upstream-sync: sync Prebid.js 11.18.0 → 11.19.0

.github/workflows/prebid-code-scanner.yml

@@ -0,0 +1,37 @@
+name: Prebid code scanner
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+  push:
+    branches:
+      - master
+      - '*-legacy'
+
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
+  security-events: write
+
+jobs:
+  scan:
+    name: "Prebid code scanner"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (PR)
+        if: ${{ github.event_name == 'pull_request_target' }}
+        uses: actions/checkout@v6
+        with:
+          ref: refs/pull/${{ github.event.pull_request.number }}/head
+          fetch-depth: 0
+      - name: Checkout (Push)
+        if: ${{ github.event_name == 'push' }}
+        uses: actions/checkout@v6
+      - name: Scan
+        uses: prebid/code-scanner@main
+        with:
+          token: ${{ github.token }}
+          pem: ${{ secrets.CODE_SCANNER_PEM }}
+          appId: ${{ vars.CODE_SCANNER_APPID }}
+          installationId: ${{ vars.CODE_SCANNER_INSTALLATION }}

AGENTS.md

@@ -71,3 +71,4 @@ This file contains instructions for the Codex agent and its friends when working
 - Low priority calls should be import ajax method and use fetch keepalive; they shouldnt use trigger pixel when it can be avoided or fail to specify keepalive.
 - Analytics modules must provide a disableAnalytics method.
 - Metadata files that say do not edit in the comments should not be edited; the build process is responsible for updating the metadata files.
+- PRs should not need to modify https://github.com/prebid/Prebid.js/blob/master/metadata/overrides.mjs as module codes and module names should generally match.

PR_REVIEW.md

@@ -8,7 +8,7 @@ For modules and core platform updates, the initial reviewer should request an ad
 
 ### Running Tests and Verifying Integrations
 
-General gulp commands include separate commands for serving the codebase on a built in webserver, creating code coverage reports and allowing serving integration examples. The `review-start` gulp command combinese those into one command.
+General gulp commands include separate commands for serving the codebase on a built in webserver, creating code coverage reports and allowing serving integration examples. The `review-start` gulp command combines those into one command.
 
 - Run `gulp review-start`, adding the host parameter `gulp review-start --host=0.0.0.0` will bind to all IPs on the machine
     - A page will open which provides a hub for common reviewer tools.
@@ -29,6 +29,7 @@ General gulp commands include separate commands for serving the codebase on a bu
 - Make sure the code is not setting cookies or localstorage directly -- it must use the `StorageManager`.
 - Review for obvious errors or bad coding practice / use best judgement here.
 - Don't allow needless code duplication with other js files; require both files import common code. Do not allow commits designed to fool the code duplication checker.
+- Module filenames should match module codes. Exceptions in https://github.com/prebid/Prebid.js/blob/master/metadata/overrides.mjs should almost never be needed.
 - If the change is a new feature / change to core openads.js - review the change with a Tech Lead on the project and make sure they agree with the nature of change.
 - If the change results in needing updates to docs (such as public API change, module interface etc), add a label for "needs docs" and inform the submitter they must submit a docs PR to update the appropriate area of Prebid.org **before the PR can merge**. Help them with finding where the docs are located on prebid.org if needed. 
 - If all above is good, add a `LGTM` comment and, if the change is in PBS-core or is an important module like the prebidServerBidAdapter, request 1 additional core member to review.
@@ -48,6 +49,7 @@ Follow steps above for general review process. In addition, please verify the fo
     - The bidder code should be unique for the first 6 characters
     - Reserved words that cannot be used as bidder names: all, context, data, general, prebid, and skadn
 - Verify that bidder has submitted valid bid params and that bids are being received.
+- Verify filenames are correct, eg bidderCode must match {{biddermodule}}BidAdapter
 - Verify that bidder is not manipulating the openads.js auction in any way or doing things that go against the principles of the project. If unsure check with the Tech Lead.
 - Verify that code re-use is being done properly and that changes introduced by a bidder don't impact other bidders.
 - If the adapter being submitted is an alias type, check with the bidder contact that is being aliased to make sure it's allowed.
@@ -75,7 +77,7 @@ Follow steps above for general review process. In addition, please verify the fo
     - If their bidder doesn't work well with safeframed creatives, add `safeframes_ok: false`. This will alert publishers to not use safeframed creatives when creating the ad server entries for their bidder.
     - If they're setting a deal ID in some scenarios, add `bidder_supports_deals: true`
     - If they have an IAB Global Vendor List ID, add `gvl_id: ID`. There's no default.
-- After a new adapter is approved, let the submitter know they may open a PR in the [headerbid-expert repository](https://github.com/prebid/headerbid-expert) to have their adapter recognized by the [Headerbid Expert extension](https://chrome.google.com/webstore/detail/headerbid-expert/cgfkddgbnfplidghapbbnngaogeldmop). The PR should be to the [bidder patterns file](https://github.com/prebid/headerbid-expert/blob/master/bidderPatterns.js), adding an entry with their adapter's name and the url the adapter uses to send and receive bid responses.
+
 
