Skip to content

upstream-sync: sync Prebid.js 11.28.0 → 11.29.0 - #113

Merged
khang-vu-ttd merged 16 commits into
masterfrom
prebid-sync-11.29.0
Aug 14, 2026
Merged

upstream-sync: sync Prebid.js 11.28.0 → 11.29.0#113
khang-vu-ttd merged 16 commits into
masterfrom
prebid-sync-11.29.0

Conversation

@openads-sync-bot

@openads-sync-bot openads-sync-bot Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Prebid.js Sync: 11.28.011.29.0

📊 Run summary

This PR was auto-generated by the Sync with Upstream Prebid.js workflow.
Prebid 11.29.0 Release Page

Upstream diff: prebid/Prebid.js@11.28.0...11.29.0

✅ Applied Commits

  • f43032926 | Tests: eliminate dead code #15447
  • 677017db6 | Copper6SSP Adapter Update: temporary override until GVL 1356 deviceStorageDisclosureUrl is updated #15427 (auto-resolved)
  • a01d74dd5 | Core: start net timer at request dispatch #15433
  • 6a4bcd994 | DevTools MCP module: initial release #15356
  • facedb3b9 | Tests: TripleLift E2E Tests #15191
  • 6165c5083 | AdPlus ID System: add storage disclosure metadata #15460
  • 4951c6ea5 | Vidazoo bidder: resubmit utility changes #15455 (auto-resolved)
  • 08cb3c5 | Prebid Version Update (OpenAds Upstream Sync Bot)
  • 6f9900ab5 | Various Bid Adapters: use user sync COPPA argument #15454 (bid adapter change) (only modules/rubiconBidAdapter.js's COPPA-source change cherry-picked as a post-sync follow-up; all other adapters in this commit not shipped, teqblazeUtils change not applicable since no shipped adapter currently uses it)

⏭️ Skipped Commits

These commits were intentionally skipped because they made changes to files matching BidAdapter:

  • bdf6c983e | Increment version to 11.29.0-pre (unneeded changes)
  • ef8817bdd | VISX Bid Adapter: Added support for TID #15445 (bid adapter change)
  • a2e9d6608 | feat: add LunamediaHB bidder adapter with updated parameters and registration #15099
  • 56fbd5f68 | OCM Bid Adapter: improve user syncing and request timeout handling #15410 (bid adapter change)
  • 298adb4f8 | Yieldmo: Potential fixes for 4 code quality findings in tests #15448
  • 0e3699865 | HyperBrainz Bid Adapter: new adapter #15405 (bid adapter change)
  • 2306f4b44 | Ocm bid adapter: code quality findings #15468 (bid adapter change)
  • f806cbb4c | Synapse HX Bid Adapter : initial release #15331 (bid adapter change)
  • f8feaa94c | Prebid 11.29.0 release (will cause merge conflicts)

❌ Conflicting Commits (require manual resolution)

Post Sync Commits

  • a0291a8 | Rubicon Bid Adapter: use ORTB2 regs.coppa instead of config.getConfig('coppa') (post-sync follow-up to #15454)
  • 8ac6404 | Tests: rename pbjs global to oajs in TripleLift E2E test page and spec (post-sync follow-up to #15191) -- the new triplelift_banner.html/basic_banner_ad.spec.js used the raw upstream pbjs global instead of this fork's renamed oajs global, so the real library instance never received requestBids(), causing all 4 E2E browser jobs to fail identically
  • 721cff9 | Docs: fix devtoolsMcp.md example to use the oajs global instead of pbjs (post-sync follow-up to #15356) -- docs-only, found during the same renaming sweep
  • 3f076e7 | Tests: exclude triplelift_banner E2E spec (post-sync follow-up to #15191) -- tripleliftBidAdapter is not shipped in this fork (dropped by 3140c2f); the renaming fix alone wasn't sufficient since the module bundle itself 500s, so the spec is excluded from the E2E suite via wdio.shared.conf.js
  • 2247e13 | Tests: delete triplelift_banner E2E spec instead of excluding it (post-sync follow-up to #15191)
  • 1c3599a | Tests: remove orphaned triplelift fake-server infra and page (post-sync follow-up to #15191)

patmmccann and others added 8 commits August 14, 2026 20:30
* Apply suggested fix to test/spec/unit/core/bidderFactory_spec.js from Copilot Autofix

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

* Apply suggested fix to test/spec/unit/core/bidderFactory_spec.js from Copilot Autofix

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
…orageDisclosureUrl is updated (#15427)

* temporary override until GVL 1356 deviceStorageDisclosureUrl is updated

* revert to npx gulp update-metadata change

---------

Co-authored-by: Anna Yablonsky <annay+perion@perion.com>
* Core: start net timer at request dispatch

The net timer started before the method switch, so gzip compression time
was counted as network time on the endpointCompression path. Move it into
the ajax dispatch so net measures only the HTTP call on every path.

