Skip to content

Commit 6ad07f0

Browse files
DimaIntentIQChucky-choopatmmccannprebidjs-releasedependabot[bot]
authored
Merge branch tcf race condition (#83)
* Matterfull Bid Adapter: initial release (#14922) * Matterfull Bid Adapter: initial release * Matterfull Bid Adapter: fix endpoint * Matterfull Bid Adapter: make params.env field required * AnzuDSP Bid Adapter: initial release (#14924) * AnzuDSP Bid Adapter: initial release * AnzuDSP Bid Adapter: make params.env field required * Bliink: Remove GVL_ID from bliinkBidAdapter.js (#14949) * Remove GVL_ID from bliinkBidAdapter.js * Delete gvlid exposure test from bliinkBidAdapter_spec Removed test case for exposing gvlid. * RhythmOne Adapter: remove lint exception for size parsing (#14765) * RhythmOne Adapter: remove lint exception for size parsing * Marsmedia Bid Adapter: remove coffee-style lint suppression (#14771) * Core: fix typos in reducers comments (#14768) * Marsmedia Bid Adapter: remove coffee-style lint suppression * Update marsmediaBidAdapter.js * Prebid 11.14.0 release * Increment version to 11.15.0-pre * Bump tmp from 0.2.4 to 0.2.6 (#14953) Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.4 to 0.2.6. - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](https://github.com/raszi/node-tmp/compare/v0.2.4...v0.2.6) --- updated-dependencies: - dependency-name: tmp dependency-version: 0.2.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * SSPF-3301: Kargo Adapter: use gppString for GPP consent (fix Prebid API) (#65) (#14954) * Kargo Adapter: use gppString for GPP consent (fix Prebid API) * remove comment Co-authored-by: Julian Gan <juliangan07@gmail.com> * Core: complete enforcement of accessRequestCredentials (#14935) * Core: fix bug with accessRequestCredentials not controlling access to request credentials * keep shallow copying in abtshieldIdSystem * remove unused function * lint * Fix firefox losing keepalive flag * Use module name in bidder's ajax * add withCallers plumbing * Build-time determination of moduleType/moduleName * fix undetermined callers * fix undetermined callers * fix multi-gvlid that are not asking for credentials * fix adapterManager tests * fix adelerate tests * fix asterio tests * chunk 3 test fixes * chunk 4 test fixes * chunk 4 test fixes * Chunk 5 test fixes * chunk 6 fixes * chunk 7 test fixes * chunk 8 test fixes * remove redundant hasDeviceAccess check * lint * Potential fix for pull request finding 'Semicolon insertion' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * Potential fix for pull request finding 'Semicolon insertion' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * Potential fix for pull request finding 'Semicolon insertion' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * Improve comments --------- Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Core: fix bug where hb_cache_host is sometimes not set to the right host (#14806) * TNE Catalyst Bid Adapter: optional params + ortb2 passthrough (#14941) Combines the AMX-style permissive-params refactor with full ortb2.* passthrough so the adapter integrates with a single '{ bidder: tne_catalyst }' entry while honouring everything the wrapper already populates. Permissive params (AMX-style) - All bid params optional. isBidRequestValid accepts a bid with no params; rejects bids with wrong-typed values via a nullOrType helper. - slot defaults to bid.adUnitCode and is mirrored into imp.tagid. - site.publisher.id omitted when no override; exchange resolves publisher from site.domain via sellers.json. - New optional params.endpoint and params.testMode (the latter is resolved per-imp so individual placements can be marked as test). ortb2 passthrough - ortb2.user / regs / device / app flow through to the outbound. - bid.userIdAsEids still read and merged with ortb2.user.eids (de-duped by source). - Per the module rules, wrapper-set fields are authoritative; derived signals (gdprConsent, uspConsent, gppConsent) only fill gaps the wrapper hasn't already populated. site / app mutex - OpenRTB 2.6 §3.2.1: site and app are mutually exclusive. When ortb2.app is present, site is omitted entirely; publisherId stamps onto app.publisher.id. Site is also omitted when no site fields would be populated. schain - Read from ortb2.source.ext.schain (Prebid 9.x normalized location) with fallback to ortb2.source.schain (OpenRTB 2.6 top-level) and finally legacy bid.schain for older wrapper builds. Outbound goes on source.schain so modern adapters don't need to ext-fish. 101 tests passing. Co-authored-by: thenexusengine <250033251+thenexusengine@users.noreply.github.com> * Core: migrate from deprecated GPT getTargeting/setTargeting to getConfig/setConfig (#14816) * Core: migrate from deprecated GPT getTargeting/setTargeting to getConfig/setConfig * use gptUtils/setKeyValue instead of setPageTargeting when possible; fix incorrect test setup * update types * lint * Add methods to fetch entire targeting map * Update relaido to use getTargetingMap methods * update relaido to use getTargetingMap methods * Update src/utils/gptTargeting.ts Co-authored-by: derdeka <derdeka@users.noreply.github.com> * update mock data to use arrays --------- Co-authored-by: derdeka <derdeka@users.noreply.github.com> * Removed alias from appnexus and add it to microsoft adapter (#14965) Co-authored-by: Andy <arezitopedia@gmail.com> * 51Degrees RTD: enrich ORTB with IP/geo, 51DiD eids, preference/TCF/GPP consent forwarding (#14914) * 51Degrees RTD: enrich ORTB with IP/geo, 51DiD eids, and PMP-aware id.usage Adds device.ip/ipv6/geo from the cloud ip vendor, a 51d.es user.eids entry from fodid, and id.usage forwarding sourced from module params or PMP localStorage. * configure PMP in the example * proper casing * improve example with debug bids * set device.geo.region * reload PMP button * correct shape of user.eids[].uids * guard publisher set device.ip * warn on legacy ext.fiftyonedegrees_deviceId write The module writes the 51Degrees device id to both ortb2.device.ext.fod.deviceId (canonical) and ortb2.device.ext.fiftyonedegrees_deviceId (legacy mirror kept for adapters that read the older path, e.g. gumgumBidAdapter). Emit a one-shot logWarn the first time the legacy mirror is written so adapter authors can spot the duplication and migrate. Output is unchanged. * populate geo if locationconfidence is high/medium also set correct ipservice value * 51Degrees RTD: forward TCF/GPP consent strings to the cloud as evidence * update doc * update doc and remove params.idUsage * update configurator link * fix lint errors * migrate consumers to ext.fod.deviceId (formerly fiftyonedegrees_deviceId) --------- Co-authored-by: YaroslavVlasenko <yaroslavvlasenko@gmail.com> Co-authored-by: James Rosewell <james@51degrees.com> * Acxiom's realid userID prebid module (GCD-559) (#14948) * Add Acxiom Real ID Submodule to User ID system * Update Acxiom Real ID Submodule to use POST requests with JSON payload and simplify API URL handling * Simplify Acxiom Real ID Submodule by removing unused log prefix and redundant logInfo calls * Update Acxiom Real ID API endpoint * Refactor Acxiom Real ID Submodule to handle stored IDs and improve decode logic * Expand Acxiom Real ID Submodule to enforce consent-based suppression and add GPP (US privacy) handling * Update Acxiom Real ID to delete tokens with all suffixes for better consent compliance * Update Acxiom Real ID to handle userAgent retrieval using `getWindowSelf` for improved compatibility * Add detailed typedefs for Acxiom Real ID configuration and parameters * Migrate Acxiom Real ID Submodule to TypeScript for improved type safety and module clarity --------- Co-authored-by: Rameez Israr <rameez@govassist.com> * Ogury Bid Adapter: add instream video support (#14962) * Vidazoo utils: Additional validation for request (#14952) * adding devicetype value validation to prevent errors from request in bidder * make a deep clone in order to validate value without changing device info in the initial object --------- Co-authored-by: Anna Yablonsky <annay+perion@perion.com> * Adnow & DistroScale Adapters: remove deleted GVL IDs (#14966) ### Motivation - The IAB vendor list marks GVL IDs `1210` and `754` as deleted, so adapters must not advertise those vendor IDs. - Keep adapter runtime behavior unchanged while preventing Prebid from registering deleted TCF vendors. - Ensure module metadata and per-module disclosure entries no longer reference deleted vendor IDs or disclosure URLs. ### Description - Remove the `GVLID` constants and the `gvlid` fields from `modules/adnowBidAdapter.js` and `modules/distroscaleBidAdapter.js` so adapters no longer expose `1210` or `754`. - Update generated metadata files `metadata/modules.json`, `metadata/modules/adnowBidAdapter.json`, and `metadata/modules/distroscaleBidAdapter.json` to set the corresponding `gvlid` values to `null` and clear `disclosures`/`disclosureURL` entries. - Preserve the `ds` alias for DistroScale and leave all other adapter behaviour and supported media types unchanged. ### Testing - Ran `npx eslint modules/adnowBidAdapter.js modules/distroscaleBidAdapter.js --cache --cache-strategy content` and it completed successfully. - Ran the adapter unit tests with `npx gulp test --nolint --file test/spec/modules/adnowBidAdapter_spec.js` and `npx gulp test --nolint --file test/spec/modules/distroscaleBidAdapter_spec.js` and both test runs passed. - Performed metadata validation and JSON parse checks (build-time GVL/metadata checks) and they passed without errors. * 🐛 Criteo Id System: store raw bidId values (#14973) Co-authored-by: v.raybaud <v.raybaud@criteo.com> * Core: add deprecated GPT targeting CodeQL check (#14967) * UnifiedId Adapter: add typed userId mappings (#14904) * UnifiedId Adapter: add typed userId mappings * UnifiedId Adapter: align tdid typing with runtime shapes * UnifiedId Adapter: require partner or url in types (#14961) --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Goldbach Bid Adapter: server-driven syncs and identity rework (#14925) * Goldbach Bid Adapter: Endpoint adjustment, server-side cookie sync * Goldbach Bid Adapter: adjusted consent check, player size tuple check * New Adapter: ferio (#14896) * Add ferio bid adapter * fix: isolate fallback response media type, include types * refactor: convert adapter and utilities to ts * refactor: rely on ORTB converter for request signals --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * fluct Bid Adapter: add device.ext.vpw/vph viewport size signals (#14957) * add instl support * falseの場合も明示的に送信するようにした * fluct Bid Adapter: allow wrapper to inject its name via x-fluct-prebid-wrapper header Read `fluct.wrapperName` from Prebid config and, when set, attach it as the `x-fluct-prebid-wrapper` HTTP header on every bid request so the fluct bidder can identify which wrapper the request originates from. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: move customHeaders construction outside _each loop Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: add device.ext.vpw/vph viewport size signals Pass viewport dimensions (vpw, vph) from ortb2.device.ext to the fluct server. Viewability prediction by DSPs uses viewport size to differentiate between screen size (w/h) and actual visible area, which directly affects bid prices. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: yosei-ito <ca01423@cartahd.com> Co-authored-by: himu62 <ca00732@cartahd.com> Co-authored-by: himu <himu62@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Core: Avoid keepalive for >64KiB request bodies and log warning (#14916) * Core: warn when keepalive is skipped for oversized payload * Potential fix for pull request finding 'Unused variable, import, function or class' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * use blob() to calculate size * Potential fix for pull request finding 'Semicolon insertion' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * lint * Fix firefox losing keepalive, not supporting body * Safari fix * update comment --------- Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * ResetDigital Bid Adapter: Forward user EIDs (#14975) * ResetDigital: Forward user EIDs * ResetDigital: Aggregate user EIDs * ResetDigital: Simplify EID forwarding * acxiomRtd: fix tests (#14974) * feat: add hubvisor analytics adapter (#14976) * Bump actions/github-script from 8 to 9 (#14980) Bumps [actions/github-script](https://github.com/actions/github-script) from 8 to 9. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v8...v9) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Aps Bid Adapter: map bidder metadata (#14977) * Core: bidDesirabilityAdjustment (#14860) * adding bidderDesirabilityAdjusments to bidderSettings * adding bid desirability sort to bidLimit path * adding bid desirability to reducers * sharing bidRequest between cpm and desirability adjustments * sortByDealAndPriceBucketOrDesirability * fixing multibid & removing bidRequest fallback --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * fluct Bid Adapter: add remaining missing bid request signals (#14958) * add instl support * falseの場合も明示的に送信するようにした * fluct Bid Adapter: allow wrapper to inject its name via x-fluct-prebid-wrapper header Read `fluct.wrapperName` from Prebid config and, when set, attach it as the `x-fluct-prebid-wrapper` HTTP header on every bid request so the fluct bidder can identify which wrapper the request originates from. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: move customHeaders construction outside _each loop Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: add remaining missing bid request signals Forward all outstanding signals from Prebid.js to the fluct server: Regulation/privacy: - regs.ext.dsa (Digital Services Act) — EU DSPs skip bids without it - regs.ext.gpc (Global Privacy Control) User attributes: - user.yob, user.gender, user.keywords — demographic/interest targeting - user.ext.data (all fields, not just im_segments) Site metadata: - site.name, site.search, site.publisher.domain Auction context: - refererInfo.canonicalUrl — more reliable than raw page URL - refererInfo.isAmp, reachedTop, numIframes — page environment signals - timeout — lets fluct server optimize response time - source.tid — auction-level transaction ID Floor model metadata: - floorData.modelVersion, location, floorProvider Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: fix guard inconsistencies found in code review - yob: use != null guard (consistent with gender) - numIframes: use != null guard so top-level pages (numIframes=0) are forwarded - site.publisher: gate on publisher object existence instead of domain, and forward id in addition to domain Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: remove floorData metadata fields Floor model metadata (modelVersion, location, floorProvider) has unclear server-side use. Removing to keep the PR focused; floor price itself (bidfloor/bidfloorcur) is already forwarded by existing code. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: fix duplicate instl assignment after rebase Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: remove extra blank line (lint fix) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: fix padded-blocks lint error in spec Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fluct Bid Adapter: remove CORS preflight by switching to text/plain Replace custom request headers with body fields to eliminate the ~400ms OPTIONS preflight on every bid request: - Remove Content-Type: application/json and custom headers (x-fluct-app, x-fluct-version, x-openrtb-version, x-fluct-prebid-wrapper) - Move adapter metadata to request body: - adapterVersion (was x-fluct-version) - wrapperName (was x-fluct-prebid-wrapper, set only when configured) - Default content type becomes text/plain (Prebid ajax default), which is a CORS simple request and requires no preflight Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Revert "fluct Bid Adapter: remove CORS preflight by switching to text/plain" This reverts commit 5c129058b1dfab4ab9fcb69aa376b474f96420df. --------- Co-authored-by: yosei-ito <ca01423@cartahd.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * Asterio Bid Adapter: Add native support (#14929) * Zeta Global Analytics Adapter: extra events (#14964) * Zeta Global SSP Analytics Adapter: track extra events * Zeta Global SSP Analytics Adapter: harden payload helpers and fallbacks Extract shared site-context, floor, mediaType, and device helpers so analytics events send complete fields (including auctionId on bidsReceived) with robust page/domain fallbacks and bounded bidder error payloads. Co-authored-by: Cursor <cursoragent@cursor.com> * Zeta SSP Analytics Adapter: code style fixes. --------- Co-authored-by: Cursor <cursoragent@cursor.com> * tcfControl: use the GVL to determine legal basis (#14979) * fetch purposes during build * Update metadata * include purpose metadata in adapters * add warning on bidders without p2 LI * add --no-fetch option to compile-metadata * add warning on undeclared flexible purposes * getPublicUrl * Update metadata * cleanup * Better purpose declaration warnings * do not double include purpose metadata * update metadata including specialFeatures * add build time validation * update tcfControl to check purpose declarations * lint * do not use intersection/difference * New Adapter: Vuukle Bid Adapter (banner, video, native) (#14981) * Build: remove unused @wdio/concise-reporter dev dependency (#14956) * IntentIq ID Module & Analytical Adapter: A/B percentage passing, CMP consent improvements (#14936) * AGT-817 Group change for module (#70) Co-authored-by: Alex <alex@MacBook-Pro-Alex.local> * AGT-843 Module documentation (#71) Co-authored-by: Alex <alex@MacBook-Pro-Alex.local> * AGT-751 AB% passing * Merge master into 0.36 (#75) * Remove gvlid from movingup bid adapter (#14749) * billow_rtb25: New adapter (#14690) * New adapter: billow_rtb25 * delete options * add public interface * Change the adapter type to a ts file --------- Co-authored-by: zepeng.yin <zp.yin@foxmail.com> * Prebid 11.7.0 release * Increment version to 11.8.0-pre * Showheroes Bid Adapter: rename showheroes bid adapter (#14644) * rename showheroes bid adapter * Showheroes: bring back old adapter * Impactify Bid Adapter: ensure compatible mediaType mapping (#14748) * Updated bid adapter to log errors * Remove onBidderError function and LOGGER_JS_URI Removed unused onBidderError function and LOGGER_JS_URI constant. * Apply suggestion from @Copilot Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix mediatypes * Add banner test * Add mediaType fallbacks --------- Co-authored-by: Filipe Neves <me@filipeneves.net> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * CriteoBidAdapter: Fix outstream video (#14753) * Update: Adding Device hardware version (hwv) in the adapter (#14757) * wurfl rtd: collect SUA via src/fpd/sua.js for high-entropy hints (#14758) Switch the SUA source from the bid request to direct calls to getHighEntropySUA from src/fpd/sua.js. This ensures wurfl.js and the analytics beacon receive high-entropy User-Agent Client Hints. Falls back to low-entropy SUA when high-entropy is unavailable (non-Chromium browsers, restrictive Permissions Policy). Refs prebid/Prebid.js#14574 * Msft Bid Adapter - Native request example in md updated to include eventtrackers (#14760) * Update msftBidAdapter.md * Minor update to the keyword format * Minor update to the keyword format * Update msftBidAdapter.md --------- Co-authored-by: Jason Crane <jasoncrane@microsoft.com> * Intenze Adapter: Europe support (#14658) * Intenze Adapter: Europe support * fix lint problem in intenzeBidAdapter.js * Bid Filter Module: Add option for bidResponseFilter handling for in-banner video on multi-format (#14542) * Add option for bidResponseFilter handling for in-banner video on multi-format * Format code for consistency in bidResponseFilter_spec.js --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> Co-authored-by: Patrick McCann <pmccann@cafemedia.com> * Core: fix typos in reducers comments (#14768) * IntimateMerger Analytics Adapter : initial release (#14726) * IntimateMerger Analytics Adapter : initial release * IntimateMerger Analytics Adapter : fix event overlap * IntimateMerger Analytics Adapter : refactoring * IntimateMerger Analytics Adapter : Update modules/imAnalyticsAdapter.