, C2paPayload, RtdProviderSpec<'encypher'>) - Enforce HTTPS on Path A manifest URLs - Add 8 new tests (39 total, all passing) Addresses review feedback from patmmccann on #14807. --------- Co-authored-by: Developer <developer@example.com> * Prebid 11.9.0 release * Increment version to 11.10.0-pre * New adapter: cortex (#14811) * New adapter: cortex * fix(md-docs): add info about bid params * fix(types): update types for BidParams --------- Co-authored-by: Cortex Dev <dev@cortexch.it> * Module Fix: `mergeConfig` failing to apply custom `priceGranularity` (and fix `mediaTypePriceGranularity` setter) (#14815) * fix: allow mergeConfig to overwrite primitives with objects and fix mediaTypePriceGranularity setter * test: add regression test for mergeConfig with custom priceGranularity * Refactor mergeConfig regression test for clarity Removed unnecessary blank line and updated comment formatting. --------- Co-authored-by: Patrick McCann <pmccann@cafemedia.com> * BrainX Adapter: simplify test adm and crid fixtures (#14822) * Bid Adapters: simplify discovery and bliink test adm fixtures (#14823) * Pigeoon bid adapter: initial release (#14786) * Add Pigeoon bid adapter * Fix GDPR flag, replace cookie with StorageManager, remove native support, use text/plain content-type * Fix GDPR flag, replace cookie with StorageManager, remove native support, use text/plain content-type * Fix linting: use 2 space indentation * Trigger CI * Simplify documentation to match Prebid standard format * Add JSDoc types and simplify documentation --------- Co-authored-by: OSMAN YAVUZ PİŞKİN <osman.piskin01@outlook.com> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Intenze Adapter: stabilize endpoint URL assertions in tests (#14790) * Lotame Id module: reset Lotame storage config between getId calls in tests (#14824) * Core: reset Lotame storage config per getId call * Core: use per-request Lotame storage config in async callback * Core: replace body-parser usage with express parsers (#14825) * ReVantage Bid Adapter: add gvlid (#14829) * Create revantageBidAdapter.js * Create revantageBidAdapter.md * Update revantageBidAdapter.js * Update revantageBidAdapter.js * Update revantageBidAdapter.js * Update revantageBidAdapter.js Fixed trailing slash Error on Line 123 * Create revantageBidAdapter_spec.js * Update revantageBidAdapter_spec.js Fixed Trailing slashes (again) * Update revantageBidAdapter_spec.js * Update revantageBidAdapter_spec.js same thing again * Refactor Revantage Bid Adapter for media types and bids Refactor Revantage Bid Adapter to use media type constants and improve bid response handling. * Refactor RevantageBidAdapter tests for GPP consent * Update modules/revantageBidAdapter.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update modules/revantageBidAdapter.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Validate feedId consistency in batch bid requests Added validation to ensure all bid requests in a batch have the same feedId, logging a warning if they do not. * Add test for rejecting batch with different feedIds * Update syncOptions for image sync URL parameters * Update sync URL to use 'tag=img' instead of 'type=img' * Update print statement from 'Hello' to 'Goodbye' * fixed * Enhance video bid handling and add utility functions Added functions to handle video size extraction and VAST detection. * Add gvlid to revantageBidAdapter --------- Co-authored-by: Patrick McCann <pmccann@cafemedia.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Percent in view library: guard viewability observer against non-elements (#14709) * Build system: do not run Intersection.observe of mock elements during tests * fix stub not always active --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Viously Adapter: normalize nurl test URLs to avoid chunk noise (#14801) * Asterio Bid Adapter: add initial bidder adapter (#14691) * Asterio Bid Adapter: add initial bid adapter * Asterio Bid Adapter: corrected documentation * Asterio Bid Adapter: review fixes * Asterio Bid Adapter: migrating to typescript --------- Co-authored-by: Denis Anoykin <aden@asteriosoft.com> * relayBidAdapter.js: remove gvl id (#14830) * Remove GVLID constant from relayBidAdapter.js Removed the GVLID constant from relayBidAdapter.js * Update relayBidAdapter.js * MSFT Bid Adapter - support video.placement and video.plcmt (#14832) * Prebid 11.10.0 release * Increment version to 11.11.0-pre * Bump actions/github-script from 8 to 9 (#14834) Bumps [actions/github-script](https://github.com/actions/github-script) from 8 to 9. