upstream-sync: sync Prebid.js 11.25.0 → 11.26.0 - #110
Merged
Conversation
![null[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Bumps [axios](https://github.com/axios/axios) from 1.16.0 to 1.18.1. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.0...v1.18.1) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.9.3 to 5.10.1. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.1) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.10.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.5 to 1.20.6. - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) --- updated-dependencies: - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.16 to 7.5.21. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.16...v7.5.21) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.21 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Core: fpd validation library * tests rework * changing to ts * fpdValidation renaming * type fix * moving validation from bid interception to debugging initial start * deepClone check * moving to startAuction hook * Core: inject fpd validation utils from call sites Convert libraries/fpdUtils/validateFpd into an fpdValidator factory that takes logWarn/isNumber/isEmpty/deepAccess as injected dependencies instead of importing from src/utils. Callers wire the deps: - validationFpdModule imports them from src/utils - debugging uses logger.logWarn (debug-prefixed) with utils for the rest Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Core: guarantee startAuction fpd validation never breaks the auction Wrap validateOrtb2Fragments in a try/catch in the debugging startAuction hook so next() is always called with the original request even if reading or validating req.ortb2Fragments throws. Add tests covering that the hook never mutates req.ortb2Fragments and always forwards the request to next, including when a throwing getter forces an exception. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * too many types * Core: make fpd validation warning wording configurable The fpdValidator warnings say "Filtered ...", which is accurate for validationFpdModule (it removes invalid data) but misleading for debugging, which validates a clone and never alters the request. Add a `filtered` option (default true) that switches the wording to "Invalid" when the caller does not modify the data; debugging opts into it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Core: move fpd validation cloning into fpdValidator Since fpdValidator knows via the `filtered` option whether it is filtering data or only generating warnings, let it own the decision to modify the input. When `filtered` is false it now validates against an internally-made clone (via an injected deepClone dep) and returns the original untouched; when true it returns the filtered result as before. The debugging caller no longer clones or threads deepClone through validateOrtb2ForDebug. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Core: rename fpdValidator 'filtered' option to 'filter' Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Core: throw when fpdValidator filter is false without deepClone A validator asked not to filter but given no deepClone cannot inspect data without risking mutation, so fail loudly instead of silently doing nothing. Update the library and debugging tests that expected a no-op to expect a throw. In the auction flow this surfaces through the startAuction hook's try/catch, so next is still called. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Core: remove Topics API handling * Potential fix for pull request finding 'Superfluous trailing arguments' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * Potential fix for pull request finding 'Superfluous trailing arguments' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * Potential fix for pull request finding 'Superfluous trailing arguments' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * Potential fix for pull request finding 'Superfluous trailing arguments' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * Deprecate topicsHeader in BidderSettings interface Add deprecation notice for topicsHeader option. * Update bidderSettings.ts --------- Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
…13761) * Add GPP consent information to the DFP video url * Adjust bidViewaiblity for GPP * Replaced gpp_string with gpp now that the parameter is officially documented * Added test which checks for presence of gpp * Fix linting problem * Remove unused formatQS import from gamAdServerVideo.js --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> Co-authored-by: Patrick McCann <pmccann@cafemedia.com>