 ### Reviewing a New or Updated Analytics Adapter
 
@@ -143,7 +145,7 @@ The debugging module cannot import from core in the same way that other modules
 Each week, Prebid Org assigns one person to keep an eye on incoming issues and PRs. Every Monday morning a reminder is sent to the prebid-js slack channel with a link to the spreadsheet. If you're on rotation, please check that list each Monday to see if you're on-duty.
 
 When on-duty:
-- Review issues and PRs at least once per weekday for new items. Encourage a 48 "SLA" on PRs/issues assigned. Aim for touchpoint once every 48/hours. 
+- Review issues and PRs at least once per weekday for new items. Encourage a 48 "SLA" on PRs/issues assigned. Aim for touchpoint once every 48 hours. 
 - For PRs: assign PRs to individuals on the **PR review list**. Try to be equitable -- not all PRs are created equally. Use the "Assigned" field and add the "Needs Review" label.
 - For Issues: try to address questions and troubleshooting requests on your own, assigning them to others as needed. Please add labels as appropriate (I.E. bug, question, backlog etc).
 - Issues that are questions or troubleshooting requests may be closed if the originator doesn't respond within a week to requests for confirmation or details.

libraries/intentIqConstants/intentIqConstants.js

@@ -5,11 +5,10 @@ export const SUPPORTED_TYPES = ["html5", "cookie"];
 export const WITH_IIQ = "A";
 export const WITHOUT_IIQ = "B";
 export const DEFAULT_PERCENTAGE = 95;
-export const BLACK_LIST = "L";
 export const CLIENT_HINTS_KEY = "_iiq_ch";
 export const EMPTY = "EMPTY";
 export const GVLID = "1323";
-export const VERSION = 0.36;
+export const VERSION = 0.37;
 export const PREBID = "pbjs";
 export const HOURS_24 = 86400000;
 export const HOURS_72 = HOURS_24 * 3;

libraries/pbsExtensions/processors/pbs.js

@@ -8,6 +8,7 @@ import { setRequestExtPrebid, setRequestExtPrebidChannel } from './requestExtPre
 import { setBidResponseVideoCache } from './video.js';
 import { addEventTrackers } from './eventTrackers.js';
 import { setRequestExtPrebidPageViewIds } from './pageViewIds.js';
+import { setBidResponseSafeRenderer, setRequestExtPrebidSafeRenderer } from './safeRenderer.js';
 
 export const PBS_PROCESSORS = {
   [REQUEST]: {
@@ -27,6 +28,10 @@ export const PBS_PROCESSORS = {
       // sets ext.openads.page_view_ids
       fn: setRequestExtPrebidPageViewIds
     },
+    extPrebidSafeRenderer: {
+      // sets ext.openads.safeRenderer support flag
+      fn: setRequestExtPrebidSafeRenderer
+    }
   },
   [IMP]: {
     params: {
@@ -79,6 +84,10 @@ export const PBS_PROCESSORS = {
       // converts "legacy" burl and ext.openads.events.win into eventtrackers
       fn: addEventTrackers
     },
+    safeRenderer: {
+      // sets bidResponse.safeRenderer from ext.openads.meta.rendererUrl
+      fn: setBidResponseSafeRenderer
+    }
   },
   [RESPONSE]: {
     serverSideStats: {