* Core: widen doAjax payload type to match ajax
* DevTools MCP Module: make integration optional

* DevTools MCP Module: address review feedback

* DevTools MCP Module: define tool interfaces

* DevTools MCP Module: namespace tools by global

* DevTools MCP Module: test custom globals

* DevTools MCP Module: inject dependencies via folder module

Refactor the module so the core logic performs no direct imports of
Prebid internals; every dependency is injected through a DevToolsDeps
interface, mirroring debugging/debugging.js.

- devtoolsMcp/index.ts: entry point, resolves deps from src and calls install()
- devtoolsMcp/devtoolsMcp.ts: dependency-free core (makeDevTools/install)
- Route getEvents and config.getConfig through the already-injected
  getGlobal(), reducing injected deps from 10 to 8
- Convert the module from a single file to a folder so there is no
  file/folder name collision under modules/

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* DevTools MCP Module: drop redundant prebid_ tool-name prefix

Tools are already namespaced by the Prebid global name, so the extra
prebid_ segment was redundant. Tool names are now <global>_summary,
<global>_auctions, and <global>_events.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* DevTools MCP Module: aggregate tools across Prebid instances

Rework the discovery/install path so multiple Prebid instances on a page
are all usable, instead of only whichever loaded last.

- Track instances in a single window global (__prebidDevToolsMcp): an
  array of per-instance handlers that also marks whether the discovery
  listener is installed, replacing the per-globalName map and the
  separate installed flag.
- Install the discovery listener once (first instance to load), and
  register a single, un-namespaced set of tools that no longer depend on
  the Prebid global variable name.
- Add a layer of indirection: tool execute() resolves the handlers from
  the window global at run time rather than closing over one instance.
- Aggregate results across all instances: concatenated summaries, a
  flattened auction list, and an event history ordered by elapsedTime
  whose limit selects the most recent records across the combined
  history (not per instance).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* DevTools MCP Module: filter and tag results by Prebid instance

Give each registered Prebid instance an identifier and expose it through
the tools.

- Identify each instance by its global variable name when the build
  defines a global (getGlobalVarName), otherwise a synthetic unnamed-<n>;
  store it alongside the handlers in the __prebidDevToolsMcp registry.
- Tag every result row (summary, auction, event) with its source
  instance id.
- Add an optional `instance` parameter to all three tools to restrict
  results to a single instance.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* DevTools MCP Module: drop redundant cacheTTL from summary

The summary already includes the full config snapshot, which contains
the minBidCacheTTL / minTargetedBidCacheTTL settings, so the separate
cacheTTL object was duplicated data. Removing it makes the
getMinBidCacheTTL and getMinTargetedBidCacheTTL dependencies unnecessary.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Core: load DevTools MCP module on demand via standalone bundle

Let Prebid pull in the devtoolsMcp module automatically when it is not
compiled into the build, mirroring the debugging module.

- Add modules/devtoolsMcp/standalone.js and a devtoolsMcp-standalone
  entry to the (renamed) webpack.standalone.js build config.
- Add src/devtoolsMcp.js: loads the standalone bundle and installs it
  with the core dependencies when debugTurnedOn() and navigator.webdriver
  are both true (i.e. running under automation with debug on). Wired into
  prebid.ts.
- Extract the common on-demand load/install/handshake logic shared with
  the debugging loader into src/standaloneModuleLoader.js, and refactor
  src/debugging.js to use it.

Verified end to end via Chrome DevTools MCP: the module auto-loads, is
discovered through the devtoolstooldiscovery event, and its summary tool
runs through execute_3p_developer_tool.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* DevTools MCP Module: rewrite docs around agent prompts

Reorient devtoolsMcp.md to its primary audience - someone inspecting
Prebid through an agent driving Chrome DevTools. Lead with the on-demand
usage (debug on + automated browser, no build step required) and example
prompts, condense the per-tool breakdown, and demote build inclusion to
an optional section. Also drop the stale note about a per-global
registration guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* always include devtoolsmcp in tests

* DevTools MCP Module: load whenever debug is on

Drop the navigator.webdriver requirement from the on-demand load
trigger. The standalone module now loads whenever debugging is turned
on (via ?pbjs_debug=true or pbjs.setConfig({debug:true})), rather than
only under an automated browser.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* DevTools MCP Module: document experimental third-party tools setup

Chrome third-party developer tools are still experimental, and an agent
will not discover page-provided tools on its own. Document that, besides
starting the MCP server with --categoryExperimentalThirdParty=true, the
agent must be pointed at the chrome-devtools-mcp third-party developer
tools guide so it knows to call list_3p_developer_tools /
execute_3p_developer_tool. Both are expected to become unnecessary once
the feature is generally available.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Hello world

* Revert "Hello world"

This reverts commit c8b8334f72a173c467c1c94e440230900802a252.

