Merge commit 'ac95edbaec2eb9361bb0e1a1ec8a8ffd45798056' into develop

.circleci/config.yml

@@ -7,7 +7,7 @@ aliases:
   - &environment
       docker:
         # specify the version you desire here
-        - image: cimg/node:16.20-browsers
+        - image: cimg/node:20.14.0-browsers
       resource_class: xlarge
         # Specify service dependencies here if necessary
         # CircleCI maintains a library of pre-built images
@@ -18,8 +18,6 @@ aliases:
   - &restore_dep_cache
       keys:
         - v1-dependencies-{{ checksum "package.json" }}
-        # fallback to using the latest cache if no exact match is found
-        - v1-dependencies-
 
   - &save_dep_cache
       paths:

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-ARG VARIANT="12"
+ARG VARIANT="20"
 FROM mcr.microsoft.com/vscode/devcontainers/javascript-node:${VARIANT}
 
 RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor > /usr/share/keyrings/yarn-archive-keyring.gpg

.eslintrc.js

@@ -83,6 +83,7 @@ module.exports = {
     files: key + '/**/*.js',
     rules: {
       'prebid/validate-imports': ['error', allowedModules[key]],
+      'prebid/no-innerText': ['error', allowedModules[key]],
       'no-restricted-globals': [
         'error',
         {
@@ -95,5 +96,16 @@ module.exports = {
     // code in other packages (such as plugins/eslint) is not "seen" by babel and its parser will complain.
     files: 'plugins/*/**/*.js',
     parser: 'esprima'
+  }, 
+  {
+    files: '**BidAdapter.js',
+    rules: {
+      'no-restricted-imports': [
+        'error', {
+          patterns: ["**/src/events.js",
+          "**/src/adloader.js"]
+        }
+      ]
+    }
   }])
 };

.github/workflows/jscpd.yml

@@ -1,6 +1,6 @@
 name: Check for Duplicated Code
 
-on: 
+on:
   pull_request_target:
     branches:
       - master
@@ -14,6 +14,7 @@ jobs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0  # Fetch all history for all branches
+        ref: ${{ github.event.pull_request.head.sha }}
 
     - name: Set up Node.js
       uses: actions/setup-node@v4
@@ -99,11 +100,14 @@ jobs:
           const fs = require('fs');
           const filteredReport = JSON.parse(fs.readFileSync('filtered-jscpd-report.json', 'utf8'));
           let comment = "Whoa there, partner! 🌵🤠 We wrangled some duplicated code in your PR:\n\n";
+          function link(dup) {
+             return `https://github.com/${{ github.event.repository.full_name }}/blob/${{ github.event.pull_request.head.sha }}/${dup.name}#L${dup.start}-L${dup.end - 1}`
+          }
           filteredReport.forEach(duplication => {
-            const firstFile = duplication.firstFile.name;
-            const secondFile = duplication.secondFile.name;
+            const firstFile = duplication.firstFile;
+            const secondFile = duplication.secondFile;
             const lines = duplication.lines;
-            comment += `- \`${firstFile}\` has ${lines} duplicated lines with \`${secondFile}\`\n`;
+            comment += `- [\`${firstFile.name}\`](${link(firstFile)}) has ${lines} duplicated lines with [\`${secondFile.name}\`](${link(secondFile)})\n`;
           });
           comment += "\nReducing code duplication by importing common functions from a library not only makes our code cleaner but also easier to maintain. Please move the common code from both files into a library and import it in each. Keep up the great work! 🚀";
           github.rest.issues.createComment({