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v8...v9) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Core: allow async event handlers (#14828) * Core: allow async event handlers * lint * Remove isA function from objects.ts Removed isA function that checks object type. * Remove isA tests from utils_spec.js Removed tests for the isA function from utils_spec.js. * Clean up documentation for isFn function Removed unnecessary parameter documentation from isFn function. --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * stub out more storagemanager methods (#14836) * SeedingAlliance Bid Adapter: handle eventtrackers correctly (#14800) * seedingAlliance: handle eventtrackers correctly * fix unit test * increase test coverage * New Adapter: TeqBlaze Demo (#14837) * added ts for teqblaze utils and some fixes * New Adapter: TeqBlaze Demo * update readme * Fix formatting in TeqBlaze Demo Bid Adapter documentation --------- Co-authored-by: Patrick McCann <pmccann@cafemedia.com> * Github Actions: Auto-label PRs touching core modules in PR-assignment-deps workflow (#14820) * CI: fix GPP control module names for core labeling * CI: skip core labeling when token is read-only * move label assignment to PR assignment job --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Core: add release drafter category for core-tagged PRs (#14821) * Core: add release drafter category for core-tagged PRs * Core: move core release-drafter section above features * Bump axios from 1.15.0 to 1.16.0 (#14842) Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.16.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.15.0...v1.16.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * NaveggIdSystem: fix spurious test failures (#14841) * NaveggIdSystem: fix spurious test failures * Fix extra directory * Conceptx Bid Adapter: Update site property values (#14831) * New adapter: concepx * Syntax change * Revert syntax change * Defensive check for response from bidder server * Add better validation for the request * Merge branch 'master' of https://github.com/prebid/Prebid.js * Don't append url on every buildrequest * Add gvlId to conceptX * Change conceptx adapter, to directly request our PBS * Add empty getUserSync, as the syncing will be delegated (runPbsCookieSync) * Update conceptx bid adapter with modified site params sent * add params type + tests --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * MGID Bid Adapter: migrate to ortbConverter (#14761) Co-authored-by: Erik Poul <erik.poul@mgid.com> * Fix github token; exclude top-level file changes from being considered core (#14843) * Attekmi: add regions (#14833) * Attekmi: add region to Markapp * syntax fix * Markapp uses only http protocol * endpoints update to https * Attekmi: add regions * fixes on review * eslint fixes * tests extended and fixed --------- Co-authored-by: Victor <victor.banudz@smart-hub.io> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Core: map teqBlaze demo adapter to metadata component (#14844) * ssp_geniee Adapter: use request-scoped client hints (#14747) * ssp_geniee Adapter: use request client hints * Update ssp_genieeBidAdapter.js * Prebid 11.11.0 release * Increment version to 11.12.0-pre * Bump ip-address and socks (#14845) Bumps [ip-address](https://github.com/beaugunderson/ip-address) and [socks](https://github.com/JoshGlazebrook/socks). These dependencies needed to be updated together. Updates `ip-address` from 9.0.5 to 10.2.0 - [Commits](https://github.com/beaugunderson/ip-address/commits) Updates `socks` from 2.8.4 to 2.8.8 - [Release notes](https://github.com/JoshGlazebrook/socks/releases) - [Commits](https://github.com/JoshGlazebrook/socks/compare/2.8.4...2.8.8) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect - dependency-name: socks dependency-version: 2.8.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump basic-ftp from 5.3.0 to 5.3.1 (#14847) Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.3.0 to 5.3.1. - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](https://github.com/patrickjuchli/basic-ftp/compare/v5.3.0...v5.3.1) --- updated-dependencies: - dependency-name: basic-ftp dependency-version: 5.