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * IntimateMerger Analytics Adapter : Update waitTimeout Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * IntimateMerger Analytics Adapter : Update modules/imAnalyticsAdapter.js docs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * IntimateMerger Analytics Adapter : Update docs * IntimateMerger Analytics Adapter : cid optional --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Adquery Bid Adapter: userID usage refactor (#14692) * adquery_video_work9 * adquery_video_work9 * adquery_video_work9 * update onBidWon --------- Co-authored-by: Adrian Dzida <a.dzida@openmobi.pl> * New Bidder: PGAM Direct (#14763) * Add PGAM Direct bid adapter New SSP bidder (server-to-server, canonical OpenRTB 2.6) operated by PGAM Media LLC. Distinct from pgamssp (our legacy TeqBlaze-hosted adapter); we plan to migrate publishers from pgamssp to pgamdirect over 2026 and will submit a deprecation PR for pgamssp once migration completes. Both are actively maintained. GVL ID: 1353 Endpoint: https://rtb.pgammedia.com/rtb/v1/auction Media types: banner, video, native Supports: schain, TCF v2, USP, GPP, COPPA, EIDs, GPID, floors module, deals, first-party data 37 spec cases covering isBidRequestValid, buildRequests across banner video and native, multi-imp, consent forwarding for GDPR/USP/GPP/COPPA, EIDs and schain passthrough, interpretResponse across all media types including VAST XML/URL variants and native JSON parsing, malformed- input rejection, ext.meta merge, and metadata assertions. Coverage: 100% functions, 100% lines, 82% branches. * pgamdirect: address Codex review Three P1s from the Codex automated review: 1. Floors module integration — imp.bidfloor now comes from bid.getFloor() when the Floors module is enabled, falling back to params.bidfloor and then 0. Currency is carried from the Floors-returned currency, not hard-coded to USD. Resolves the regression where publishers on floor rules were silently sending their static params.bidfloor. 2. schain lookup precedence — buildSource() now reads ortb2.source.ext.schain first (the modern FPD path), falling back to the legacy bid.schain. Resolves the drop for publishers who configure schain through FPD rather than per-bidder params. 3. CORS preflight — removed the x-openrtb-version custom header. The request is now CORS-simple enough to avoid a browser preflight on every auction, reducing perceived auction latency by one RTT. Server accepts OpenRTB 2.6 as default regardless. Tests updated: 6 new cases covering the two P1 behaviour changes (getFloor used, fallback to params, fallback when getFloor throws, fallback to 0, currency preserved, ortb2 schain wins over bid.schain, bid.schain fallback when ortb2 empty). The removed "forwards schain from first bid" test is covered by the new "falls back to bid.schain" case. Existing CORS assertion updated to expect absent customHeaders. 43/43 tests green in Karma/ChromeHeadless. Lint clean. * pgamdirect: convert to TypeScript, use ortbConverter Addresses patmmccann review on #14763: - Convert pgamdirectBidAdapter.js → .ts with typed public interface. - Replace the hand-rolled imp/device/user/source builders with libraries/ortbConverter, keeping only the pgam-specific fields (imp.ext.pgam.orgId, imp.tagid from params.placementId, meta.networkName from seatbid.seat) as converter hooks. - Drop the contentType: 'application/json' header entirely — JSON is NOT a CORS-simple content-type, so setting it forces a browser preflight on every auction. Omitting it keeps the POST preflight-free (saves one RTT per request). The converter inherits Prebid's standard handling of: - priceFloors module (imp.bidfloor / bidfloorcur via bid.getFloor) - schain via FPD normalisation (source.ext.schain) - source.tid, user.eids, site/device/regs (GDPR, USP, GPP, COPPA) - media types (banner sizes → format[], video player size passthrough, native request serialisation) - bidResponse cpm/currency/ttl/netRevenue/mediaType/advertiserDomains So this change: - Removes ~200 lines of custom plumbing. - Means future ORTB spec updates (2.7, new privacy fields) flow through automatically when Prebid updates the converter. Also: - Register GVL ID 1353 on spec (PGAM Media LLC, registered with IAB). - Keep params.bidfloor as a legacy fallback when the priceFloors module has not populated imp.bidfloor. - Force at=1 (first-price) and cur=['USD'] via a request hook. Spec tests: trimmed to cover only the adapter-owned behaviour (isBidRequestValid, CORS-simple options, imp hook custom fields, request hook, bidResponse.meta.networkName, onBidWon). Library-owned behaviour (floors / schain / GDPR / media types / VAST parsing) is not re-asserted here; those are covered by ortbConverter's own specs and by every other adapter that uses it. 26/26 pass locally. * Core: remove deprecated wretry usage (#14772) * CI: replace wretry artifact flow with cache save/restore * CI: use artifact handoff without deprecated retry wrapper * Core: reduce allocations in metrics.getMetrics (#14769) * Core: cleanup adloader callback/listener references (#14767) * Core: tighten apntag shim typing (#14766) * Core: tighten apntag shim typing * Core: tighten apntag shim typing ### Motivation - TypeScript compilation failed when core code accessed `window.apntag.getTag().keywords` because `window.apntag` was typed as `any` and `getTag` returned `unknown` properties. - Provide a focused, maintainable shim for the `apntag` global so core targeting logic can rely on well-typed properties without losing runtime extensibility. ### Description - Added an `ApnTag` interface in `src/types/local/shim.d.ts` with explicit method signatures for `getTag`, `modifyTag`, `setKeywords`, `anq`, and `onEvent` and preserved an index signature for extra runtime fields (see `src/types/local/shim.d.ts` 【F:src/types/local/shim.d.ts†L7-L18】). - Typed `getTag` to return an object that may include `keywords` (`{ keywords?: Record<string,string> } | undefined`) so property access like `.keywords` is accepted by the TypeScript compiler. - Made the global `Window.apntag` optional (`apntag?: ApnTag`) to reflect pages where the integration is absent. ### Testing - Ran `npx eslint src/types/local/shim.d.ts --cache --cache-strategy content` which completed successfully. - Ran `npx gulp test --nolint --file test/spec/unit/core/targeting_spec.js` which completed successfully (all relevant tests passed). - Ran `npx tsc --noEmit` which completed successfully with no type errors. * Core: use window crypto reference for UUID random data (#14764) * Permutive RTD: iterate bidders configured via params.bidders (#14774) * Permutive RTD: iterate bidders configured via params.bidders Previously setBidderRtb only wrote ortb2 for the union of acBidders and Permutive's SSP list. A bidder declared under params.bidders with a customCohorts mapping was iterated only if it was also present in one of those lists, leaving publishers' configuration silently inert. Include Object.keys(params.bidders) in the iterated set so an explicit per-bidder customCohorts mapping is always honored. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Permutive RTD: type the public params interface Add a `.d.ts` declaring `PermutiveRtdProviderParams` / `PermutiveRtdProviderConfig` and wire them into the module via JSDoc typedef imports (follows the pattern from prebid/Prebid.js#14773). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * 51Degrees RTD: use highEntropySUAAccessor for HEV retrieval (#14746) * CI: add manual retry for artifact downloads (#14776) * Prebid 11.8.0 release * Increment version to 11.9.0-pre * Bump @xmldom/xmldom from 0.8.12 to 0.8.13 (#14779) Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.12 to 0.8.13. - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13) --- updated-dependencies: - dependency-name: "@xmldom/xmldom" dependency-version: 0.8.13 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump fast-xml-parser from 5.5.7 to 5.7.1 (#14780) Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.5.7 to 5.7.1. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.7...v5.7.1) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.7.