libraries/pbsExtensions/processors/safeRenderer.js

@@ -0,0 +1,18 @@
+import { deepSetValue } from '../../../src/utils.js';
+
+export function setRequestExtPrebidSafeRenderer(ortbRequest, bidderRequest) {
+  deepSetValue(
+    ortbRequest,
+    `ext.openads.safeRenderer`,
+    true
+  );
+}
+
+export function setBidResponseSafeRenderer(bidResponse, bid) {
+  const { rendererUrl } = bid.ext?.openads?.meta || {};
+  if (rendererUrl) {
+    bidResponse.safeRenderer = {
+      url: rendererUrl,
+    };
+  }
+}

modules/intentIqIdSystem.js

@@ -102,7 +102,7 @@
 
 function verifyIdType(value) {
   if (value === 0 || value === 1 || value === 3 || value === 4) return value;
   return -1;
 }
 
 function appendPartnersFirstParty(url, configParams) {
@@ -148,7 +148,7 @@
       +d[3]
     );
   } catch (e) {
     return NaN;
   }
 }
 
@@ -280,11 +280,11 @@
   storeCounters(allowedStorage, partnerData);
 }
 
-function storeCounters(storage, partnerData) {
+function storeCounters(allowedStorage, partnerData) {
   partnerData.callCount = callCount;
   partnerData.failCount = failCount;
   partnerData.noDataCounter = noDataCount;
-  storeData(PARTNER_DATA_KEY, JSON.stringify(partnerData), storage, firstPartyData);
+  storeData(PARTNER_DATA_KEY, JSON.stringify(partnerData), allowedStorage, firstPartyData);
 }
 
 /** @type {Submodule} */
@@ -421,7 +421,7 @@
     if (chSupported) {
       chPromise = fetchAndHandleCH();
       chPromise.catch(err => {
         logError('fetchAndHandleCH failed', err);
       });
     } else {
       clientHints = '';
@@ -437,8 +437,8 @@
     if (typeof partnerData.failCount === 'number') failCount = partnerData.failCount;
     if (typeof partnerData.noDataCounter === 'number') noDataCount = partnerData.noDataCounter;
     if (partnerData.wsrvcll) {
       partnerData.wsrvcll = false;
       storeData(PARTNER_DATA_KEY, JSON.stringify(partnerData), allowedStorage, firstPartyData);
     }
 
     if (partnerData.data) {
@@ -505,7 +505,7 @@
             .then(ch => buildAndSendPixel(ch || ''));
         }
       } else {
         buildAndSendPixel('');
       }
       return;
     }
@@ -568,7 +568,7 @@
             };
             if (callbackTimeoutID) clearTimeout(callbackTimeoutID);
             if ('cttl' in respJson) {
               partnerData.cttl = respJson.cttl;
             } else partnerData.cttl = HOURS_72;
 
             if ('tc' in respJson) {
@@ -609,7 +609,7 @@
               }
               // If data is empty, means we should save as INVALID_ID
               if (respJson.data === '') {
                 respJson.data = INVALID_ID;
               } else {
                 // If data is a single string, assume it is an id with source intentiq.com
                 if (respJson.data && typeof respJson.data === 'string') {
@@ -624,7 +624,7 @@
             }
 
             if ('sid' in respJson) {
               partnerData.siteId = respJson.sid;
             }
 
             if ('spd' in respJson) {
@@ -633,14 +633,14 @@
             }
 
             if ('abTestUuid' in respJson) {
               if ('ls' in respJson && respJson.ls === true) {
                 partnerData.abTestUuid = respJson.abTestUuid;
               }
             }
 
             if ('gpr' in respJson) {
               // GAM prediction reporting
               partnerData.gpr = respJson.gpr;
             } else {
               delete partnerData.gpr; // remove prediction flag in case server doesn't provide it
             }