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Remove gulp-wrap dependency and clean up package files (#14846) * Build: remove gulp-wrap dependency to eliminate consolidate * Build: remove gulp-wrap usage from precompilation * pass in imp.displaymanager and img.displaymanagerver (#14857) Co-authored-by: Shuhao <shuhao.qgg.zhang@gmail.com> * CI: fix coveralls base comparison for PR branches (#14813) * CI: compute coveralls base commit from merge-base * CI: fetch full base branch history for merge-base * CI: isolate coveralls upload to dedicated coverage run * remove additional test run * Fix source maps * remove unused variable --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Bump fast-xml-builder from 1.1.5 to 1.2.0 (#14862) Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.5 to 1.2.0. - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.5...v1.2.0) --- updated-dependencies: - dependency-name: fast-xml-builder dependency-version: 1.2.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump fast-uri from 3.1.0 to 3.1.2 (#14864) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @babel/plugin-transform-modules-systemjs from 7.28.5 to 7.29.4 (#14865) Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.28.5 to 7.29.4. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs) --- updated-dependencies: - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bliink Adapter: replace long VAST event token fixture (#14848) * mileRtdProvider initial commit (#14636) * mileRtdProvider initial commit * removing the isFlooringEnforcedForAuction gate * converted to typescript and removed the flooringEnforcedCheck inside the RTD module * using adUnit.adserverTargeting --------- Co-authored-by: JP Mohan <jpmohan@MacBook-Pro-9.local> * Core Typescript types: Add bidCacheFilterFunction to types (#14869) * Add bidCacheFilterFunction to types * Fix linting errors * Native Agents Bid Adapter: add new adapter (#14755) * New adapter: Native Agents * NativeAgents Bid Adapter: add TypeScript BidderParams type augmentation * NativeAgents Bid Adapter: rename bider code to ntvagents * Abtshield id system prebid (#14861) * ABTShield User ID Adapter: add ID system * ABT Shield ID System: add SIVT segment * ABT Shield ID System: scope credentialed requests * Require storage config with 1-day minimum TTL in abtshieldIdSystem Add validation to reject missing or incomplete storage configuration and enforce a 1-day minimum for `storage.expires` to bound MCR request volume. Update TypeScript definitions to make storage fields required with documentation. Add comprehensive test coverage for validation logic. * Bump @wdio/browserstack-service from 9.19.1 to 9.23.3 (#14871) Bumps [@wdio/browserstack-service](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-browserstack-service) from 9.19.1 to 9.23.3. - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.23.3/packages/wdio-browserstack-service) --- updated-dependencies: - dependency-name: "@wdio/browserstack-service" dependency-version: 9.23.3 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fluct Bid Adapter: add ortb2Imp.ext.data and rwdd signals (#14872) * add instl support * falseの場合も明示的に送信するようにした * fluct Bid Adapter: add ortb2Imp.ext.data and rwdd signals Pass impression-level custom targeting data (ortb2Imp.ext.data) and rewarded ad flag (ortb2Imp.rwdd) to the fluct server to improve signal coverage and enable rewarded inventory differentiation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: yosei-ito <ca01423@cartahd.com> Co-authored-by: himu62 <ca00732@cartahd.com> Co-authored-by: himu <himu62@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * Clear Livewrapped analytics cache when pbjs.clearAllAuctions is called (#14870) * feat(hypelabBidAdapter): migrate to OpenRTB 2.6 endpoint (#14863) Migrate HypeLab bid adapter from custom /v1/prebid_requests format to OpenRTB 2.6-compliant /v1/rtb_requests endpoint using Prebid's built-in ortbConverter. Remove legacy event reporting callbacks (onTimeout, onSetTargeting, onBidderError); keep onBidWon to fire burl pixel. * Currency: fix bug where conversion rates are sometimes reset to defaultRates (#14878) * Currency: fix bug where conversion rates are sometimes reset to defaultRates * allow for multiple settings of defaultRates * CI: do not auto-assign reviewers on draft PRs (#14876) * CI: do not auto-assign reviewers on draft PRs * add ready_for_review trigger * reinstall to pick up package.json updates (#14731) Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Tercept Analytics Adapter: make auction window configurable (#14858) * Changing auction timer to configurable with a 5 secs default value since many BID_WON events were happening after 1.5 secs. * Use nullish coalescing for analyticsBatchTimeout so 0 is treated as an explicit immediate flush rather than falling back to the default. * Bump