Repository navigation
upstream-sync: sync Prebid.js 11.31.0 → 11.32.0 - #118
Open
openads-sync-bot[bot] wants to merge 10 commits into
Open
openads-sync-bot[bot] wants to merge 10 commits into
openads-sync-bot[bot] wants to merge 10 commits into
Conversation
![null[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…dance (#15542) * Build system: cache the precompilation babel pass `gulp precompile` re-transpiled the whole source tree on every cold invocation. `gulp.lastRun` is per-process state, so the existing `since:` filters made `watch` / `serve-*` incremental and did nothing for a fresh CLI run. Babel was ~16s of a ~20s precompile. Cache it on disk, per file, keyed on the file's contents and on the build configuration - so that repeat runs are cheap without anyone needing to know a cache exists: no new flags, no hygiene rules, and no obligations on steps added later. - gulp.cache.js: `cachedPipeline` splits the source stream into hits and misses, runs the transform on misses only, and merges the hits back in before `dest`. The source glob still decides which files exist, so a stale entry in the cache is never enumerated - pruning it is disk housekeeping, not correctness. - `precompilationKey` is both what `babelPrecomp` memoizes on and the name of its cache directory, so the two cannot drift apart. It hashes the resolved options, since `disableFeatures`, `distUrlBase` and `polyfills` all default from `argv`. - `dist/src` is now built whole from empty on every cold run, which makes orphaned output structurally impossible. Previously a deleted module kept its `dist/src/public` entry point - which ships - a deleted spec kept running via `require.context`, and a stale `.d.ts` stayed in the public type summary. The wipe is skipped when this process has already precompiled, so `watch` and `serve-*` behave exactly as before. - tsconfig.json: move the `tsc --incremental` buildinfo out of `outDir`, where the wipe would delete it and `ts-dev` would silently do a full compile. - generateTypeSummary: sort the globbed declarations, so the summaries no longer vary with directory order now that the tree is rebuilt each run. Cold `gulp precompile` is unchanged at ~21s; warm is ~5.6s. Warm output is byte-identical to cold, and identical to master's except for the two type summaries that are now sorted (same imports, stable order). gulp lint: passes. gulp test-build-logic: 39 passing, including 7 new specs for `cachedPipeline`. gulp test-only-nobuild: 24386 passing. gulp test-all-features-disabled-nobuild: 23820 passing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Build system: keep caches out of `clean`, key webpack caches by configuration `clean` deleted `.cache` along with `build` and `dist`, so every task starting with it - `test`, `test-coverage`, all four `serve*`, `serve-e2e*`, `e2e-test` - discarded the precompilation, webpack and babel-loader caches before anything could use them. `clean` now leaves them alone, and a new `clean-cache` removes them deliberately, which is what a change to the build system itself calls for. Caches surviving `clean` then exposed a pre-existing bug. `dist/src` holds one feature variant at a time, at the same paths, and `gulp.dest` carries each source file's mtime over - so two variants are indistinguishable to webpack, and it served modules compiled from whichever variant it saw first. `gulp test` was already exposed, building both variants in one invocation with a single `clean`. Every cache is now keyed on the build configuration. `precompilationKey` moves into gulp.cache.js, which owns how the build is keyed; precompilation stamps the tree it produces with that key; webpack.common.js versions the bundle caches on it, plus `--ES5`, which decides the loader rules it adds; and karma versions `.cache/webpack-test` on the stamp rather than on argv, since `test-all-features-disabled` and `serve-and-test` set the variant directly where argv cannot see it. An unstamped tree disables the karma cache rather than risk reusing the wrong entries. Verified for both webpack passes, each against a control confirming the two variants do produce different output: building variant B with the cache warmed by variant A now yields byte-identical output to building B cold, where before it yielded A's. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Build system: let `gulp lint` take a file subset `gulp lint` could only lint the whole repo, so linting a few changed files meant calling eslint directly - and a bare `npx eslint` without `--cache` *deletes* .eslintcache, making the next full run pay for a rebuild. `gulp lint --files a,b` lints a subset with the cache flags already applied; comma separated, the same shape as `--modules`. Calling eslint directly stays perfectly fine, and CI deliberately keeps doing so: it starts from a fresh checkout with no cache to lose, and it keeps eslint.config.js authoritative rather than letting lint configuration accumulate in this task. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Build system: emit declarations into the cache, and always incrementally `tsc` emitted declarations into `dist/src` while its buildinfo lived under `.cache`, so the two disagreed the moment `precompile` emptied `dist/src`: with a warm buildinfo tsc skipped emitting declarations it believed it had already written, and the tree ended up with 118 of 379. It escaped because only `ts-dev` was incremental, so the partial emit happened on the dev path alone - and the dev series omits `ts-strict` and `check-declarations` entirely. Had `check-declarations` run it would have caught this: the missing set includes the core entry it resolves, and it errors outright when that is absent. What it would *not* have caught is a partial set elsewhere - removing 132 module declarations by hand leaves it passing - so it guards the entry point, not the completeness of the type surface. `outDir` now sits beside the buildinfo under `.cache/ts`, so tsc's outputs and its incremental state survive the wipe together, and `precompile` copies the declarations into `dist/src` afterwards. Same shape as the babel cache: build into the cache, materialise into the tree. The copy is driven by the sources, not by the cache: tsc never deletes an output whose input is gone, so copying wholesale would restore orphan declarations that `check-declarations` type-checks and `generateTypeSummary` imports, keeping deleted modules in the published type surface. What gets skipped is logged, because the test - does `<name>.ts` exist on disk - would also skip a `.ts` generated during the build, and that case is a missing declaration rather than housekeeping. `ts` and `ts-dev` collapse into one always-incremental task; with the buildinfo coherent there is nothing for a non-incremental variant to protect against. The gain is a pre-warmed local build - CI starts from a fresh checkout and restores no `.cache`, so it is unaffected. Measured: 379 declarations with a cold buildinfo, a warm buildinfo over a wiped tree, and on the dev path; `tsc` 2.3s cold and ~0.5s warm; a warm prod `precompile` 3.3s, down from 4.5s. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Documentation: rewrite the agent command guidance The command instructions were spread across three sections that contradicted each other, and several were wrong. Verified against the build rather than transcribed: - "Use `gulp serve-and-test --file <spec>` or `gulp test --file` so Babel processes only the specified files" was false on both counts. Both tasks begin with `clean` and a whole-tree precompile; `--file` is read only by the karma config, where it selects which specs to load. And `serve-and-test` runs karma with `singleRun: false`, so it never exits - an agent told to use it for a check hangs. - `gulp test --file <spec>` was recommended per changed spec. It is the slowest way to run one spec (`clean`, a repo-wide auto-fixing lint, two precompiles, the spec twice) and it cannot validate anything: with `--file`, karma loads only that spec, so nothing about specs leaking global state is exercised - which is what CI checks. - `gulp review-start` was removed in #13501. - `submodules.json` does not exist; it is `modules/.submodules.json`, and only submodules of `userId`, `rtdModule`, `fpdModule` and `videoModule` register there. - The three core type-reference paths are TypeScript now, so every documented path 404s: `src/adapterManager.ts`, `src/adapters/bidderFactory.ts`, `src/userSync.ts`. - `TEST_CHUNKS` was described as something to switch on; it is on by default, its three siblings were undocumented, and all four are ignored when `--file` is given. - "Do not submit pr's with changes to creative.html or creative.js" named nothing that exists - no `creative.js` has been tracked since #955. Generalised to the actual rule: do not hand-edit tracked generated files, because `gulp build-release` regenerates and commits them. Each one says so in its opening lines, so the rule leans on that notice rather than on a list that will rot. The three sections are replaced by one table of what to run per goal, plus a list of the traps. Two of those are newly documented: `--coverage=false` silently *enables* coverage (yargs yields the string "false", which is truthy), and `--disable VIDEO` also switches `GREEDY` back on, because the list replaces the default rather than adding to it. Coverage had a threshold stated in three places and no method stated anywhere, and both documented report paths were wrong. The table now carries a measured procedure, and distinguishes "is my change covered" - one spec, one lcov file - from "does this file meet 80%", which needs the chunks merged, because a file is exercised by specs in different chunks and any single chunk understates it. Durations are gone throughout. They were wrong in the direction that matters - the file told agents to budget fifteen minutes and poll - and any number written today goes stale; the caching work this week moved one of them fourfold. Relative cost and the reason for it are stated instead. Where facts have an owner elsewhere they are linked, not restated: the release and SemVer labels now point at PR_REVIEW.md, which is how `bugfix` came to be missing here. Commands go the other way - this file says it is authoritative for them, because CONTRIBUTING.md and PR_REVIEW.md still carry stale ones. This PR deliberately breaks the rule against changing root `.md` files, which is the only way to fix that file. The rule now states its own exception, so a reviewer can tell drift from repair. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Build system: test the precompilation cache key and declaration copy Both of these fail quietly when they break, which is the argument for covering them: a key that stops distinguishing two builds lets webpack serve one variant's modules to the other, and a declaration copy that stops skipping orphans puts deleted modules back into the published type surface. Neither shows up as a failing build. `precompilationKey` is checked against every input the output depends on - the feature set and its ordering, dev vs production, the chunk URL base, and `LiveConnectMode`, which plugins/pbjsGlobals.js substitutes into the emitted code. The stamp is checked for the round trip and for reading as null on an unstamped tree, which is what makes karma turn its filesystem cache off rather than key on nothing. `copyDeclarations` is checked for copying a declaration whose source is present, skipping one whose source is gone, and leaving the orphan in the cache rather than deleting it. It needed exporting to be reachable from a test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Build system: make karma's webpack cache work, for single-spec runs `.cache/webpack-test` was configured but never written. Nothing closes the compiler in a single run - karma-webpack registers `compiler.close()`, which is what flushes the cache, only on its watch branch, and that branch needs `watch: true` in the webpack options, which karma-webpack's own defaults set to false. So the only path to disk is webpack's idle timer, whose initial store defaults to 5s, and a `--file` run finishes in about two seconds and then exits through `karmaRunner`'s `process.exit()`. The cache was therefore populated only by long multi-chunk runs and never by the fast loop it would help. Zeroing the idle timeouts fixes that: a single spec compiles in ~170ms warm against ~715ms cold. Restricted to `--file` runs, because a store rewrites the cache for the compilation that just ran. The full suite is eight compilations that between them grow it to ~800MB while saving under 10% (76s to 69s), and the two patterns evict each other - measured before this restriction, a single spec after a full suite compiled in 240ms rather than 170ms, and a full suite after a single spec pushed 33MB to 345MB. Gated, the cache stays at 33MB and a full suite leaves it untouched. The flag has to be passed explicitly: for a full run `karmaRunner` hands each chunk of the suite to `karmaConfMaker` through the same `file` argument that carries a single spec, so the config cannot tell the two apart - both arrive as arrays. Watch mode keeps webpack's default timeouts: that process lives long enough for them to fire on their own, and storing after every rebuild would put the cache write into the save loop. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Build system: fix three cache defects found in review **`gulp test` was broken.** It precompiles two feature variants back to back in one process, and `cleanPrecompiled` wiped `dist/src` for each of them. The second wipe emptied the tree while `copyVerbatim`, `generateMetadataModules`, `generatePublicModules` and `generateCreativeRenderers` were all holding `gulp.lastRun(...)` timestamps from the first pass, so they saw unchanged inputs and skipped, and nothing put the `.json` files, metadata modules or public modules back. It failed on the first casualty - `generateGlobalDef` writing into a directory that no longer existed. The wipe now happens once per process: it exists to sweep orphans out of a tree left by an *earlier* run, and a variant switch does not need it, because everything configuration-dependent is rebuilt regardless while everything else is already correct on disk. **The cache key missed Babel's external inputs.** `plugins/pbjsGlobals.js` substitutes `package.json`'s version into the output, and `plugins/callerContext.js` and `plugins/gvlPurposes.js` read `metadata/modules/*.json` - so a change to either altered what was emitted while leaving every source file's own content hash untouched, and a release build on a warm cache would have emitted the previous version number. Both are now digested into the key, whole rather than field by field: keying on the fields in use today would invalidate less often but would quietly stop covering a plugin that starts reading something else, and that failure is silent. `build-release` and `prepare-release` also begin with `clean-cache`, so the paths that publish never depend on the key being complete. **`--polyfills` produced a partial report.