* Update bundle.js

* added triplelift fake responder

* prebid_js; nvm use; gulp lint;

* test

* First working response

* adding our ad

* Update response.json

* Update description.md

* Create basic_banner_ad.spec.js

* Update tripleliftBidAdapter.js

* Update basic_banner_ad.spec.js

* Update description.md

* Update fake-responder.js

* Update basic_banner_ad.spec.js

* Update basic_banner_ad.spec.js

* Update basic_banner_ad.spec.js

* Update basic_banner_ad.spec.js

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Update basic_banner_ad.spec.js

* Update basic_banner_ad.spec.js

* finished tests

* update

* Update tripleliftBidAdapter.js

* Update request.json

* refactor fake-server for multiple fake responders

* added stub

* add a static dir to fake-server

* Update triplelift-ttj.js

* Update makeResponder.js

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
* resubmit utility changes

* adding tests that were changed

* adding tests that were changed

* fixing copper6 tests

* fixing shinez tests

* more coverage, removed redefined function from tests

* linter fix

* optional fild stays optional

* adding missing use of ursl in spec

* replacing triggerPixel with ajax for all related urls

---------

Co-authored-by: Anna Yablonsky <annay+perion@perion.com>
@github-actions

Copy link
Copy Markdown
Contributor

Whoa there partner! This project is migrating to typescript. Consider changing the new JS files to TS, with well-defined types for what interacts with the prebid public API (for example: bid params and configuration). Thanks!

  • modules/devtoolsMcp/standalone.js
  • src/devtoolsMcp.js
  • src/standaloneModuleLoader.js

@github-actions

github-actions Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

This PR introduces changes that may not work on all browsers. According to Babel, the following polyfills may be needed, and they are not automatically included:

  • Changes to libraries/intentIqUtils/detectBrowserUtils.ts may need:
    • es.iterator.constructor
    • es.iterator.map
    • es.iterator.some
    • esnext.iterator.constructor
    • esnext.iterator.map
    • esnext.iterator.some
  • Changes to libraries/intentIqUtils/gamPredictionReport.ts may need:
    • es.array.push
    • es.iterator.constructor
    • es.iterator.filter
    • es.iterator.find
    • es.iterator.for-each
    • esnext.iterator.constructor
    • esnext.iterator.filter
    • esnext.iterator.find
    • esnext.iterator.for-each
  • Changes to libraries/intentIqUtils/getRefferer.ts may need:
    • web.url-search-params.delete
    • web.url-search-params.has
    • web.url-search-params.size
  • Changes to libraries/intentIqUtils/storageUtils.ts may need:
    • es.iterator.constructor
    • es.iterator.filter
    • es.json.stringify
    • esnext.iterator.constructor
    • esnext.iterator.filter
    • esnext.json.parse
  • Changes to libraries/intentIqUtils/urlUtils.ts may need:
    • es.json.stringify
  • Changes to modules/devtoolsMcp/devtoolsMcp.ts may need:
    • es.array.push
    • es.iterator.constructor
    • es.iterator.filter
    • es.iterator.find
    • es.iterator.flat-map
    • es.iterator.map
    • es.iterator.reduce
    • es.json.stringify
    • esnext.iterator.constructor
    • esnext.iterator.filter
    • esnext.iterator.find
    • esnext.iterator.flat-map
    • esnext.iterator.map
    • esnext.iterator.reduce
    • esnext.json.parse
  • Changes to modules/devtoolsMcp/standalone.js may need:
    • es.iterator.constructor
    • es.iterator.for-each
    • esnext.iterator.constructor
    • esnext.iterator.for-each
  • Changes to modules/intentIqAnalyticsAdapter.ts may need:
    • es.array.push
    • es.json.stringify
    • web.dom-exception.stack
  • Changes to modules/intentIqIdSystem.ts may need:
    • es.iterator.constructor
    • es.iterator.for-each
    • es.json.stringify
    • esnext.iterator.constructor
    • esnext.iterator.for-each
  • Changes to test/fake-server/makeResponder.js may need:
    • es.iterator.constructor
    • es.iterator.filter
    • es.iterator.map
    • es.json.stringify
    • esnext.iterator.constructor
    • esnext.iterator.filter
    • esnext.iterator.map
    • esnext.json.parse
  • Changes to test/fake-server/responders/appnexus.js may need:
    • es.iterator.constructor
    • es.iterator.for-each
    • esnext.iterator.constructor
    • esnext.iterator.for-each
  • Changes to test/spec/devtoolsMcp_spec.js may need:
    • es.iterator.constructor
    • es.iterator.map
    • es.iterator.some
    • esnext.iterator.constructor
    • esnext.iterator.map
    • esnext.iterator.some