terceptAnalyticsAdapter version to v2.0.0 * Add TypeScript type definitions for terceptAnalyticsAdapter init options * Reference TerceptAnalyticsAdapterOptions type in adapter via JSDoc typedef * Update default analytics endpoint to b-s.tercept.com and fix pubKey type to number * Build system: combine coverage results for coveralls (#14874) * Build system: update source maps sourceRoot * try finagling file name * try combining coverage results * install lcov * Update test.yml --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * tcfControl: enforce publisher restrictions (#14856) * tcfControl: enforce publisher restrictions * guard against empty consentData * Build system: add strict type check during compilation and fix several types (#14879) * Build system: add strict type check during compilation and fix several types * lint * skip type check on development builds --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Prebid 11.12.0 release * Increment version to 11.13.0-pre * Docs: add pgamdirectBidAdapter.md (missing companion to #14763) + note GVL 1353 (#14887) * Add pgamdirectBidAdapter.md (missing module overview + GVL 1353) * Update TCF to v2.3 per @patmmccann review * Clarify COPPA forwarding (per codex review) * Fix mangled maintainer email — replace email-obfuscation placeholder with real address * Optimera RTD Module: Add pagelevel array to window (#14789) * added feature for window.optimera.pagelevel to be accessible * updated spec file to include use case where pagelevel is not in score file * fix linting error --------- Co-authored-by: Sami <sbeig@optimera.nyc> * Make all properties in VideoMediaType optional, as specified in the docs (#14889) * Core: further clean up of adpod from the code base (#14890) * Removed adpod from the code base * Remove some more adpod occurrences from the code base * Build system: add linting on imports (#14892) * add import linting * eslint --fix * fix imports * fix pageInfosUtils tests * fix hadron, imu * lint the linting update * only try different extensions for code extensions * New adapter: Anzu SSP (#14894) * new adapter * bidder code changed * js to ts * Update adapter: Selectmedia (#14867) * new adapter: selectmedia * make region param required * define region base on timezone * pgamdirectBidAdapter: enrich meta, usersync, telemetry hooks (#14796) * Add pgamdirect Analytics Adapter Companion to modules/pgamdirectBidAdapter.ts (merged #14763). Publishers install this alongside the bid adapter to forward auction telemetry to the PGAM Direct SSP backend. Forwards four Prebid events, deliberately narrow: AUCTION_END — competitor CPMs seen in the auction BID_WON — Prebid-layer winner + price AD_RENDER_SUCCEEDED — client-confirmed impression AD_RENDER_FAILED — with reason (exception / timeout / etc) The value add over a server-side-only ledger: client-confirmed render vs. "RTB said we won", plus visibility into what other bidders priced the same auction at (we own server-side data for our own DSP calls, but not for the ones other SSPs made through the same Prebid wrapper). Payload is normalised into a small fixed shape before POST — we deliberately drop the raw Prebid event args, which carry full FPD / user.eids / custom bidder params that we don't need and shouldn't exfiltrate. Sink: https://app.pgammedia.com/api/analytics-events (one POST per event; content-type text/plain to keep CORS simple). Config: pbjs.enableAnalytics({ provider: 'pgamdirect', options: { orgId: '<pgam org id>', // required endpoint: 'https://...' // optional override } }); GVL ID 1353 (PGAM Media LLC, same as the bid adapter). Tests: 12 covering registration, orgId validation, and the pure normalise transform across all 4 forwarded event types (including the 20-entry bidders_seen cap and filter-out of bidders with no code). Event-emission path is not covered in this spec because the sinon mock + AnalyticsAdapter async queue interact oddly in the test harness — we export normalise() directly so the transform is verifiable without the full event pipeline. The ajax call itself is covered by upstream AnalyticsAdapter base-class tests. * pgamdirectAnalytics: address Codex review on #14778 Two P1s flagged by Codex on the initial commit: 1. ad_unit_code semantic inconsistency Original code pulled ad_unit_code from args.adUnitCode on BID_WON but from args.adId on AD_RENDER_*, so the same field represented different identifiers across event types. In auctions with multiple ad units (or repeated wins from the same bidder), this prevented reliable win → render reconciliation and could misattribute render outcomes. Fix: render events now read ad_unit_code from args.bid.adUnitCode (stable across the BID_WON ↔ AD_RENDER_* join for the same slot). adId moves to its own field `ad_id` so per-bid traceability is preserved. Type definition updated with a comment explaining the split so future contributors don't re-conflate them. 2. Missing fetch keepalive Prebid AGENTS.md §71 requires low-priority telemetry calls to set fetch keepalive. Without it, BID_WON + AD_RENDER_* events emitted near page unload get dropped before reaching the endpoint — and those are exactly the events that fire in that window. Added `keepalive: true` to the ajax call. Prebid's ajax helper already supports the flag (src/ajax.ts option); no adapter-side polyfill needed. Tests: +1 spec case covering "missing bid object on AD_RENDER_* still captures ad_id cleanly." Existing render-event assertions updated to verify the ad_unit_code-vs-ad_id split explicitly. 13/13 pass (was 12). * pgamdirectBidAdapter: enrich meta, usersync, telemetry hooks Brings the adapter in line with tier-1 bidders (PubMatic, IX, Magnite, Insticator) and closes gaps that Kueez / Rise don't cover: - getUserSyncs: prefer iframe, fall back to pixel; forward gdpr, gdpr_consent, us_privacy, gpp, gpp_sid so the server-side /rtb/v1/usersync endpoint can consent-gate the cookie correctly. - bidResponse meta: populate advertiserDomains, primaryCatId + secondaryCatIds, networkName / networkId (from seatbid.seat), brandId / brandName / agencyId / buyerId / demandSource (reads both snake_case and camelCase from bid.ext.meta), and pass through ORTB 2.6 dsa + dchain blocks. Downstream ad servers (AdX, Amazon Publisher Services) reject bids without advertiserDomains, so this directly lifts fill. - imp hook: set imp.displaymanager = 'Prebid.js' and imp.displaymanagerver = $prebid.version$ on every imp. Some DSPs shape bids on these fields; matches pubmatic/conversant/oms convention. - onBidWon: fire a win pixel from bid.ext.pgam.winurl (or bid.nurl as fallback), with ${AUCTION_PRICE} / ${AUCTION_ID} macro replacement. Swallows errors so a bad URL can't break the page. - onTimeout: fire a pixel to /rtb/v1/metrics/timeout with tmax + auction so publisher-side tmax misses show up on our Grafana. Spec adds 6 new describe blocks (getUserSyncs, bidResponse meta enrichment, imp displaymanager, onBidWon, onTimeout). 42/42 green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * pgamdirect: Phase 3 hooks (billable/render/PAAPI) + Codex P1 fix Codex review on commit ed8f408 flagged one P1 against the analytics adapter; addressed alongside three adapter enhancements that close the remaining hook gap vs tier-1 bidders (APS, Yandex, Vidazoo). Analytics: - normalise(BID_WON) now emits ad_id (Prebid's per-bid adId). Prior revision only had it on AD_RENDER_*; on refresh-heavy pages multiple wins share the same ad_unit_code so reconciliation by slot name alone is ambiguous. Addresses Codex P1 review. Bid adapter: - onBidBillable — fire pixel to /rtb/v1/metrics/billable with cpm / auction / adid when Prebid counts the bid as billable. Billable ≠ bid-won (ad-server can still swap in house ads); keeping the counters separate is how APS / Yandex / Vidazoo report fill. - onAdRenderSucceeded — fire pixel to /rtb/v1/metrics/render with adid / auction so we can subtract render failures (captured on the analytics side via EVENTS.AD_RENDER_FAILED) from inventory KPIs and flag misbehaving creatives to blocklist. - interpretResponse PAAPI passthrough — when the bidder returns response.ext.paapi, surface it as { bids, paapi } so the Chrome Privacy Sandbox / Protected Audience API flow works when the publisher enables it in wrapper config. Accepts both bidId and impid as the correlation key; filters entries with no config. Tests: - pgamdirectBidAdapter_spec.js: +11 tests. onBidWon / onTimeout now stub triggerPixel to assert on URL + macro replacement (the old tests only asserted no-throw, leaving some branches uncovered). New describe blocks for onBidBillable, onAdRenderSucceeded, and PAAPI passthrough. 53/53 green. - pgamdirectAnalyticsAdapter_spec.js: BID_WON test asserts ad_id carries through (verifies the Codex P1 fix). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * pgamdirect: low-priority telemetry via fetch + keepalive (Codex P1) Codex review on 4b56ccf flagged that onBidBillable + onAdRenderSucceeded used triggerPixel, violating AGENTS.md §Review guidelines: "Low priority calls should be import ajax method and use fetch keepalive; they shouldn't use trigger pixel when it can be avoided or fail to specify keepalive." The practical cost: pixel requests are first-to-drop on navigation / unload — which is exactly when billable + render telemetry fires. Dropped events undercount the KPIs this change is trying to fix, so the reviewer is right. - Add sendBeacon() helper: fetch(url, { method: 'GET', keepalive: true }) with a catch-all that swallows errors. Pattern matches kargo sendTimeoutData + amx onTimeout + startioBidAdapter. - Swap triggerPixel → sendBeacon on onTimeout, onBidBillable, and onAdRenderSucceeded (the three hooks that fire our own metrics). - Keep triggerPixel on onBidWon — that call targets the DSP's nurl / winurl from the bid response, which is an OpenRTB-contract ImageBeacon and DSPs expect pixel semantics there. Not our telemetry, not ours to change to fetch. - Spec tests updated to stub window.fetch instead of utils.triggerPixel for the three hooks, and to assert keepalive=true on the init arg. 53/53 green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * pgamdirectAnalytics: Phase 4.2 — runner-up POST on AUCTION_END Paired change to the bidder-edge's new /rtb/v1/shading/record ingestion endpoint. When an AUCTION_END payload carries a pgamdirect winner AND at least one competitor bid on the same adUnit, we POST the competitor's highest CPM (the runner-up) plus the cell signature from bid.ext.pgam.shade to the bidder-edge. The backing Store learns per-cell runner-up distributions so a future Part B activation can shade our outbound bid down toward the runner-up + headroom, capturing the margin delta between "what our DSP bid into us" and "what we needed to bid into Prebid to win." Implementation: - maybePostShading() exported for testability. Groups bidsReceived by adUnitCode, identifies pgam winners per-adUnit (multi-imp safe), computes runner-up as max non-pgam CPM on that adUnit. - Skips when: <2 bids, no pgam winner, no ext.pgam.shade (bidder-edge didn't populate it), or runner-up is 0 (one-bidder auction — no signal for us). - Uses ajax() with text/plain content-type (CORS-simple, no preflight) and keepalive:true per AGENTS.md. - Wrapped in try/catch — a malformed AUCTION_END payload can't take down the main analytics POST that runs alongside it. Spec: 7 new tests covering the happy path, multi-adUnit split, missing-winner skip, missing-shade skip, one-bidder skip, and malformed-input tolerance. 19/19 green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * pgamdirect: drop duplicate getUserSyncs; apply prior commit's missed renames Two getUserSyncs definitions in the bid adapter spec object — the ext.cookies reader silently shadowed the consent-passthrough version. Removed the dead one and its test block; kept the version that matches our PBS yaml and /rtb/v1/usersync endpoint. Also applying the SHADING_ENDPOINT -> AUCTION_CONTEXT_ENDPOINT (and related) renames the prior commit's message described but didn't actually ship — those edits were made in the working tree before the upstream merge but got overwritten during conflict resolution when upstream's version of the analytics file was checked out. Comment trim pass while in there. --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * CriteoId: Add typescript types through a .d.ts file (#14902) * Add typing for criteo id system * Improved the typings a bit further * Changed criteo to criteoId in the UserId and ProvidersToId interfaces * Adelerate Bid Adapter: initial release (#14854) Co-authored-by: Djole <djole@Djole.local> * Attekmi: rename Adinify to Adlywise (#14910) Co-authored-by: Victor <victor.banudz@smart-hub.io> * Core: export more types (#14915) * export more types * fix comment * debugging module: Added type definitions (#14911) * Added type definitions for the debugging module * Make intercept property optional * Allow null to drop a bid * Movingup Bid Adapter: add standalone adapter, drop nexx360 alias (#14855) Promotes movingup from a nexx360 alias to its own bidder modeled on mtcBidAdapter, with dedicated endpoint, storage namespace, spec, and docs. Co-authored-by: Gabriel Chicoye <gabriel@macbookrogab24g.lan> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * New adapter: haloads (#14901) * haloads initial addition * review comments * resolved content type comments and build error * updated nurl handler * mileAdapter revert --------- Co-authored-by: Ritesh Ghodrao <riteshghodrao@Riteshs-MacBook-Air.local> * Prebid 11.13.0 release * Increment version to 