.nvmrc

@@ -1 +1 @@
-12.16.1
+20.13.1

PR_REVIEW.md

@@ -23,10 +23,11 @@ General gulp commands include separate commands for serving the codebase on a bu
 - Checkout the branch (these instructions are available on the GitHub PR page as well).
 - Verify PR is a single change type. Example, refactor OR bugfix. If more than 1 type, ask submitter to break out requests.
 - Verify code under review has at least 80% unit test coverage. If legacy code doesn't have enough unit test coverage, require that additional unit tests to be included in the PR.
-- Verify tests are green in Travis-ci + local build by running `gulp serve` | `gulp test`
+- Verify tests are green in circle-ci + local build by running `gulp serve` | `gulp test`
 - Verify no code quality violations are present from linting (should be reported in terminal)
 - Make sure the code is not setting cookies or localstorage directly -- it must use the `StorageManager`.
 - Review for obvious errors or bad coding practice / use best judgement here.
+- Don't allow needless code duplication with other js files; require both files import common code. Do not allow commits designed to fool the code duplication checker.
 - If the change is a new feature / change to core prebid.js - review the change with a Tech Lead on the project and make sure they agree with the nature of change.
 - If the change results in needing updates to docs (such as public API change, module interface etc), add a label for "needs docs" and inform the submitter they must submit a docs PR to update the appropriate area of Prebid.org **before the PR can merge**. Help them with finding where the docs are located on prebid.org if needed. 
 - If all above is good, add a `LGTM` comment and, if the change is in PBS-core or is an important module like the prebidServerBidAdapter, request 1 additional core member to review.
@@ -51,20 +52,21 @@ Follow steps above for general review process. In addition, please verify the fo
 - If the adapter being submitted is an alias type, check with the bidder contact that is being aliased to make sure it's allowed.
 - All bidder parameter conventions must be followed:
     - Video params must be read from AdUnit.mediaTypes.video when available; however bidder config can override the ad unit. 
-    - First party data must be read from [getConfig('ortb2');](https://docs.prebid.org/dev-docs/publisher-api-reference/setConfig.html#setConfig-fpd).
+    - First party data must be read from the bid request object: bidrequest.ortb2
     - Adapters that accept a floor parameter must also support the [floors module](https://docs.prebid.org/dev-docs/modules/floors.html) -- look for a call to the `getFloor()` function.
     - Adapters cannot accept an schain parameter. Rather, they must look for the schain parameter at bidRequest.schain.
     - The bidderRequest.refererInfo.referer must be checked in addition to any bidder-specific parameter.
     - Page position must come from bidrequest.mediaTypes.banner.pos or bidrequest.mediaTypes.video.pos
-    - Global OpenRTB fields should come from [getConfig('ortb2');](https://docs.prebid.org/dev-docs/publisher-api-reference/setConfig.html#setConfig-fpd):
+    - Eids object is to be preferred to Userids object in the bid request, as the userid object may be removed in a future version
+    - Global OpenRTB fields should come from bidrequest.ortb2
         - bcat, battr, badv
     - Impression-specific OpenRTB fields should come from bidrequest.ortb2imp
         - instl
 - Below are some examples of bidder specific updates that should require docs update (in their dev-docs/bidders/BIDDER.md file):
-    - If they support the GDPR consentManagement module and TCF1, add `gdpr_supported: true`
-    - If they support the GDPR consentManagement module and TCF2, add `tcf2_supported: true`
+    - If they support the TCF consentManagementTcf module and TCF2, add `tcf2_supported: true`
     - If they support the US Privacy consentManagementUsp module, add `usp_supported: true`
-    - If they support one or more userId modules, add `userId: (list of supported vendors)`
+    - If they support the GPP consentManagementGpp module, add `gpp_supported: true`
+    - If they support one or more userId modules, add `userId: (list of supported vendors) or (all)`
     - If they support video and/or native mediaTypes add `media_types: video, native`. Note that display is added by default. If you don't support display, add "no-display" as the first entry, e.g. `media_types: no-display, native`
     - If they support COPPA, add `coppa_supported: true`
     - If they support SChain, add `schain_supported: true`
@@ -100,7 +102,7 @@ Follow steps above for general review process. In addition:
   - modules/userId/userId.md
 - tests can go either within the userId_spec.js file or in their own _spec file if they wish
 - GVLID is recommended in the *IdSystem file if they operate in EU
-- make sure example configurations align to the actual code (some modules use the userId storage settings and allow pub configuration, while others handle reading/writing cookies on their own, so should not include the storage params in examples)
+- make sure example configurations align to the actual code (some modules use the userId storage settings and allow pub configuration, while others handle reading/writing cookies on their own, so should not include the storage params in examples). This ability to write will be removed in a future version, see https://github.com/prebid/Prebid.js/issues/10710
 - the 3 available methods (getId, extendId, decode) should be used as they were intended
   - decode (required method) should not be making requests to retrieve a new ID, it should just be decoding a response
   - extendId (optional method) should not be making requests to retrieve a new ID, it should just be adding additional data to the id object
@@ -121,6 +123,7 @@ Follow steps above for general review process. In addition:
 - Confirm that the module
   - is not loading external code. If it is, escalate to the #prebid-js Slack channel. 
   - is reading `config` from the function signature rather than calling `getConfig`.
+  - Is practicing reasonable data minimization, eg not sending all eids over the wire without publisher whitelisting
   - is sending data to the bid request only as either First Party Data or in bidRequest.rtd.RTDPROVIDERCODE.
   - is making HTTPS requests as early as possible, but not more often than needed.
   - doesn't force bid adapters to load additional code.

