[openads-sync-bot]

Prebid.js Sync: 11.22.0 → 11.23.0

📊 Run summary

This PR was auto-generated by the Sync with Upstream Prebid.js workflow.
Prebid 11.23.0 Release Page

Upstream diff: prebid/Prebid.js@11.22.0...11.23.0

✅ Applied Commits

• e20617afc | CI: warn about naming convention violations in PRs #15306
• 0161f903c | Tcf control module: fix TypeError: Cannot read properties of undefined (reading 'gdpr') for non-GDPR countries in 11.21 #15308
• 9b5be4718 | Dependabot target: bump babel plugins #15289
• 2741eb3df | Adplus Adapters: expand payload fields and normalize IDs #15323 (auto-resolved)
• 28afe271e | Core: escape user sync iframe URL in HTML #15047
• f15e4c560 | Update AGENTS.md #15310
• 801381c | Prebid Version Update (OpenAds Upstream Sync Bot)

⏭️ Skipped Commits

These commits were intentionally skipped because they made changes to files matching BidAdapter:

• 69d64bf99 | Increment version to 11.23.0-pre (unneeded changes)
• 2ba68a778 | OneTag Bid Adapter: report bid timeouts #15305 (bid adapter change)
• 12ede54b7 | JJTech Bid Adapter: new banner bid adapter #15312 (bid adapter change)
• 0039e2b60 | Cadent Aperture MX Bid Adapter: migrate endpoints to ssp.cadent.com (chore: sync Prebid.js 10.11.0 → 10.12.0 #20) #15316 (bid adapter change)
• f364e2a6f | Mediago Bid Adapter:adapter upgrade to support native ad #15298 (bid adapter change)
• 6e4fe5f50 | Adtrgtme Bid Adapter: add Video & Native support, migrate to ortbConverter #15259 (bid adapter change)
• 7c28380d2 | Equativ Bid Adapter: skip invalid bid requests and address review comments #15322 (bid adapter change)
• 495a6b62d | Prebid 11.23.0 release (will cause merge conflicts)

❌ Conflicting Commits (require manual resolution)

• 374eb6403 | Bump actions/checkout from 6 to 7 #15271
• cc974ce6b | CI: check for and warn about possible missing polyfills #15268
• dcf5fa917 | PBS Adapter: Host company vendor consent check #15136

Post Sync Commits

• c3c11f0 | Tests: fix consentUtils_spec.js test-isolation gap -- pre-existing upstream test bug (relies on shared module state from tcfControl.ts, which never shares a CI chunk with this file), unrelated to any commit in this sync
• 9606b74 | Tests: adjust hostGvlid endpoint-selection tests for forced single endpoint -- setConfigDefaults() forces p1Consent/noP1Consent to the same URL in this fork, so the 3 ported tests could never observe the distinction they were written to check

[khang-vu-ttd]

Resolved 2 of 3 conflicting commits:

`639750b7f` (Bump actions/checkout from 6 to 7, #15271): two modify/delete conflicts, both resolved by keeping our side's deletion — `prebid-code-scanner.yml` (removed in PR #104, missing GitHub App credentials) and `PR-assignment.yml` (upstream's Prebid.org auto-reviewer-assignment bot workflow, needing `PR_BOT_ID`/`PR_BOT_PEM` secrets referenced nowhere else in this fork — we only ever adopted the first-stage `PR-assignment-deps.yml` that generates `dependencies.json`, never this second-stage bot step). Everything else auto-merged cleanly.

`0b480c7a7` (CI: check for and warn about possible missing polyfills, #15268): consolidates our `PR-assignment-deps.yml` into upstream's new `build-metadata.yml`, which fully replaces its `dependencies.json`-generation job and adds the new polyfill-diff-check feature. Accepted upstream's consolidation (deleted `PR-assignment-deps.yml`, added `build-metadata.yml`); kept `PR-assignment.yml` deleted per the same rationale as above.

[khang-vu-ttd]

Resolved c85d229c4 (PBS Adapter: Host company vendor consent check, #15136) — the trickiest of the three.

This commit bundles two things:

• A pure refactor (no behavior change): extracts getAcceptableFlags/getConsent/getPurposeDeclarations/DEFAULT_PURPOSE_DECLARATION/etc. out of modules/tcfControl.ts into a new shared libraries/consentManagement/consentUtils.ts, with modules/consentManagementTcf.ts updated to match. Verified byte-identical to upstream post-merge.
• A new opt-in feature: an optional hostGvlid config on s2sConfig that, when set, validates TCF purpose-1 consent for a specific vendor (via the new hasVendorPurposeConsent) instead of the generic check, when selecting the p1Consent/noP1Consent endpoint URL. Ported this onto openadsServerBidAdapter (our PBS-equivalent), adapting comments from "Prebid Server host" to "OpenAds Server host" to match this file's existing convention. This auto-merged in almost entirely cleanly — the only real conflict was the type-declaration comment block, resolved by keeping both our existing comment and the new hostGvlid property.

[khang-vu-ttd]

Fixed c3c11f016: consentUtils_spec.js's new hasVendorPurposeConsent test relied on shared module-level state (consentUtils.ts's defaultPurposeDeclaration) normally set by tcfControl.ts's setEnforcementConfig — but nothing guarantees that runs first, and in real CI chunking consentUtils_spec.js (libraries/) and tcfControl_spec.js (modules/) never share a chunk. So the test failed deterministically, not just in a narrow local run. Fixed by explicitly setting the default in a beforeEach. Verified against the exact CI chunk (TEST_CHUNKS=8 TEST_CHUNK=2): 682/682 passing.

This is a pre-existing upstream test bug, unrelated to anything renamed/reconciled in this fork — the merged consentUtils.ts/tcfControl.ts/consentManagementTcf.ts are byte-identical to upstream.

[khang-vu-ttd]

Fixed 9606b7439: the 3 ported hostGvlid endpoint selection tests configured distinct p1Consent/noP1Consent fixture URLs and asserted on which one got hit — but this fork's setConfigDefaults() unconditionally forces both keys to the same production URL (pre-existing behavior, already covered by tests earlier in this same spec file, lines 653-664), for both the auction and sync endpoints. So hostGvlid's vendor-specific consent check still runs correctly, but its result can never be observed via endpoint selection in this fork — there's nothing to select between.

Adjusted the 3 tests to assert against the actual forced default endpoint instead of custom fixture URLs. They still exercise hasVendorPurposeConsent's three distinct branches (vendor-specific denial, publisher-restriction override, GDPR-not-applicable bypass) without erroring, confirming the ported logic is sound even though its practical effect on endpoint choice is currently inert in this fork's architecture.