11.14.0-pre * Core: remove promise param lint exception in auctionmanager spec (#14735) * add new integer-valued keys to mobian rtd module (#14917) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Patrick McCann <patmmccann@gmail.com> Co-authored-by: universe <88066680+chinaAdministrator@users.noreply.github.com> Co-authored-by: zepeng.yin <zp.yin@foxmail.com> Co-authored-by: Prebid.js automated release <prebidjs-release@prebid.org> Co-authored-by: Filip Stamenkovic <filip.stamenkovic@showheroes-group.com> Co-authored-by: Abdou <40374175+disparate1@users.noreply.github.com> Co-authored-by: Filipe Neves <me@filipeneves.net> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: MarinaZhuravlevaCriteo <m.zhuravleva@criteo.com> Co-authored-by: sumit-shark <sumit.kamble@ic.gumgum.com> Co-authored-by: Luca Corbo <lucor@scientiamobile.com> Co-authored-by: jasonc721 <jasonc721@gmail.com> Co-authored-by: Jason Crane <jasoncrane@microsoft.com> Co-authored-by: Intenze Support <devops@intenze.co> Co-authored-by: sarthakshah <sarthakshah2810@gmail.com> Co-authored-by: Patrick McCann <pmccann@cafemedia.com> Co-authored-by: eknis <tem.eknis@gmail.com> Co-authored-by: adquery <89853721+adquery@users.noreply.github.com> Co-authored-by: Adrian Dzida <a.dzida@openmobi.pl> Co-authored-by: PGAMDSP <103131000+mastap150@users.noreply.github.com> Co-authored-by: Antonio Gargaro <38767071+AntonioGargaro@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: thenexusengine <ops@thenexusengine.io> Co-authored-by: StreetsDigital <45595449+StreetsDigital@users.noreply.github.com> Co-authored-by: Gabriel Chicoye <gabriel.chicoye@gmail.com> Co-authored-by: Gabriel Chicoye <gabriel@macbookrogab24g.lan> Co-authored-by: quietPusher <129727954+quietPusher@users.noreply.github.com> Co-authored-by: mderevyanko <mderevyanko24@gmail.com> Co-authored-by: Shashank Pradeep <101392500+shashankatd@users.noreply.github.com> Co-authored-by: Anna Yablonsky <annay@perion.com> Co-authored-by: Anna Yablonsky <annay+perion@perion.com> Co-authored-by: derdeka <derdeka@users.noreply.github.com> Co-authored-by: GoAdserver <jan@goadserver.com> Co-authored-by: Blazo <blazo@goadserver.com> Co-authored-by: john-bauzon-gumgum <john.bauzon@gumgum.com> Co-authored-by: supreez <60138999+supreez@users.noreply.github.com> Co-authored-by: Erik Svilich <erik.svilich@gmail.com> Co-authored-by: Developer <developer@example.com> Co-authored-by: cortex-tech <dev@cortextech.it> Co-authored-by: Cortex Dev <dev@cortexch.it> Co-authored-by: 12q1 <42697100+12q1@users.noreply.github.com> Co-authored-by: pigeoon-tech <destek@pigeoon.com> Co-authored-by: OSMAN YAVUZ PİŞKİN <osman.piskin01@outlook.com> Co-authored-by: v0idxyz <58184010+v0idxyz@users.noreply.github.com> Co-authored-by: mihanikw2g <92710748+mihanikw2g@users.noreply.github.com> Co-authored-by: Denis Anoykin <aden@asteriosoft.com> Co-authored-by: jsnellbaker <31102355+jsnellbaker@users.noreply.github.com> Co-authored-by: Hendrick Musche <107099114+sag-henmus@users.noreply.github.com> Co-authored-by: MaksymTeqBlaze <maksym.pavliv@teqblaze.com> Co-authored-by: cpcpn-emil <115714010+cpcpn-emil@users.noreply.github.com> Co-authored-by: Eric Poul <31760529+EricPoul@users.noreply.github.com> Co-authored-by: Erik Poul <erik.poul@mgid.com> Co-authored-by: SmartHubSolutions <87376145+SmartHubSolutions@users.noreply.github.com> Co-authored-by: Victor <victor.banudz@smart-hub.io> Co-authored-by: szhang-str <159489278+szhang-str@users.noreply.github.com> Co-authored-by: Shuhao <shuhao.qgg.zhang@gmail.com> Co-authored-by: mohanjpAtmd <101256106+mohanjpAtmd@users.noreply.github.com> Co-authored-by: JP Mohan <jpmohan@MacBook-Pro-9.local> Co-authored-by: robin-crazygames <robin@crazygames.com> Co-authored-by: teqblaze <162988436+teqblaze@users.noreply.github.com> Co-authored-by: tzwierzchowski <102951000+tzwierzchowski@users.noreply.github.com> Co-authored-by: tososhi <ca01736@cartahd.com> Co-authored-by: yosei-ito <ca01423@cartahd.com> Co-authored-by: himu62 <ca00732@cartahd.com> Co-authored-by: himu <himu62@users.noreply.github.com> Co-authored-by: bjorn-lw <32431346+bjorn-lw@users.noreply.github.com> Co-authored-by: Minebomber <Minebomber@users.noreply.github.com> Co-authored-by: mdusmanalvi <72804728+mdusmanalvi@users.noreply.github.com> Co-authored-by: Sami Beig <31363470+SamiBeig@users.noreply.github.com> Co-authored-by: Sami <sbeig@optimera.nyc> Co-authored-by: anzuprebid <prebid@anzu.io> Co-authored-by: selectmediaPrebid <prebid@selectmedia.asia> Co-authored-by: Djole <dd@umcar…