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * aceex and yandex bidders: type the public interface (#14773) * Aceex Adapter: type public params via d.ts * Aceex/Yandex Adapter: refine bidder params typing * GPP control modules: add option to restrict more activities (#14762) * Core: add TCF 2.3 tcData coverage to consent tests (#14788) * New Bid Adapter: tne_catalyst (#14738) * New Bid Adapter: tne_catalyst * tne_catalyst: normalize video playerSize to handle flat [w,h] and nested [[w,h]] forms * tne_catalyst: use getFloor() for dynamic floors with currency passthrough, fallback to params.bidfloor * tne_catalystBidAdapter: convert to TypeScript and switch request to text/plain - Migrate adapter from JS to TS with typed BidderParams (per repo TS migration guidance). - Change request contentType from application/json to text/plain to avoid the CORS preflight that was flagged by CodeQL and noted in review. --------- Co-authored-by: StreetsDigital <45595449+StreetsDigital@users.noreply.github.com> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * pgamdirect: add getUserSyncs for cookie-sync pixel support (#14777) * pgamdirect: add getUserSyncs for cookie-based retargeting DSPs Follow-up to #14763. Our bid adapter previously declared no user- sync pixels, which blocked cookie-based retargeting DSPs from matching our users to their own — they need the browser-side sync step to correlate, and without it their bids come back heavily suppressed for "user not matched." Implementation routes sync URLs through the OpenRTB response from our bidder at `response.ext.cookies[]`. Each entry carries: { type: 'image' | 'iframe', url: string } The per-DSP sync URL list lives server-side (one entry per downstream DSP we integrate), so this adapter stays stable even as we add / rotate DSPs. Behaviour: - Empty serverResponses or no ext.cookies → return [] - Respects syncOptions.iframeEnabled / pixelEnabled (publisher- controlled — some publishers disallow iframe syncs) - Drops malformed entries (missing url or unknown type) - Caps at 5 pixels per response to avoid cookie floods Consent note: Prebid passes parsed GDPR / USP / GPP state, but we don't filter server-side. Each DSP's sync URL already encodes its own consent handling (appending ?gdpr=1&gdpr_consent=... as each requires). Future revision can add per-DSP consent framework declarations + server-side suppression if a DSP fails to register handling for the caller's framework. Tests: +6 spec cases covering empty, malformed, caps, and consent- driven filtering. 32/32 pass (was 26). * pgamdirect: remove in-adapter sync cap (address Codex review) Codex pointed out on #14777 that the hard-cap at 5 pixels bypassed Prebid's `userSync.syncsPerBidder` control in src/userSync.ts. Core already enforces the per-bidder sync limit based on publisher configuration; an additional cap inside the adapter silently drops valid sync URLs when a publisher raises the limit (or sets 0 = unlimited), reducing match coverage for downstream DSPs. Fix: remove the break on length >= 5 so getUserSyncs returns the full filtered list. Prebid core does the right thing from here. Updated the corresponding test to assert the full list comes back with a comment pointing to where the authoritative cap lives. 32/32 tests still pass. --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Nexx360 Utils Library: add shared getGzipSetting helper (#14781) * Nexx360 Utils Library: add shared getGzipSetting helper Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Gabriel Chicoye <gabriel@macbookrogab24g.lan> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Rename agenticAudienceAdapter to agenticAudienceRtdProvider (#14729) * Core: fix additional typo occurrences (#14770) * new alias nuclion (#14783) Co-authored-by: mderevyanko <mderevyanko24@gmail.com> * enable compression and remove callbacks (#14643) * Add pgamdirect Analytics Adapter (#14778) * Add pgamdirect Analytics Adapter Companion to modules/pgamdirectBidAdapter.ts (merged #14763). Publishers install this alongside the bid adapter to forward auction telemetry to the PGAM Direct SSP backend. Forwards four Prebid events, deliberately narrow: AUCTION_END — competitor CPMs seen in the auction BID_WON — Prebid-layer winner + price AD_RENDER_SUCCEEDED — client-confirmed impression AD_RENDER_FAILED — with reason (exception / timeout / etc) The value add over a server-side-only ledger: client-confirmed render vs. "RTB said we won", plus visibility into what other bidders priced the same auction at (we own server-side data for our own DSP calls, but not for the ones other SSPs made through the same Prebid wrapper). Payload is normalised into a small fixed shape before POST — we deliberately drop the raw Prebid event args, which carry full FPD / user.eids / custom bidder params that we don't need and shouldn't exfiltrate. Sink: https://app.pgammedia.com/api/analytics-events (one POST per event; content-type text/plain to keep CORS simple). Config: pbjs.enableAnalytics({ provider: 'pgamdirect', options: { orgId: '<pgam org id>', // required endpoint: 'https://...' // optional override } }); GVL ID 1353 (PGAM Media LLC, same as the bid adapter). Tests: 12 covering registration, orgId validation, and the pure normalise transform across all 4 forwarded event types (including the 20-entry bidders_seen cap and filter-out of bidders with no code). Event-emission path is not covered in this spec because the sinon mock + AnalyticsAdapter async queue interact oddly in the test harness — we export normalise() directly so the transform is verifiable without the full event pipeline. The ajax call itself is covered by upstream AnalyticsAdapter base-class tests. * pgamdirectAnalytics: address Codex review on #14778 Two P1s flagged by Codex on the initial commit: 1. ad_unit_code semantic inconsistency Original code pulled ad_unit_code from args.adUnitCode on BID_WON but from args.adId on AD_RENDER_*, so the same field represented different identifiers across event types. In auctions with multiple ad units (or repeated wins from the same bidder), this prevented reliable win → render reconciliation and could misattribute render outcomes. Fix: render events now read ad_unit_code from args.bid.adUnitCode (stable across the BID_WON ↔ AD_RENDER_* join for the same slot). adId moves to its own field `ad_id` so per-bid traceability is preserved. Type definition updated with a comment explaining the split so future contributors don't re-conflate them. 2. Missing fetch keepalive Prebid AGENTS.md §71 requires low-priority telemetry calls to set fetch keepalive. Without it, BID_WON + AD_RENDER_* events emitted near page unload get dropped before reaching the endpoint — and those are exactly the events that fire in that window. Added `keepalive: true` to the ajax call. Prebid's ajax helper already supports the flag (src/ajax.ts option); no adapter-side polyfill needed. Tests: +1 spec case covering "missing bid object on AD_RENDER_* still captures ad_id cleanly." Existing render-event assertions updated to verify the ad_unit_code-vs-ad_id split explicitly. 13/13 pass (was 12). * fix: add upstream_partner KV to GAM (#14743) Co-authored-by: Shashank <=> * Vidazoo adapter: support host bidder param (#14784) * align spec on all adapters that we manage; add coverage to libraries/vidazooUtils/bidderUtils.js; changes are backward-compatible * more coverage * more coverage for vidazoo bidder utilities * more coverage; utils function full coverage * remove comments * fix tests after the code removal in new master code: check of bidderRequest.paapi.enabled * fixing get headers * fixing single request * adding burl to createInterpretResponseFn * adding more tests for coverage * fixing latest changes to support the right data * fixing tests * fix missing map of a host param * fix missing map of a host param * adding test for the new data params map * adding type files for adapter to define params in bid object * code imp --------- Co-authored-by: Anna Yablonsky <annay+perion@perion.com> * Build System: replace source-map-loader with webpack native source-map loading (#14797) * Mtc Bid Adapter: initial release (#14782) * Nexx360 Utils Library: add shared getGzipSetting helper Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Mtc Bid Adapter: initial release Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Update mtcBidAdapter.ts Bid Params guard fix * Update mtcBidAdapter.md * Nexx360 Bid Adapter: make requestCounter assertion order-independent The shared module-level requestCounter in libraries/nexx360Utils is incremented by every consuming adapter, so when mtcBidAdapter tests run in the same chunk before nexx360 tests, the counter is no longer 0. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gabriel Chicoye <gabriel@macbookrogab24g.lan> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * New Bid Adapter - goadserver (#14701) * New Bid Adapter - goadserver Multi-tenant Prebid.js adapter for the goadserver platform. One bidder code ("goadserver") serves every deployment — publishers pass the deployment-specific host + SSP campaign token per ad unit via params.host and params.token. The adapter POSTs to https://{host}/openrtb2/auction (goadserver's Prebid Server-compatible endpoint) and supports banner, video, and native via ortbConverter. GVL ID is not yet registered with IAB Europe and is commented out in the adapter for now; will be populated once the TCF registration lands. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: use real maintainer email Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: support params.subid Emits an optional per-impression subid in imp.ext.goadserver.subid so goadserver can attribute bids to a sub-identifier (page section, article bucket, A/B test group, etc.) without requiring a separate HB campaign per variation. Server-side normalization strips unsafe characters and caps the length at 1024. Test coverage: 22 → 24 tests (adds "emits params.subid" and "omits imp.ext.goadserver.subid when no subid is set" cases). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: getUserSyncs from ext.goadserver.usersync Implements the getUserSyncs hook so publishers using this adapter drop the goadserver persistent cookie after each auction. The sync URL is published per-deployment at response.body.ext.goadserver.usersync by the server (/openrtb2/auction), so the same adapter picks up the right pixel for every goadserver system without hardcoding hosts. Returns image or iframe syncs per syncOptions; falls back to empty when either the response has no sync entry or the publisher has disabled sync types globally. Test coverage: 24 → 29 tests (5 new getUserSyncs cases covering empty responses, missing ext, type filtering, and iframe path). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: params.deals[] + outstream video docs Two Tier 2 additions: 1. params.deals[] support. Publishers can now attach private marketplace deal objects per ad unit; the adapter's ortbConverter imp hook translates them into imp.pmp.deals[] in the outgoing BidRequest. Each deal object accepts id (required), bidfloor, bidfloorcur, at, wseat[], wadomain[] — matching the OpenRTB 2.5 imp.pmp.deals spec. 2. Outstream video documentation. The adapter already forwards video imps untouched via ortbConverter (including context='outstream') so no code change is needed on the request side. Added an .md section showing the standard Prebid.js ad-unit-level renderer pattern for publishers who want outstream. Test coverage: 29 → 32 tests (emits deals, omits when unset, outstream video imp shape preserved). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: outstream video renderer + cached VAST URL Attaches a Prebid.js Renderer for video bids whose ad unit requested mediaTypes.video.context = 'outstream'. The renderer loads the deployment-hosted player at https://{params.host}/prebid-outstream.js which parses the VAST XML and injects a muted autoplay <video> element into the slot with impression + click tracking. Publishers can override the hosted script via params.outstreamRendererUrl, or fall back to a standard ad-unit-level renderer which takes precedence. Also prefers the Prebid Cache URL (exposed via ext.prebid.targeting .hb_cache_url) over inline VAST XML when both are present, so large VAST blobs don't have to live in Prebid's in-memory targeting store. The bidRequests array is now stashed on the ServerRequest so interpretResponse can correlate bids back to their originating ad unit (needed to detect outstream context). All 32 existing unit tests still pass. * goadserverBidAdapter: split per (host, token); plain-text POST Addresses codex-connector review on PR #14701: - buildRequests now groups bids by (host, token) and emits one ServerRequest per group, so pages mixing multiple goadserver deployments route each ad unit to the correct endpoint + token. - POST uses contentType 'text/plain' instead of 'application/json' so the browser skips the CORS preflight (same JSON body, one round-trip instead of two). - getUserSyncs JSDoc @returns {UserSync[]} -> {Object[]} to clear the lint warning from an undefined type reference. New specs cover multi-tenant splitting, same-tenant bundling, and the text/plain content-type assertion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * goadserverBidAdapter: migrate to TypeScript Per the prebid/Prebid.js TS migration guidance from the bot review on PR #14701: convert the adapter to .ts with typed BidderSpec and a GoadserverBidParams type registered via `declare module '../src/adUnits'`. Runtime behavior unchanged — spec passes 33/33. --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Blazo <blazo@goadserver.com> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Build system: Switch to native Gulp v5 sourcemap handling and remove `gulp-sourcemaps` (#14805) * Build System: remove gulp-sourcemaps dependency * Build System: preserve bundle sourcemaps through header/footer injection * fix warning on creative renderers source map --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Core: disable user syncs in Firefox and Webkit Chrome (#14803) * Core: disable user syncs in Firefox * Core: block user syncs for Chrome iOS * Livewrapped Adapter: align cookieSupport browser gating * Livewrapped Adapter: stabilize cookieSupport tests across browsers * ADTS-661-send-video-pos-value-from-Prebid-JS-adapter (#14808) * CI: use app password for notification emails (#14817) * CI: use app password for notification emails * update workflow file; fix validation * Core: limit mergeConfig notifications to updated topics (#14741) * mergeConfig trigger only merged topic listeners & write test * Avoid prototype inheritance in merged config * Encypher RTD Provider: C2PA content provenance signals (#14807) * feat: add Encypher RTD provider for C2PA content provenance Injects C2PA content provenance signals into OpenRTB bid requests at site.ext.data.c2pa, enabling DSPs to factor verified publisher identity and content integrity into bidding decisions. Three execution paths in strict priority: - Path A (Manifest shortcut): reads <meta name="c2pa-manifest-url"> - Path B (Cache): serves from localStorage, no network call - Path C (API): extracts text, sends to Encypher API which detects existing embedded provenance markers or signs fresh content Content signed at CMS/CDN level carries invisible C2PA markers that survive DOM rendering. The API detects and verifies these server-side, returning the publisher's authenticated signer tier. This differentiates publisher-signed inventory from third-party-attested inventory in bids. Extracts JSON-LD metadata (author, dates, section, keywords, publisher, language) for analytics when structured data is available. No external scripts loaded. Every code path calls callback(). The module never blocks an auction. GDPR-compliant via Prebid storageManager. Free tier: 1,000 unique content signatures per domain per month. Verification of already-signed content does not count against quota. Deduped by content hash. Quota exceeded fails open gracefully. * fix(encypherRtd): add security guards from code review - Add callback-once guard to prevent double-invocation - Add 2s safety timeout so module never blocks auction - Add GDPR consent gate before transmitting page content - Add API host allowlist (api.encypher.com, staging-api.encypher.com) - Add tests for consent, allowlist, and HTTP-rejection scenarios - Update test apiBase to use allowed host * docs(encypherRtd): note security guards in module README * fix(encypherRtd): address review feedback, migrate to TypeScript - Extract getCanonicalUrl/hashUrl to libraries/encypherUtils - Remove application/json content type to avoid CORS preflight - Broaden consent gate to check COPPA, USP/CCPA opt-out, and GDPR - Migrate module to TypeScript with typed public interface (EncypherRtdParams, C2paPayload, RtdProviderSpec<'encypher'>) - Enforce HTTPS on Path A manifest URLs - Add 8 new tests (39 total, all passing) Addresses review feedback from patmmccann on #14807. --------- Co-authored-by: Developer <developer@example.com> * Prebid 11.9.0 release * Increment version to 11.10.0-pre * New adapter: cortex (#14811) * New adapter: cortex * fix(md-docs): add info about bid params * fix(types): update types for BidParams --------- Co-authored-by: Cortex Dev <dev@cortexch.it> * Module Fix: `mergeConfig` failing to apply custom `priceGranularity` (and fix `mediaTypePriceGranularity` setter) (#14815) * fix: allow mergeConfig to overwrite primitives with objects and fix mediaTypePriceGranularity setter * test: add regression test for mergeConfig with custom priceGranularity * Refactor mergeConfig regression test for clarity Removed unnecessary blank line and updated comment formatting. --------- Co-authored-by: Patrick McCann <pmccann@cafemedia.com> * BrainX Adapter: simplify test adm and crid fixtures (#14822) * Bid Adapters: simplify discovery and bliink test adm fixtures (#14823) * Pigeoon bid adapter: initial release (#14786) * Add Pigeoon bid adapter * Fix GDPR flag, replace cookie with StorageManager, remove native support, use text/plain content-type * Fix GDPR flag, replace cookie with StorageManager, remove native support, use text/plain content-type * Fix linting: use 2 space indentation * Trigger CI * Simplify documentation to match Prebid standard format * Add JSDoc types and simplify documentation --------- Co-authored-by: OSMAN YAVUZ PİŞKİN <osman.piskin01@outlook.com> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Intenze Adapter: stabilize endpoint URL assertions in tests (#14790) * Lotame Id module: reset Lotame storage config between getId calls in tests (#14824) * Core: reset Lotame storage config per getId call * Core: use per-request Lotame storage config in async callback * Core: replace body-parser usage with express parsers (#14825) * ReVantage Bid Adapter: add gvlid (#14829) * Create revantageBidAdapter.js * Create revantageBidAdapter.md * Update revantageBidAdapter.js * Update revantageBidAdapter.js * Update revantageBidAdapter.js * Update revantageBidAdapter.js Fixed trailing slash Error on Line 123 * Create revantageBidAdapter_spec.js * Update revantageBidAdapter_spec.js Fixed Trailing slashes (again) * Update revantageBidAdapter_spec.js * Update revantageBidAdapter_spec.js same thing again * Refactor Revantage Bid Adapter for media types and bids Refactor Revantage Bid Adapter to use media type constants and improve bid response handling. * Refactor RevantageBidAdapter tests for GPP consent * Update modules/revantageBidAdapter.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update modules/revantageBidAdapter.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Validate feedId consistency in batch bid requests Added validation to ensure all bid requests in a batch have the same feedId, logging a warning if they do not. * Add test for rejecting batch with different feedIds * Update syncOptions for image sync URL parameters * Update sync URL to use 'tag=img' instead of 'type=img' * Update print statement from 'Hello' to 'Goodbye' * fixed * Enhance video bid handling and add utility functions Added functions to handle video size extraction and VAST detection. * Add gvlid to revantageBidAdapter --------- Co-authored-by: Patrick McCann <pmccann@cafemedia.