The best way to address this is to provide good test coverage, as normal PR checks run unit tests on older browsers.

eyvazahmadzada and others added 2 commits August 14, 2026 13:47
* convert all iiq js files to ts

* update version, ts fixes

* fix test and lint issues

* fix lint issues

* no ab group in browserblacklist (#87)

* no ab group in browserblacklist

* fix lint issues

* remove isblacklisted logic from request

* small fix

* add tests

---------

* small fixes

* update version

---------

Co-authored-by: Eyvaz Ahmadzada <eyvazahmadzada@gmail.com>
Co-authored-by: Eyvaz <eyvaz@intentiq.com>
* Core: apply analytics provider config once in AnalyticsConfig

AnalyticsConfig applied AnalyticsProviderConfig[P] twice - spread at the top
level, and again under `options`. Providers declare `options` in their own
entry, so the two applications nested it under itself: AnalyticsConfig<'generic'>
demanded `options.options`, and no natural config satisfied it. The `options`
clause now uses the option type the provider declared, so both applications
agree.

Publishers were unaffected because enableAnalytics accepted `any`, added while
working towards a build that does not need skipLibCheck. Drop it; the parameter
is no longer reassigned, and Array.isArray replaces isArray, which arrives
untyped from utils.js and cannot narrow.

test/types/analyticsConfig.ts records the expectations for tsc to check. The
@ts-expect-error directives hold in both directions - an unused directive is an
error - so the build fails whether the type becomes too strict or too loose.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Core: type enableAnalytics against each provider's declared options

intentIqAnalyticsAdapter, pgamdirectAnalyticsAdapter and terceptAnalyticsAdapter
each describe the options they take, but never declared them in
AnalyticsProviderConfig, so nothing that reads a publisher's configuration knew
about them. Augment all three.

That made AnalyticsConfig<keyof AnalyticsProviderConfig> instantiate with a union
of four providers rather than one. AnalyticsProviderConfig[P] appears twice in
AnalyticsConfig - spread at the top level, and under `options` - and each
distributes over that union on its own, so the two cross-multiply and `options`
becomes one provider's options intersected with another's. Completions for
`options` already showed it, listing every provider's keys whichever provider was
named. SomeAnalyticsConfig maps over the declared providers instead, which builds
the same union without instantiating with one; completions now follow the
provider that was named.

Where the registry hands a configuration back to its adapter, the provider name
it is keyed by has erased the tie between the two, hence the assertion there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* IntentIq Analytics Adapter: correct the declared type of additionalParams

`additionalParams` was declared as a map of names to values. The adapter reads it
as an array of parameters, each naming itself and carrying the destinations it
should be sent with, which is also how the module's documentation describes it.

Declaring the options in AnalyticsProviderConfig makes this type the one
publishers are checked against, so the two have to agree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Core: keep the shared analytics options available to every provider

The base adapter reads `options.sampling` whatever the provider, but the declared
options of a provider that has them replaced the whole bag, so `sampling` was
rejected for every provider except the one that happened to declare
`DefaultOptions` in its own entry. Intersect it in the config type, where the
adapter that consumes it lives, rather than leaving each provider to remember.

The expectation is stated against tercept: generic declares `DefaultOptions`
itself, so it would hold either way.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* PGAM Direct Analytics Adapter: require orgId

The adapter forwards nothing without `orgId`, and its documentation calls it
required, but the declared type left it optional - so a configuration missing it
type checked while doing nothing at runtime.