new alias nuclion

bd7fc49

This was referenced Apr 23, 2026

Limelight New Adapter: Nuclion prebid/prebid.github.io#6542

Open

New Adapter: Nuclion - Limelight Alias prebid/prebid-server#4751

Open

Merge branch 'master' into limelight-nuclion

7728215

review-assignment-bot Bot requested a review from robertrmartinez April 24, 2026 08:11

patmmccann approved these changes Apr 24, 2026

View reviewed changes

patmmccann merged commit b9356c8 into prebid:master Apr 24, 2026
102 checks passed

oleksandrhn-code pushed a commit to DimaIntentIQ/Prebid.js that referenced this pull request Apr 28, 2026

new alias nuclion (prebid#14783)

29b5ec8

Co-authored-by: mderevyanko <mderevyanko24@gmail.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Limelight: New alias Nuclion#14783

Limelight: New alias Nuclion#14783
patmmccann merged 2 commits into
prebid:masterfrom
ProjectLimelight:limelight-nuclion

quietPusher commented Apr 23, 2026 •

edited

Loading

Uh oh!

patmmccann commented Apr 23, 2026

Uh oh!

quietPusher commented Apr 24, 2026

Uh oh!

coveralls commented Apr 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

quietPusher commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Type of change

Description of change

Other information

Uh oh!

patmmccann commented Apr 23, 2026

Uh oh!

quietPusher commented Apr 24, 2026

Uh oh!

coveralls commented Apr 24, 2026

Coverage Report for CI Build 24879280164

Coverage remained the same at 96.411%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

quietPusher commented Apr 23, 2026 •

edited

Loading