* New Module: DAA AdChoices Signal Adds the adChoices module (modules/adChoices.ts), which reads the DAA AdChoices Signal in the browser via the Protect My Choices (PMC) extension postMessage protocol (ExtensionLoaded -> GetAdPreferences -> AdPreferences) and conveys it in the OpenRTB bid stream as the community extension regs.ext.adchoices, per Appendix 5 of the DAA AdChoices Signal Specification. - Standalone `adChoices` config namespace; supports a static `signal` override (takes precedence) and an opt-in `timeout`. Non-blocking by default; when a positive timeout is set, the first auction is delayed up to that many ms while waiting for the signal (the window starts when an auction begins waiting and applies once, so later auctions are not re-delayed). - Injects the value via the FPD enrichment hook, matching the consent modules. - TypeScript public types (AdChoicesConfig); 20 unit tests. * AdChoices Signal Module: add repo-side module docs Adds modules/adChoices.md with an overview, example `adChoices` config (`signal` and `timeout`), and the resulting `regs.ext.adchoices` bid-request output, per reviewer request. * AdChoices Signal Module: address review feedback - Remove the requestBids hook (and clear the installed flag) in resetAdChoicesData so the hook does not leak onto the global requestBids across test runs, and can be reinstalled after a reset. Adds a test that sets a timeout, resets, and asserts the hook is gone. - Reformat modules/adChoices.md to the repo-side `# Overview` convention (Module Name / Module Type / Maintainer); the page_v2 frontmatter remains in the docs PR. --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com>
* Update eightpod bid and analytics adapters * Address burl review comment and fix nurl for adunit rendering * Skip blank tracker URLs before emitting pixels
* WURFL RTD: report configurable caps in beacon via wurfl_caps Report a configurable set of WURFL capabilities in the analytics beacon under a new wurfl_caps object, instead of only the hard-coded wurfl_id * WURFL RTD: keep wurfl_id in beacon when caps omit it Inject wurfl_id into wurfl_caps when beacon.cap_indices does not include it, so the beacon always carries a WURFL identifier regardless of backend configuration. Add a spec for a beacon cap set without wurfl_id. * WURFL RTD: cover defensive and LCE branches in tests Add unit tests for previously untested branches: storage/async-load fallbacks, FPD enrichment edge cases, empty numeric coercion, missing caps array, additional LCE user-agent parsing (iOS 26, iPadOS 26, versionless Android, Android tablets, ChromeOS, Tizen, Roku, PlayStation), sampling, consent-class edges, the statsHost override, invalid URL handling, and the fetch fallback. * WURFL RTD: reset per-auction beacon state to prevent stale wurfl_caps
* Allow post-install for realTimeData module could we do the same (prebid/Prebid.js#11214) for rtdModules? * RTD Module: initialize providers registered after configuration `postInstallAllowed` lets provider bundles register through `submodule('realTimeData', ...)` after Prebid has booted, but `attachRealTimeDataProvider` only added them to the registry - it never rebuilt the active submodule list. A provider registering after `setConfig({realTimeData})` was therefore never initialized and never ran, which is the case the flag is meant to support. Registration now runs `initSubModules`. `init` results are memoized per provider, so a late registration does not re-initialize the ones already running - providers that do not expect a second `init` are unaffected. Registering a name that is already taken is ignored. Providers enabled after configuration announce themselves individually; the startup message still lists those available at configuration time. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * RTD Module: make provider de-registration a standalone export `attachRealTimeDataProvider` returned a closure that unregisters the provider. Nothing in production ever calls it - only tests do - but as an escaping value no bundler could prove it unreachable, so the code shipped in every build. Replace it with an exported `detachRealTimeDataProvider(submodule)`. Being a named export that no other module references, it is dropped by tree shaking: `splice`, `indexOf` and `Map.delete` disappear from the minified rtdModule chunk, which goes from 3749 to 3656 bytes. Note this changes the contract of `attachRealTimeDataProvider`, which no longer returns anything. The returned closure was only ever reachable for providers registered after startup, since `submodule()` returns the installer's value only on the post-install path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* override Copper6 adapter * fix * name fix * fix name of types * some additional explanation in types * adding some clarity to the md file about bids ext object * adding map for legacy params to support publishers that use old params for copper6ssp bid adapter * lint fixes * FIX - Validate legacy params before normalizing them * FIX - Preserve legacy params in the exported type --------- Co-authored-by: Anna Yablonsky <annay+perion@perion.com>
…ip (#15326) * resolve qid synchronously without backend round-trip * add test * fall back to generateUUID when crypto is unavailable * Discard stored qid longer than 36 characters and regenerate * Remove docs for params.url/params.urlArg, no longer used --------- Co-authored-by: Adrian Dzida <a.dzida@openmobi.pl>
* remove use of bid.userId; use right schain object; tests adjustment; * remove use of bid.userId; use right schain object; tests adjustment; fixing import * removing tests for deprecated bid.userId that is not mapped in v10 and v11 * name fix * lint fix * fixing params support in urls * fixing Propagate the new tracking URLs onto bids * fxing paste error in tests --------- Co-authored-by: Anna Yablonsky <annay+perion@perion.com>
This reverts commit 30cce05c3fb8f3c136357a97528ff56f3d8400f6.