The interception that validates it takes a partial, since it reads what the
publisher passed rather than what the configuration type asks for.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Patrick McCann <patmmccann@gmail.com>
@khang-vu-ttd

Copy link
Copy Markdown
Contributor

Conflicting commits resolved

a0b513148 — CI: classify PR files as core by component ownership (#15444)

Upstream split getPRProperties.js's "is this file core?" logic out into a new coreFiles.js. Neither script is referenced by any workflow in this fork — the only workflow that used getPRProperties.js upstream is PR-assignment.yml (upstream's own community PR auto-triage/labeling bot), which this fork has never carried (not in our .github/workflows/ list, no git history for either script here). With both files unused, resolving the modify/delete conflict (git rm on the "theirs" version) and removing the newly-added coreFiles.js left an empty diff — resolved with git cherry-pick --skip.

9244b9f54 — Agt 632 migrating modules to type script (#89) (#15436)

Straight JS→TS port of the IntentIq library/module family (intentIqUtils, intentIqConstants, intentIqIdSystem, intentIqAnalyticsAdapter) — 21 files, mostly clean renames. The one real conflict was in libraries/intentIqUtils/gamPredictionReport.ts: our fork's targeting-key renaming (hb_adidoa_adid) collided with upstream's TS retyping of the same expression. Resolved by keeping our renamed oa_adid key with upstream's new TS cast ((element.args as any).adId). Swept the rest of the migrated files for any other un-renamed hb_/pbjs references — found none.

8ca3ef5d2 — Core: fix analytics provider configuration types (#15467)

Merged cleanly (src/adapterManager.ts auto-merged, new test/types/analyticsConfig.ts added).

@khang-vu-ttd

Copy link
Copy Markdown
Contributor

Post-sync fix: TripleLift E2E test used the wrong global (root cause of the E2E failures)

All 4 browser E2E jobs (Chrome, Firefox, msedge, Safari) failed identically on test/spec/e2e/triplelift_banner/basic_banner_ad.spec.js, added by facedb3b9 (#15191). Root cause: the new test/pages/triplelift_banner.html and its spec companion used the raw upstream pbjs global (var pbjs = pbjs || {}, window.pbjs.adUnits[...]), but this fork's library only exposes itself as window.oajs (package.json's globalVarName). Every other established E2E page in this fork uses oajs — this pair was simply never swept for the rename. Since the page's pbjs.que.push(...) callback registered against a global the real library never populates, requestBids() never fired, leaving adUnits/bids undefined in the test and no ad ever rendering — a deterministic bug, not flakiness (confirmed by all 4 browsers failing identically).

Fixed in 8ac640455: renamed the global in both files to match the established oajs convention (mirrors test/pages/banner.html exactly).

While re-sweeping the full Applied section for this same class of gap, also found modules/devtoolsMcp.md (new module from 6a4bcd994/#15356) showing a literal invocation example pbjs.setConfig({ debug: true }) — same fix needed, docs-only. Fixed in 721cff95d.

…191)

tripleliftBidAdapter is not shipped in this fork (dropped by 3140c2f),
so the new triplelift_banner E2E spec bundles a module that doesn't exist
here (?modules=tripleliftBidAdapter 500s) and can never pass.
…t-sync follow-up to #15191)

Removes the spec file itself now that it's confirmed unrunnable in this
fork (tripleliftBidAdapter not shipped), and reverts the now-unnecessary
wdio.shared.conf.js exclude entry.
…nc follow-up to #15191)

Now that the triplelift_banner E2E spec is gone, remove the fake-server
responder/fixtures/static asset and test page it exclusively used, and
drop the now-dead references to them in test/fake-server/index.js,
bundle.js, and README.md.
@khang-vu-ttd

Copy link
Copy Markdown
Contributor

Follow-up: deleted the unrunnable spec instead of excluding it, plus removed its orphaned infra

Per discussion, went further than the initial exclude-based fix:

  • 2247e13fd — deleted test/spec/e2e/triplelift_banner/basic_banner_ad.spec.js outright (root cause: tripleliftBidAdapter isn't shipped in this fork — dropped by 3140c2f0c — so ?modules=tripleliftBidAdapter 500s and this spec can never pass here), and reverted the now-unnecessary wdio.shared.conf.js exclude entry.
  • 1c3599a36 — removed the fake-server responder/fixtures/static asset and test page that spec exclusively used (test/fake-server/responders/triplelift.js, test/fake-server/fixtures/triplelift/, test/fake-server/static/triplelift-ttj.js, test/pages/triplelift_banner.html), and dropped the now-dead references to them in test/fake-server/index.js, bundle.js, and README.md.

@khang-vu-ttd
khang-vu-ttd merged commit 7f76a4d into master Aug 14, 2026
103 checks passed
@khang-vu-ttd
khang-vu-ttd deleted the prebid-sync-11.29.0 branch August 14, 2026 23:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants