Sync with upstream prebid-server v4.9.0

[zwl-williamzha]

Important

Merge with "Create a merge commit", not squash. This PR is a two-parent merge, and squashing it throws away the upstream ancestry again. That is exactly why this sync was hard: #109 was squashed, so the next sync would hit the same 225 conflicts.

Don't merge until the matching MSP PR is ready. MSP doesn't pick this up until its submodule pointer moves, and that PR has to move the pointer, switch every import to /v4, and port the modules to the new ModuleContext API at the same time. Moving the pointer alone breaks the build.

What this does

Merges upstream v4.9.0 (2026-08-25) into msp-2506. We were 137 upstream commits behind: the last sync (#109, Dec 2025) stopped at upstream f358e2472 (prebid#4085).

Because #109 was squash-merged, git no longer knew those 135 upstream commits were already in, so a straight merge conflicted on 225 files, most of them add/add on upstream's own adapters. The first commit fixes that: an -s ours merge of f358e2472 that records the ancestry without changing the tree. After it, the real merge conflicts on only 8 files. Before relying on that, I checked that #109 contains upstream's first 135 commits in order with none missing, so the ours merge doesn't drop anything.

Conflicts and how they were resolved

File	Resolution
go.mod / go.sum	Upstream versions, plus MSP's pyroscope-go/godeltaprof (and klauspost/compress, indirect)
config/config.go	Upstream's struct (adds Video, CookieSync), with MSPMetricsConfig kept
server/server.go	Upstream /v4 imports, with the msp/plugin import kept
router/admin.go	Upstream /v4 imports, with the godeltaprof pprof handler kept
metrics/prometheus/preload.go	MSP's version, so the #134 preload removal stays, with /v4 imports
static/bidder-info/thetradedesk.yaml	Both: upstream's openrtb.version: 2.6 and MSP's endpointCompression: GZIP
.github/workflows/adapter-code-coverage.yml	Stays deleted, as on msp-2506

Three MSP-only files that didn't conflict (exchange/msp_bidders.go, modules/msp_plugin.go, analytics/build/msp_plugin.go) had their imports changed from /v3 to /v4.

After the merge, the same 47 files differ from upstream as before the merge, and each of MSP's changes has the same line counts. The only exceptions are the resolutions above.

Worth knowing

• Security: upstream already ships golang.org/x/crypto v0.52.0 and buger/jsonparser v1.1.2, which closes the 16 MSP Dependabot alerts on those modules (ParticleMedia/msp alerts Add bid cpm summary metric #7–Fix vrtcal bid floor #9, Merge with release 0.136.0 #12–custom targeting #24).
• Module path is now github.com/prebid/prebid-server/v4, and the go directive is 1.25.0.
• Breaking for MSP modules: hookstage.ModuleContext is now a mutex-protected struct with Get/Set (Modules: Concurrency module context fix prebid/prebid-server#4603), not a map[string]any. The executor still merges each stage's returned context into the stored one, so MSP's "fresh context per stage" pattern still works; only the call syntax changes.
• v4.0.0 breaking changes (release notes) are mostly removed or renamed upstream adapters and the dropped supportCors user-sync option. None of them are MSP bidders.

Testing

• go build ./... and go vet ./... are clean.
• ./validate.sh --nofmt --cov --race 10: 710 packages pass, 0 fail.
• Against the matching MSP branch (imports on /v4, modules ported to the new ModuleContext):
  • All 26 plugins build with make plugins.
  • MSP's unit tests match master: 16 packages pass, and the same 6 pre-existing failures fail on master too.
  • go version -m shows every dependency shared by the server binary and each .so at the identical version (go1.26.8).
  • plugin.Open loads all 26 .so files from a binary built in this module.

Not yet run: e2e against a live local server, and stage.

🤖 Generated with Claude Code