** `plugins/polyfills.js` accumulates across every file it visits and writes a summary of the lot, which is not the pure per-file transform `cachedPipeline` requires: only misses reach Babel, so the summary covered just those, or was absent entirely when every file hit. That build now bypasses the cache. Only `build-metadata.yml` passes the flag, so the exposure was CI-only. Tests: `externalInputsDigest` is exercised through injected paths against a scratch tree, so nothing touches `package.json` or `metadata/`, plus one check that the real digest is carried in the real key. Verified: `gulp test` exits 0 with both passes intact (23,820 and 24,386 tests); `gulp build --polyfills` twice yields an identical 1,371-file summary; a warm `precompile` is still ~3s; `gulp test-build-logic` 56 passing; lint clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * nice try --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…data block merge collapse (#15319) * Stackup RTD Module: disclose sessionStorage cache keys * Stackup RTD Provider: fix merge collapse of same-name ortb2 data blocks Distinguish site.content.data and user.data blocks by name + segtax + dimension instead of name alone. StackUP emits multiple blocks under a single provider name (e.g. several segtax:501 user dimensions all named data.stackup-ai.com); keying on name alone caused siblings to overwrite each other, leaving only the last block. * Stackup RTD Provider: accept segtax allowlist (4, 501, 502, 600) Replace the strict segtax === 502 check with an allowlist of the taxonomies StackUP emits: 4 (IAB Audience), 501 (legacy audience), 502 (content), 600 (publisher FPD). Validation now skips blocks with an unrecognised segtax instead of rejecting the whole payload, and such blocks are filtered out before merge so only allowlisted taxonomies reach ortb2. Broaden the segtax type to a StackupSegtax union and update tests and docs to cover the 600/4 blocks and the drop-unknown behavior. * pass through data with segtax 7 and mirror into legacy fields if permitted * accept all segtax categories from the backend * stackupRtdProvider: implement review findings * stackupRtdProvider: guard site.cattax across cat/sectioncat, validate segtax positivity --------- Co-authored-by: Nicolas Kogler <nicolas@stackup-ai.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.3 to 4.37.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.3...v4.37.9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…onse enforcement (#15566) addBidResponseHook() (the bid-response-side floor enforcement path) did not check floorInfo.floorRuleValue for null before enforcing a floor. A rule value of null is a documented, tested feature meaning "no floor for this match" (see the "setting null as rule value" describe block, and getFloor()'s own `if (floorInfo.floorRuleValue === null) return null;` check at modules/priceFloors.ts). getFirstMatchingFloor() computes matchingFloor as `Math.max(matchingData.floorMin, matchingData.floorRuleValue)`. Since Math.max coerces null to 0, a configured floorMin (the publisher's global safety-net minimum) silently overrode the rule's explicit null and became the enforced floor for that bid. This is inconsistent with getFloor() (the client-facing floor exposed to bidder adapters), which already short-circuits on a null rule value regardless of floorMin - so a bid could be told it has no floor via getFloor(), yet still be rejected post-response by addBidResponseHook() for being below floorMin. Added the same null check used by getFloor() to addBidResponseHook(), before any currency/adjustment work, so a bid matching an explicit null rule is never floored, consistent with getFloor()'s existing behavior. Added a regression test asserting a bid below a configured floorMin is not rejected when the matching rule value is null. Verified the test fails against the unmodified code (bid incorrectly rejected against floorMin) and passes with the fix. npx gulp lint --files modules/priceFloors.ts,test/spec/modules/priceFloors_spec.js: clean. npx gulp test-only (all 8 chunks): passing.
…d (#15567) populateSubmoduleId() computed refreshNeeded from `new Date(getStoredValue(submodule, 'last')).getTime()`. When no `_last` value has ever been stored for an id (e.g. it was saved before refreshInSeconds was configured, since setValueInLocalStorage/setValueInCookie only write `_last` when storage.refreshInSeconds is already set at save time), `getStoredValue` returns undefined, `new Date(undefined)` is an Invalid Date, and an Invalid Date object is still truthy in JS. So the old `storedDate && (Date.now() - storedDate.getTime() > ...)` check evaluated `Date.now() - NaN > x`, which is always false: refreshNeeded stayed false forever, silently disabling the refresh for that id until consent changed or a forced refresh occurred. Fixes it by checking `isNaN(lastUpdated)` explicitly, so a missing/invalid _last is treated as due for a refresh. Added a regression test simulating an id/expiry pair with no _last entry and refreshInSeconds configured, asserting the submodule's getId is invoked.
…NDORLESS_GVLID (#15558) * Adjust the typings of the user id#gvlid * Fxing build errors after switching gvlid to either a number or a symbol
Contributor
|
This PR introduces changes that may not work on all browsers. According to Babel, the following polyfills may be needed, and they are not automatically included:
The best way to address this is to provide good test coverage, as normal PR checks run unit tests on older browsers. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prebid.js Sync:
11.31.0→11.32.0This PR was auto-generated by the Sync with Upstream Prebid.js workflow.
Prebid 11.32.0 Release Page
✅ Applied Commits
⏭️ Skipped Commits
These commits were intentionally skipped because they made changes to files matching
BidAdapter:❌ Conflicting Commits (require manual resolution)