allowedModules.js

@@ -1,7 +1,6 @@
 
 module.exports = {
   'modules': [
-    'criteo-direct-rsa-validate',
     'crypto-js',
     'live-connect' // Maintained by LiveIntent : https://github.com/liveintent-berlin/live-connect/
   ],

browsers.json

@@ -1,51 +1,51 @@
 {
-  "bs_edge_latest_windows_10": {
+  "bs_edge_latest_windows_11": {
     "base": "BrowserStack",
-    "os_version": "10",
+    "os_version": "11",
     "browser": "edge",
     "browser_version": "latest",
     "device": null,
     "os": "Windows"
   },
-  "bs_chrome_latest_windows_10": {
+  "bs_chrome_latest_windows_11": {
     "base": "BrowserStack",
-    "os_version": "10",
+    "os_version": "11",
     "browser": "chrome",
     "browser_version": "latest",
     "device": null,
     "os": "Windows"
   },
-  "bs_chrome_87_windows_10": {
+  "bs_chrome_107_windows_10": {
     "base": "BrowserStack",
     "os_version": "10",
     "browser": "chrome",
-    "browser_version": "87.0",
+    "browser_version": "107.0",
     "device": null,
     "os": "Windows"
   },
-  "bs_firefox_latest_windows_10": {
+  "bs_firefox_latest_windows_11": {
     "base": "BrowserStack",
-    "os_version": "10",
+    "os_version": "11",
     "browser": "firefox",
     "browser_version": "latest",
     "device": null,
     "os": "Windows"
   },
-  "bs_safari_latest_mac_bigsur": {
+  "bs_safari_latest_mac": {
     "base": "BrowserStack",
-    "os_version": "Big Sur",
+    "os_version": "Sonoma",
     "browser": "safari",
     "browser_version": "latest",
     "device": null,
     "os": "OS X"
   },
   "bs_safari_15_catalina": {
     "base": "BrowserStack",
-    "os_version": "Catalina",
+    "os_version": "Monterey",
     "browser": "safari",
-    "browser_version": "13.1",
+    "browser_version": "15.6",
     "device": null,
     "os": "OS X"
   }
-  
+
 }

creative/constants.js

@@ -1,6 +1,7 @@
 // eslint-disable-next-line prebid/validate-imports
-import { AD_RENDER_FAILED_REASON, EVENTS, MESSAGES } from '../src/constants.js';
+import {AD_RENDER_FAILED_REASON, EVENTS, MESSAGES} from '../src/constants.js';
 
+export {PB_LOCATOR} from '../src/constants.js';
 export const MESSAGE_REQUEST = MESSAGES.REQUEST;
 export const MESSAGE_RESPONSE = MESSAGES.RESPONSE;
 export const MESSAGE_EVENT = MESSAGES.EVENT;

creative/crossDomain.js

@@ -1,9 +1,11 @@
 import {
   ERROR_EXCEPTION,
-  EVENT_AD_RENDER_FAILED, EVENT_AD_RENDER_SUCCEEDED,
+  EVENT_AD_RENDER_FAILED,
+  EVENT_AD_RENDER_SUCCEEDED,
   MESSAGE_EVENT,
   MESSAGE_REQUEST,
-  MESSAGE_RESPONSE
+  MESSAGE_RESPONSE,
+  PB_LOCATOR
 } from './constants.js';
 
 const mkFrame = (() => {
@@ -24,14 +26,24 @@ const mkFrame = (() => {
   };
 })();
 
+function isPrebidWindow(win) {
+  return !!win.frames[PB_LOCATOR];
+}
+
 export function renderer(win) {
+  let target = win.parent;
+  while (target !== win.top && !isPrebidWindow(target)) {
+    target = target.parent;
+  }
+  if (!isPrebidWindow(target)) target = win.parent;
+
   return function ({adId, pubUrl, clickUrl}) {
     const pubDomain = new URL(pubUrl, window.location).origin;
 
     function sendMessage(type, payload, responseListener) {
       const channel = new MessageChannel();
       channel.port1.onmessage = guard(responseListener);
-      win.parent.postMessage(JSON.stringify(Object.assign({message: type, adId}, payload)), pubDomain, [channel.port2]);
+      target.postMessage(JSON.stringify(Object.assign({message: type, adId}, payload)), pubDomain, [channel.port2]);
     }
 
     function onError(e) {
@@ -77,7 +89,7 @@ export function renderer(win) {
           W.Promise.resolve(W.render(data, {sendMessage, mkFrame}, win)).then(
             () => sendMessage(MESSAGE_EVENT, {event: EVENT_AD_RENDER_SUCCEEDED}),
             onError
-          )
+          );
         });
         win.document.body.appendChild(renderer);
       }

gulpfile.js

@@ -147,6 +147,17 @@ function makeVerbose(config = webpackConfig) {
   });
 }
 
+function prebidSource(webpackCfg) {
+  var externalModules = helpers.getArgModules();
+
+  const analyticsSources = helpers.getAnalyticsSources();
+  const moduleSources = helpers.getModulePaths(externalModules);
+
+  return gulp.src([].concat(moduleSources, analyticsSources, 'src/prebid.js'))
+    .pipe(helpers.nameModules(externalModules))
+    .pipe(webpackStream(webpackCfg, webpack));
+}
+
 function makeDevpackPkg(config = webpackConfig) {
   return function() {
     var cloned = _.cloneDeep(config);
@@ -163,14 +174,7 @@ function makeDevpackPkg(config = webpackConfig) {
       .filter((use) => use.loader === 'babel-loader')
       .forEach((use) => use.options = Object.assign({}, use.options, babelConfig));
 
-    var externalModules = helpers.getArgModules();
-
-    const analyticsSources = helpers.getAnalyticsSources();
-    const moduleSources = helpers.getModulePaths(externalModules);
-
-    return gulp.src([].concat(moduleSources, analyticsSources, 'src/prebid.js'))
-      .pipe(helpers.nameModules(externalModules))
-      .pipe(webpackStream(cloned, webpack))
+    return prebidSource(cloned)
       .pipe(gulp.dest('build/dev'))
       .pipe(connect.reload());
   }
@@ -183,14 +187,7 @@ function makeWebpackPkg(config = webpackConfig) {
   }
 
   return function buildBundle() {
-    var externalModules = helpers.getArgModules();
-
-    const analyticsSources = helpers.getAnalyticsSources();
-    const moduleSources = helpers.getModulePaths(externalModules);
-
-    return gulp.src([].concat(moduleSources, analyticsSources, 'src/prebid.js'))
-      .pipe(helpers.nameModules(externalModules))
-      .pipe(webpackStream(cloned, webpack))
+    return prebidSource(cloned)
       .pipe(gulp.dest('build/dist'));
   }
 }
@@ -413,7 +410,9 @@ function runKarma(options, done) {
   // the karma server appears to leak memory; starting it multiple times in a row will run out of heap
   // here we run it in a separate process to bypass the problem
   options = Object.assign({browsers: helpers.parseBrowserArgs(argv)}, options)
-  const child = fork('./karmaRunner.js');
+  const child = fork('./karmaRunner.js', null, {
+    env: Object.assign({}, options.env, process.env)
+  });
   child.on('exit', (exitCode) => {
     if (exitCode) {
       done(new Error('Karma tests failed with exit code ' + exitCode));
@@ -426,7 +425,15 @@ function runKarma(options, done) {
 
 // If --file "<path-to-test-file>" is given, the task will only run tests in the specified file.
 function testCoverage(done) {
-  runKarma({coverage: true, browserstack: false, watch: false, file: argv.file}, done);
+  runKarma({
+    coverage: true,
+    browserstack: false,
+    watch: false,
+    file: argv.file,
+    env: {
+      NODE_OPTIONS: '--max-old-space-size=8096'
+    }
+  }, done);
 }
 
 function coveralls() { // 2nd arg is a dependency: 'test' must be finished