Core: optionally drop retained auction data

[patmmccann]

Goal here is to continue stalled #15267 which hasn't made recent progress yet is known to be quite helpful

cc @bbaresic

Motivation

• Reduce long-lived memory and identity retention by removing request-only fields from auctions once callbacks complete while preserving the event payloads consumed by analytics and late-bid flows.
• Make the change opt-in to avoid breaking downstream consumers and allow publishers to opt into more aggressive cleanup via config rather than forcing behavioral changes.
• Preserve required video/outstream metadata so late-arriving video bids and caching behavior remain correct.
• Address reviewer code comments about analytics snapshots, S2S userId leakage, duplicate USP listener registration, and cookie-capability caching.

Description

• Add a new config flag auctionOptions.cleanupAuctionData (default false) to gate dropping request-only fields after auction callbacks; implemented in src/auction.ts with dropRetainedRequestFields() to remove ortb2, userId, userIdAsEids, params, mediaTypes, RTD, and similar fields while retaining necessary video context/useCacheKey and renderer when present.
• Snapshot analytics payloads before debounce in libraries/analyticsAdapter/AnalyticsAdapter.ts by deep-cloning arrays and bid-like objects so debounced analytics always see the original data at event time (BID_TIMEOUT, BID_RESPONSE, NO_BID, AUCTION_INIT coverage added/updated in tests).
• Add guardTids cleanup and use-scoped guarding around buildRequests/validate paths in src/adapters/bidderFactory.ts so TID proxy caches do not leak; also add clear() for the memoized proxy cache.
• Remove raw userId from S2S copies in src/adapterManager.ts to avoid leaking publisher-side userId in server-side payloads.
• Deduplicate USP registerDeletion listener registration in modules/consentManagementUsp.ts so the event listener is registered at most once and reset on resetConsentData().
• Only cache successful cookie capability checks in src/storageManager.ts so transient failures do not poison future checks; expose canSetCookie.clear() for tests.
• Tests: add/update unit tests to cover opt-in cleanup, default retention, analytics snapshot behavior for BID_TIMEOUT, and S2S/userId handling (changes in test/spec/auctionmanager_spec.js, test/spec/AnalyticsAdapter_spec.js, test/spec/unit/core/adapterManager_spec.js, plus small updates elsewhere).

Testing

• Linted changed files with npx eslint --cache --cache-strategy content <files> and the lint pass completed successfully.
• Ran targeted unit tests with npx gulp test --nolint --file test/spec/AnalyticsAdapter_spec.js, npx gulp test --nolint --file test/spec/auctionmanager_spec.js, npx gulp test --nolint --file test/spec/modules/consentManagementUsp_spec.js, and npx gulp test --nolint --file for the updated unit specs; all executed specs passed locally.
• Verified git diff --check returned clean and staged the changes; changes were committed locally as the branch update (PR creation step not available in this environment).

---

Codex Task

[github-actions]

This PR introduces changes that may not work on all browsers. According to Babel, the following polyfills may be needed, and they are not automatically included:

• Changes to modules/axonixBidAdapter.js may need:
  • es.iterator.for-each
  • esnext.iterator.for-each
• Changes to test/spec/modules/consentManagementUsp_spec.js may need:
  • es.iterator.constructor
  • es.iterator.filter
  • esnext.iterator.constructor
  • esnext.iterator.filter

The best way to address this is to provide good test coverage, as normal PR checks run unit tests on older browsers.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa58abae1f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[barecheck]

Barecheck - Code coverage report

Total: 91.17%

Your code coverage diff: 0.01% ▴

Uncovered files and lines

File	Lines
libraries/analyticsAdapter/AnalyticsAdapter.ts	60, 224-226
modules/axonixBidAdapter.js	79, 150
modules/consentManagementUsp.ts	77, 165, 205-206, 262
src/adapterManager.ts	280, 366, 377, 723, 726, 733-734, 804, 859, 890-891, 908, 935, 939, 954, 958, 970, 1037-1038
src/adapters/bidderFactory.ts	491-493, 595-596, 604, 618, 681-682, 686-687, 715-716
src/auction.ts	368, 463-464, 474-475, 490, 499, 502, 552, 554, 564, 588, 886, 970, 972, 978, 1023, 1162, 1197
src/config.ts	88-89, 146, 193, 397, 464, 477-478, 523-524, 637
src/storageManager.ts	91-92, 271, 278