…(#15049) * Core: escape tracking pixel URLs in HTML attributes * Core: avoid double-escaping tracker query separators (#15325) * Core: avoid double-escaping tracker query separators (#15327) - Tracker image URLs coming from ad markup or XML can already contain HTML-entity encoded separators like `&`, and passing them through the existing encode+escape path produced `&amp;` in emitted HTML which breaks server-side parameter parsing. - Add a small helper `decodeAmpersandEntities(url)` that converts existing `&` back to `&` before encoding. - Normalize URLs by calling `encode(decodeAmpersandEntities(url))` inside `createTrackPixelHtml` so already-encoded query separators are not double-escaped. - Add a unit test in `test/spec/utils_spec.js` that asserts `createTrackPixelHtml` preserves `&` separators in emitted `src` for an input URL containing `&`. - Fix nearby missing semicolons in `test/spec/utils_spec.js` to satisfy linting for the changed file. - Ran lint on the changed files with `npx eslint src/utils.js test/spec/utils_spec.js --cache --cache-strategy content` and it passed for the final change set. - Ran the targeted unit tests with `npx gulp test --nolint --file test/spec/utils_spec.js` and the test chunk completed successfully (`185 tests completed`). * Kimberlite Bid Adapter: fix nurl pixel test expectation (#15338) * TrustX Bid Adapter: fix tracking URL test assertion (#15337) * Adkernel Bid Adapter: fix banner nurl pixel test (#15339) * Core: preserve tracking pixel URL behavior (#15390) --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
Contributor
|
Whoa there partner! This project is migrating to typescript. Consider changing the new JS files to TS, with well-defined types for what interacts with the prebid public API (for example: bid params and configuration). Thanks!
|
Contributor
|
This PR introduces changes that may not work on all browsers. According to Babel, the following polyfills may be needed, and they are not automatically included:
The best way to address this is to provide good test coverage, as normal PR checks run unit tests on older browsers. |
Contributor
|
This PR includes an adapter whose code does not match its file name. Bid adapter modules should be named |
Contributor
|
Resolved the conflict on `a538b462a` (CI: don't lint the whole repo when the changed-file list is empty, `#15396`) by keeping our side entirely — `.github/workflows/linter.yml` already has an equivalent fix (`xargs -r` + the same empty-file `echo '[]'` guard) plus an additional early-exit `if: steps.diff.outputs.has_changes == 'true'` condition upstream doesn't have. The resolved file came out byte-identical to what we already had, so the cherry-pick was skipped as empty rather than committing a no-op. |
The DAA AdChoices Signal module (#15138) shipped its config example using upstream's pbjs naming, missing this fork's established rename applied to every other module doc.
The Copper6 adapter itself (modules/copper6sspBidAdapter.js/.md and its spec) is intentionally dropped from this fork, matching the *BidAdapter* skip pattern. This new .d.ts file slipped through the auto-resolved cherry-pick as a clean add despite its .js sibling never existing here, tripping eslint's prebid/declaration-filename rule (a declaration file must have a corresponding .js file).
Contributor
|
Fixed the `Run linter` failure (`1ead28346`): the Copper6 adapter itself (`copper6sspBidAdapter.js`/`.md` + spec) is intentionally dropped from this fork, but this new `.d.ts` declaration file slipped through the auto-resolved cherry-pick (`c86964ffc`) as a clean add despite its `.js` sibling never existing here — tripping eslint's `prebid/declaration-filename` rule. Removed it. |
The identity-manager-gating tests' idPayload.providers.id5id.expiryTime was computed once when Mocha registers the describe block, not per test run -- on a slow/loaded CI runner deep into a large chunk, enough wall-clock time can pass between suite registration and this specific test executing for the frozen expiryTime to have already lapsed, causing getId() to correctly (but unintentionally) treat the stored ID as expired. Reproduced on both SafariNative and Browserstack Safari (different versions), chunk 5 of 8, consistently across retries; passed cleanly in Chrome locally where the chunk runs fast enough that this never surfaces. Moved the expiryTime computation into beforeEach so it's stamped fresh immediately before each test runs, removing the fragility rather than just widening the window.
Contributor
|
Fixed `734a51f05`: the Safari-only `permutiveCombined_spec.js` failures reported earlier were caused by `idPayload.providers.id5id.expiryTime` being computed once at `describe`-block registration time (`Date.now() + 10000`), not per-test — on a slow/loaded CI runner deep into a large chunk (this was chunk 5 of 8, 1275 tests), enough wall-clock time can pass between suite registration and this specific test executing for the frozen expiry to have already lapsed, causing `getId()` to correctly (if unintentionally) treat the stored ID as expired. Reproduced consistently on both SafariNative and Browserstack Safari; passed cleanly in Chrome locally where the chunk runs fast enough to never hit this. Moved the `expiryTime` computation into `beforeEach` so it's stamped fresh immediately before each test runs, removing the fragility rather than just widening the window. Verified 48/48 passing locally afterward. |
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prebid.js Sync:
11.25.0→11.26.0📊 Run summary
This PR was auto-generated by the Sync with Upstream Prebid.js workflow.
Prebid 11.26.0 Release Page
✅ Applied Commits
⏭️ Skipped Commits
These commits were intentionally skipped because they made changes to files matching
BidAdapter:❌ Conflicting Commits (require manual resolution)
Post Sync Commits