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Percent in view library: guard viewability observer against non-elements (#14709) * Build system: do not run Intersection.observe of mock elements during tests * fix stub not always active --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Viously Adapter: normalize nurl test URLs to avoid chunk noise (#14801) * Asterio Bid Adapter: add initial bidder adapter (#14691) * Asterio Bid Adapter: add initial bid adapter * Asterio Bid Adapter: corrected documentation * Asterio Bid Adapter: review fixes * Asterio Bid Adapter: migrating to typescript --------- Co-authored-by: Denis Anoykin <aden@asteriosoft.com> * relayBidAdapter.js: remove gvl id (#14830) * Remove GVLID constant from relayBidAdapter.js Removed the GVLID constant from relayBidAdapter.js * Update relayBidAdapter.js * MSFT Bid Adapter - support video.placement and video.plcmt (#14832) * Prebid 11.10.0 release * Increment version to 11.11.0-pre * Bump actions/github-script from 8 to 9 (#14834) Bumps [actions/github-script](https://github.com/actions/github-script) from 8 to 9. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v8...v9) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Core: allow async event handlers (#14828) * Core: allow async event handlers * lint * Remove isA function from objects.ts Removed isA function that checks object type. * Remove isA tests from utils_spec.js Removed tests for the isA function from utils_spec.js. * Clean up documentation for isFn function Removed unnecessary parameter documentation from isFn function. --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * stub out more storagemanager methods (#14836) * SeedingAlliance Bid Adapter: handle eventtrackers correctly (#14800) * seedingAlliance: handle eventtrackers correctly * fix unit test * increase test coverage * New Adapter: TeqBlaze Demo (#14837) * added ts for teqblaze utils and some fixes * New Adapter: TeqBlaze Demo * update readme * Fix formatting in TeqBlaze Demo Bid Adapter documentation --------- Co-authored-by: Patrick McCann <pmccann@cafemedia.com> * Github Actions: Auto-label PRs touching core modules in PR-assignment-deps workflow (#14820) * CI: fix GPP control module names for core labeling * CI: skip core labeling when token is read-only * move label assignment to PR assignment job --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Core: add release drafter category for core-tagged PRs (#14821) * Core: add release drafter category for core-tagged PRs * Core: move core release-drafter section above features * Bump axios from 1.15.0 to 1.16.0 (#14842) Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.16.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.15.0...v1.16.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * NaveggIdSystem: fix spurious test failures (#14841) * NaveggIdSystem: fix spurious test failures * Fix extra directory * Conceptx Bid Adapter: Update site property values (#14831) * New adapter: concepx * Syntax change * Revert syntax change * Defensive check for response from bidder server * Add better validation for the request * Merge branch 'master' of https://github.com/prebid/Prebid.js * Don't append url on every buildrequest * Add gvlId to conceptX * Change conceptx adapter, to directly request our PBS * Add empty getUserSync, as the syncing will be delegated (runPbsCookieSync) * Update conceptx bid adapter with modified site params sent * add params type + tests --------- Co-authored-by: Patrick McCann <patmmccann@gmail.com> * MGID Bid Adapter: migrate to ortbConverter (#14761) Co-authored-by: Erik Poul <erik.poul@mgid.com> * Fix github token; exclude top-level file changes from being considered core (#14843) * Attekmi: add regions (#14833) * Attekmi: add region to Markapp * syntax fix * Markapp uses only http protocol * endpoints update to https * Attekmi: add regions * fixes on review * eslint fixes * tests extended and fixed --------- Co-authored-by: Victor <victor.banudz@smart-hub.io> Co-authored-by: Patrick McCann <patmmccann@gmail.com> * Core: map teqBlaze demo adapter to metadata component (#14844) * ssp_geniee Adapter: use request-scoped client hints (#14747) * ssp_geniee Adapter: use request client hints * Update ssp_genieeBidAdapter.js * Prebid 11.11.0 release * Increment version to 11.12.0-pre * Bump ip-address and socks (#14845) Bumps [ip-address](https://github.com/beaugunderson/ip-address) and [socks](https://github.com/JoshGlazebrook/socks). These dependencies needed to be updated together. Updates `ip-address` from 9.0.5 to 10.2.0 - [Commits](https://github.com/beaugunderson/ip-address/commits) Updates `socks` from 2.8.4 to 2.8.8 - [Release notes](https://github.com/JoshGlazebrook/socks/releases) - [Commits](https://github.com/JoshGlazebrook/socks/compare/2.8.4...2.8.8) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect - dependency-name: socks dependency-version: 2.8.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump basic-ftp from 5.3.0 to 5.3.1 (#14847) Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.3.0 to 5.3.1. - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](https://github.com/patrickjuchli/basic-ftp/compare/v5.3.0...v5.3.1) --- updated-dependencies: - dependency-name: basic-ftp dependency-version: 5.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Remove gulp-wrap dependency and clean up package files (#14846) * Build: remove gulp-wrap dependency to eliminate consolidate * Build: remove gulp-wrap usage from precompilation * pass in imp.displaymanager and img.displaymanagerver (#14857) Co-authored-by: Shuhao <shuhao.qgg.zhang@gmail.com> * CI: fix coveralls base comparison for PR branches (#14813) * CI: compute coveralls base commit from merge-base * CI: fetch full base branch history for merge-base * CI: isolate coveralls upload to dedicated coverage run * remove additional test run * Fix source maps * remove unused variable --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org> * Bump fast-xml-builder from 1.1.5 to 1.2.0 (#14862) Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.5 to 1.2.0. - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.5...v1.2.0) --- updated-dependencies: - dependency-name: fast-xml-builder dependency-version: 1.2.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump fast-uri from 3.1.0 to 3.1.2 (#14864) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @babel/plugin-transform-modules-systemjs from 7.28.5 to 7.29.4 (#14865) Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.28.5 to 7.29.4. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs) --- updated-dependencies: - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bliink Adapter: replace long VAST event token fixture (#14848) * mileRtdProvider initial commit (#14636) * mileRtdProvider initial commit * removing the isFlooringEnforcedForAuction gate * converted to typescript and removed the flooringEnforcedCheck inside the RTD module * using adUnit.adserverTargeting --------- Co-authored-by: JP Mohan <jpmohan@MacBook-Pro-9.local> * Core Typescript types: Add bidCacheFilterFunction to types (#14869) * Add bidCacheFilterFunction to types * Fix linting errors * Native Agents Bid Adapter: add new adapter (#14755) * New adapter: Native Agents * NativeAgents Bid Adapter: add TypeScript BidderParams type augmentation * NativeAgents Bid Adapter: rename bider code to ntvagents * Abtshield id system prebid (#14861) * ABTShield User ID Adapter: add ID system * ABT Shield ID System: add SIVT segment * ABT Shield ID System: scope credentialed requests * Require storage config with 1-day minimum TTL in abtshieldIdSystem Add validation to reject missing or incomplete storage configuration and enforce a 1-day minimum for `storage.expires` to bound MCR request volume. Update TypeScript definitions to make storage fields required with documentation. Add comprehensive test coverage for validation logic. * Bump @wdio/browserstack-service from 9.19.1 to 9.23.3 (#14871) Bumps [@wdio/browserstack-service](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-browserstack-service) from 9.19.1 to 9.23.3. - [Release notes](https://github.com/webdriverio/webdriverio/releases) - [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md) - [Commits](https://github.com/webdriverio/webdriverio/commits/v9.23.3/packages/wdio-browserstack-service) --- updated-dependencies: - dependency-name: "@wdio/browserstack-service" dependency-version: 9.23.3 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fluct Bid Adapter: add ortb2Imp.ext.data and rwdd signals (#14872) * add instl support * falseの場合も明示的に送信するようにした * fluct Bid Adapter: add ortb2Imp.ext.data and rwdd signals Pass impression-level custom targeting data (ortb2Imp.ext.data) and rewarded ad flag (ortb2Imp.rwdd) to the fluct server to improve signal coverage and enable rewarded inventory differentiation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: yosei-ito <ca01423@cartahd.com> Co-authored-by: himu62 <ca00732@cartahd.com> Co-authored-by: himu <himu62@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * Clear Livewrapped analytics cache when pbjs.clearAllAuctions is called (#14870) * feat(hypelabBidAdapter): migrate to OpenRTB 2.6 endpoint (#14863) Migrate HypeLab bid adapter from custom /v1/prebid_requests format to OpenRTB 2.6-compliant /v1/rtb_requests endpoint using Prebid's built-in ortbConverter. Remove legacy event reporting callbacks (onTimeout, onSetTargeting, onBidderError); keep onBidWon to fire burl pixel. * Currency: fix bug where conversion rates are sometimes reset to defaultRates (#14878) * Currency: fix bug where conversion rates are sometimes reset to defaultRates * allow for multiple settings of defaultRates * CI: do not auto-assign reviewers o…
1 parent 71e13c0 commit 6ad07f0

2,186 files changed

Lines changed: 43884 additions & 22015 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Combine coverage
2+
description: Combine and cache coverage results
3+
inputs:
4+
cache-key:
5+
description: cache key to use
6+
lcov:
7+
description: output LCOV file name
8+
source-artifact:
9+
description: Source code artifact name
10+
runs:
11+
using: 'composite'
12+
steps:
13+
- name: Restore from cache
14+
id: restore
15+
uses: actions/cache/restore@v4
16+
with:
17+
path: ${{ runner.temp }}/coverage.info
18+
key: ${{ inputs.cache-key }}
19+
- name: Restore source
20+
if: ${{ steps.restore.outputs.cache-hit != 'true' }}
21+
uses: ./.github/actions/load
22+
with:
23+
name: ${{ inputs.source-artifact }}
24+
- name: Combine coverage results
25+
if: ${{ steps.restore.outputs.cache-hit != 'true' }}
26+
shell: bash
27+
run: |
28+
sudo apt-get update
29+
sudo apt-get install lcov -y
30+
find build/coverage/chunks -name 'lcov.info' -printf ' -a %p' | xargs lcov -o ${{ runner.temp }}/coverage.info
31+
- name: Save to cache
32+
if: ${{ steps.restore.outputs.cache-hit != 'true' }}
33+
uses: actions/cache/save@v4
34+
with:
35+
path: ${{ runner.temp }}/coverage.info
36+
key: ${{ inputs.cache-key }}
37+
- name: Rename file
38+
shell: bash
39+
run: |
40+
mv "${{ runner.temp }}/coverage.info" "${{ inputs.lcov }}"
41+
- name: Save as artifact
42+
uses: actions/upload-artifact@v7
43+
with:
44+
name: ${{ inputs.lcov }}
45+
path: ${{ inputs.lcov }}
46+
47+

.github/codeql/queries/autogen_fpDOMMethod.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ class DOMMethod extends string {
77

88
DOMMethod() {
99

10-
( this = "getChannelData" and weight = 1083.37 and type = "AudioBuffer" )
10+
( this = "toDataURL" and weight = 27.97 and type = "HTMLCanvasElement" )
1111
or
12-
( this = "toDataURL" and weight = 27.64 and type = "HTMLCanvasElement" )
12+
( this = "getChannelData" and weight = 1261.88 and type = "AudioBuffer" )
1313
}
1414

1515
float getWeight() {

.github/codeql/queries/autogen_fpEventProperty.qll

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,21 +7,21 @@ class EventProperty extends string {
77

88
EventProperty() {
99

10-
( this = "accelerationIncludingGravity" and weight = 159.98 and event = "devicemotion" )
10+
( this = "beta" and weight = 776.51 and event = "deviceorientation" )
1111
or
12-
( this = "beta" and weight = 851.21 and event = "deviceorientation" )
12+
( this = "gamma" and weight = 230.63 and event = "deviceorientation" )
1313
or
14-
( this = "gamma" and weight = 303.39 and event = "deviceorientation" )
14+
( this = "alpha" and weight = 760.83 and event = "deviceorientation" )
1515
or
16-
( this = "alpha" and weight = 768.07 and event = "deviceorientation" )
16+
( this = "accelerationIncludingGravity" and weight = 77.06 and event = "devicemotion" )
1717
or
18-
( this = "candidate" and weight = 45.34 and event = "icecandidate" )
18+
( this = "candidate" and weight = 46.1 and event = "icecandidate" )
1919
or
20-
( this = "acceleration" and weight = 63.39 and event = "devicemotion" )
20+
( this = "acceleration" and weight = 34.29 and event = "devicemotion" )
2121
or
22-
( this = "rotationRate" and weight = 63.13 and event = "devicemotion" )
22+
( this = "rotationRate" and weight = 34.06 and event = "devicemotion" )
2323
or
24-
( this = "absolute" and weight = 402.37 and event = "deviceorientation" )
24+
( this = "absolute" and weight = 231.5 and event = "deviceorientation" )
2525
}
2626

2727
float getWeight() {

.github/codeql/queries/autogen_fpGlobalConstructor.qll

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@ class GlobalConstructor extends string {
66

77
GlobalConstructor() {
88

9-
( this = "OfflineAudioContext" and weight = 225.31 )
9+
( this = "SharedWorker" and weight = 80.78 )
1010
or
11-
( this = "RTCPeerConnection" and weight = 34.53 )
11+
( this = "OfflineAudioContext" and weight = 198.38 )
1212
or
13-
( this = "SharedWorker" and weight = 75.74 )
13+
( this = "RTCPeerConnection" and weight = 37.01 )
1414
or
15-
( this = "Gyroscope" and weight = 50.8 )
15+
( this = "Gyroscope" and weight = 53.04 )
1616
or
17-
( this = "AudioWorkletNode" and weight = 119.39 )
17+
( this = "AudioWorkletNode" and weight = 239.83 )
1818
}
1919

2020
float getWeight() {

.github/codeql/queries/autogen_fpGlobalObjectProperty0.qll

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -7,57 +7,57 @@ class GlobalObjectProperty0 extends string {
77

88
GlobalObjectProperty0() {
99

10-
( this = "availHeight" and weight = 89.13 and global0 = "screen" )
10+
( this = "availHeight" and weight = 96.62 and global0 = "screen" )
1111
or
12-
( this = "availWidth" and weight = 84.67 and global0 = "screen" )
12+
( this = "availWidth" and weight = 89.95 and global0 = "screen" )
1313
or
14-
( this = "colorDepth" and weight = 42.61 and global0 = "screen" )
14+
( this = "colorDepth" and weight = 42.26 and global0 = "screen" )
1515
or
16-
( this = "availTop" and weight = 1275.07 and global0 = "screen" )
16+
( this = "availTop" and weight = 1353.4 and global0 = "screen" )
1717
or
18-
( this = "permissions" and weight = 70.37 and global0 = "navigator" )
18+
( this = "deviceMemory" and weight = 61.93 and global0 = "navigator" )
1919
or
20-
( this = "deviceMemory" and weight = 59.45 and global0 = "navigator" )
20+
( this = "pixelDepth" and weight = 51.98 and global0 = "screen" )
2121
or
22-
( this = "onLine" and weight = 19.95 and global0 = "navigator" )
22+
( this = "availLeft" and weight = 661.19 and global0 = "screen" )
2323
or
24-
( this = "mediaCapabilities" and weight = 33.73 and global0 = "navigator" )
24+
( this = "orientation" and weight = 34.72 and global0 = "screen" )
2525
or
26-
( this = "pixelDepth" and weight = 49.23 and global0 = "screen" )
26+
( this = "vendorSub" and weight = 2725.72 and global0 = "navigator" )
2727
or
28-
( this = "permission" and weight = 24.75 and global0 = "Notification" )
28+
( this = "productSub" and weight = 448.44 and global0 = "navigator" )
2929
or
30-
( this = "webdriver" and weight = 26.06 and global0 = "navigator" )
30+
( this = "webkitTemporaryStorage" and weight = 37.16 and global0 = "navigator" )
3131
or
32-
( this = "getBattery" and weight = 36.56 and global0 = "navigator" )
32+
( this = "hardwareConcurrency" and weight = 72.55 and global0 = "navigator" )
3333
or
34-
( this = "availLeft" and weight = 653.43 and global0 = "screen" )
34+
( this = "appCodeName" and weight = 160.76 and global0 = "navigator" )
3535
or
36-
( this = "mediaDevices" and weight = 148 and global0 = "navigator" )
36+
( this = "onLine" and weight = 19.69 and global0 = "navigator" )
3737
or
38-
( this = "hardwareConcurrency" and weight = 69.85 and global0 = "navigator" )
38+
( this = "webdriver" and weight = 25.44 and global0 = "navigator" )
3939
or
40-
( this = "keyboard" and weight = 2171.11 and global0 = "navigator" )
40+
( this = "keyboard" and weight = 3172.04 and global0 = "navigator" )
4141
or
42-
( this = "appCodeName" and weight = 167.15 and global0 = "navigator" )
42+
( this = "mediaDevices" and weight = 151.88 and global0 = "navigator" )
4343
or
44-
( this = "webkitTemporaryStorage" and weight = 38.32 and global0 = "navigator" )
44+
( this = "storage" and weight = 38.66 and global0 = "navigator" )
4545
or
46-
( this = "vendorSub" and weight = 2404.06 and global0 = "navigator" )
46+
( this = "mediaCapabilities" and weight = 31.44 and global0 = "navigator" )
4747
or
48-
( this = "productSub" and weight = 372.86 and global0 = "navigator" )
48+
( this = "permissions" and weight = 66.89 and global0 = "navigator" )
4949
or
50-
( this = "webkitPersistentStorage" and weight = 129.8 and global0 = "navigator" )
50+
( this = "presentation" and weight = 32.86 and global0 = "navigator" )
5151
or
52-
( this = "storage" and weight = 39.68 and global0 = "navigator" )
52+
( this = "permission" and weight = 25.92 and global0 = "Notification" )
5353
or
54-
( this = "presentation" and weight = 30.64 and global0 = "navigator" )
54+
( this = "getBattery" and weight = 35.48 and global0 = "navigator" )
5555
or
56-
( this = "orientation" and weight = 35.14 and global0 = "screen" )
56+
( this = "requestMediaKeySystemAccess" and weight = 34.46 and global0 = "navigator" )
5757
or
58-
( this = "getGamepads" and weight = 214.18 and global0 = "navigator" )
58+
( this = "webkitPersistentStorage" and weight = 132.3 and global0 = "navigator" )
5959
or
60-
( this = "requestMediaKeySystemAccess" and weight = 35.23 and global0 = "navigator" )
60+
( this = "getGamepads" and weight = 254.4 and global0 = "navigator" )
6161
}
6262

6363
float getWeight() {

.github/codeql/queries/autogen_fpGlobalObjectProperty1.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ class GlobalObjectProperty1 extends string {
88

99
GlobalObjectProperty1() {
1010

11-
( this = "enumerateDevices" and weight = 652.16 and global0 = "navigator" and global1 = "mediaDevices" )
11+
( this = "enumerateDevices" and weight = 729.32 and global0 = "navigator" and global1 = "mediaDevices" )
1212
}
1313

1414
float getWeight() {

.github/codeql/queries/autogen_fpGlobalTypeProperty0.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ class GlobalTypeProperty0 extends string {
77

88
GlobalTypeProperty0() {
99

10-
( this = "x" and weight = 4676.46 and global0 = "Gyroscope" )
10+
( this = "x" and weight = 5524.41 and global0 = "Gyroscope" )
1111
or
12-
( this = "y" and weight = 4676.46 and global0 = "Gyroscope" )
12+
( this = "y" and weight = 5524.41 and global0 = "Gyroscope" )
1313
or
14-
( this = "z" and weight = 4676.46 and global0 = "Gyroscope" )
14+
( this = "z" and weight = 5524.41 and global0 = "Gyroscope" )
1515
}
1616

1717
float getWeight() {

.github/codeql/queries/autogen_fpGlobalTypeProperty1.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ class GlobalTypeProperty1 extends string {
88

99
GlobalTypeProperty1() {
1010

11-
( this = "resolvedOptions" and weight = 21.29 and global0 = "Intl" and global1 = "DateTimeFormat" )
11+
( this = "resolvedOptions" and weight = 20.38 and global0 = "Intl" and global1 = "DateTimeFormat" )
1212
}
1313

1414
float getWeight() {

.github/codeql/queries/autogen_fpGlobalVar.qll

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,23 @@ class GlobalVar extends string {
66

77
GlobalVar() {
88

9-
( this = "devicePixelRatio" and weight = 16.11 )
9+
( this = "devicePixelRatio" and weight = 15.37 )
1010
or
11-
( this = "screenX" and weight = 378.78 )
11+
( this = "screenX" and weight = 425.14 )
1212
or
13-
( this = "screenY" and weight = 349.03 )
13+
( this = "screenY" and weight = 399.3 )
1414
or
15-
( this = "outerWidth" and weight = 110.41 )
15+
( this = "outerWidth" and weight = 118.62 )
1616
or
17-
( this = "outerHeight" and weight = 160.29 )
17+
( this = "outerHeight" and weight = 187.18 )
1818
or
19-
( this = "screenLeft" and weight = 380.11 )
19+
( this = "screenLeft" and weight = 345.98 )
2020
or
21-
( this = "screenTop" and weight = 381.44 )
21+
( this = "screenTop" and weight = 344.76 )
2222
or
23-
( this = "indexedDB" and weight = 22.05 )
23+
( this = "indexedDB" and weight = 22.13 )
2424
or
25-
( this = "openDatabase" and weight = 32.51 )
25+
( this = "openDatabase" and weight = 32.7 )
2626
}
2727

2828
float getWeight() {

.github/codeql/queries/autogen_fpRenderingContextProperty.qll

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,35 +7,35 @@ class RenderingContextProperty extends string {
77

88
RenderingContextProperty() {
99

10-
( this = "getExtension" and weight = 27.52 and contextType = "webgl" )
10+
( this = "getExtension" and weight = 26.42 and contextType = "webgl" )
1111
or
12-
( this = "getParameter" and weight = 30.5 and contextType = "webgl" )
12+
( this = "getParameter" and weight = 29.54 and contextType = "webgl" )
1313
or
14-
( this = "isPointInPath" and weight = 4676.46 and contextType = "2d" )
14+
( this = "getImageData" and weight = 53.53 and contextType = "2d" )
1515
or
16-
( this = "getSupportedExtensions" and weight = 1324.74 and contextType = "webgl" )
16+
( this = "measureText" and weight = 47.84 and contextType = "2d" )
1717
or
18-
( this = "getContextAttributes" and weight = 2060.8 and contextType = "webgl" )
18+
( this = "getParameter" and weight = 78.13 and contextType = "webgl2" )
1919
or
20-
( this = "getShaderPrecisionFormat" and weight = 1194.85 and contextType = "webgl" )
20+
( this = "getShaderPrecisionFormat" and weight = 168.04 and contextType = "webgl2" )
2121
or
22-
( this = "getExtension" and weight = 75.32 and contextType = "webgl2" )
22+
( this = "getExtension" and weight = 87.85 and contextType = "webgl2" )
2323
or
24-
( this = "getParameter" and weight = 74.54 and contextType = "webgl2" )
24+
( this = "getContextAttributes" and weight = 210.46 and contextType = "webgl2" )
2525
or
26-
( this = "getSupportedExtensions" and weight = 340.32 and contextType = "webgl2" )
26+
( this = "getSupportedExtensions" and weight = 317.42 and contextType = "webgl2" )
2727
or
28-
( this = "getContextAttributes" and weight = 176.36 and contextType = "webgl2" )
28+
( this = "getShaderPrecisionFormat" and weight = 1043.76 and contextType = "webgl" )
2929
or
30-
( this = "getShaderPrecisionFormat" and weight = 127.49 and contextType = "webgl2" )
30+
( this = "getContextAttributes" and weight = 1457.36 and contextType = "webgl" )
3131
or
32-
( this = "getImageData" and weight = 60.04 and contextType = "2d" )
32+
( this = "getSupportedExtensions" and weight = 1242.7 and contextType = "webgl" )
3333
or
34-
( this = "readPixels" and weight = 40.63 and contextType = "webgl" )
34+
( this = "isPointInPath" and weight = 5524.41 and contextType = "2d" )
3535
or
36-
( this = "readPixels" and weight = 805.02 and contextType = "webgl2" )
36+
( this = "readPixels" and weight = 37.76 and contextType = "webgl" )
3737
or
38-
( this = "measureText" and weight = 37.13 and contextType = "2d" )
38+
( this = "readPixels" and weight = 1045.65 and contextType = "webgl2" )
3939
}
4040

4141
float getWeight() {

0 commit comments

Comments
 (0)