Sync with upstream prebid-server v4.9.0

.devcontainer/devcontainer.json

@@ -6,7 +6,7 @@
 		"dockerfile": "Dockerfile",
 		"args": {
 			// Update the VARIANT arg to pick a version of Go
-			"VARIANT": "1.24",
+			"VARIANT": "1.26",
 			// Options
 			"INSTALL_NODE": "false",
 			"NODE_VERSION": "lts/*"

.github/workflows/adapter-code-coverage-report.yml

@@ -0,0 +1,77 @@
+name: Adapter Code Coverage Report
+
+on:
+  workflow_run:
+    workflows: ["Adapter Code Coverage"]
+    types: [completed]
+
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  report-coverage:
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download Coverage Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: coverage-results
+          path: coverage-results
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Read PR Metadata
+        id: pr_metadata
+        run: |
+          echo "pr_number=$(cat coverage-results/pr-metadata/pr_number)" >> $GITHUB_OUTPUT
+          echo "head_sha=$(cat coverage-results/pr-metadata/head_sha)" >> $GITHUB_OUTPUT
+          echo "directories=$(cat coverage-results/pr-metadata/directories.json)" >> $GITHUB_OUTPUT
+          echo "coverage_dir=$(pwd)/coverage-results" >> $GITHUB_OUTPUT
+
+      - name: Checkout Coverage Preview Branch
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: coverage-preview
+          repository: prebid/prebid-server
+          path: preview-repo
+
+      - name: Upload Coverage Results
+        id: commit_coverage
+        run: |
+          timestamp=$(date +%s)
+          directory=preview-repo/.github/preview/${{ github.event.workflow_run.id }}_${timestamp}
+          mkdir -p $directory
+          cp -r coverage-results/*.html $directory/
+          cd preview-repo
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git add .github/preview/*
+          git commit -m 'Add coverage files for run ${{ github.event.workflow_run.id }}'
+          git push origin coverage-preview
+          echo "remote_coverage_preview_dir=.github/preview/${{ github.event.workflow_run.id }}_${timestamp}" >> $GITHUB_OUTPUT
+
+      - name: Add Coverage Summary To Pull Request
+        if: steps.commit_coverage.outputs.remote_coverage_preview_dir != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const utils = require('./.github/workflows/helpers/pull-request-utils.js')
+            const helper = utils.coverageHelper({
+              github, context,
+              headSha: '${{ steps.pr_metadata.outputs.head_sha }}', 
+              tmpCoverageDir: '${{ steps.pr_metadata.outputs.coverage_dir }}', 
+              remoteCoverageDir: '${{ steps.commit_coverage.outputs.remote_coverage_preview_dir }}',
+              prNumber: ${{ steps.pr_metadata.outputs.pr_number }}
+            })
+            const adapterDirectories = JSON.parse('${{ steps.pr_metadata.outputs.directories }}')
+            await helper.AddCoverageSummary(adapterDirectories)

.github/workflows/helpers/pull-request-utils.js

@@ -361,7 +361,7 @@ class coverageHelper {
     this.owner = input.context.repo.owner
     this.repo = input.context.repo.repo
     this.github = input.github
-    this.pullRequestNumber = input.context.payload.pull_request.number
+    this.pullRequestNumber = input.prNumber || input.context.payload.pull_request.number
     this.headSha = input.headSha
     this.previewBaseURL = `https://htmlpreview.github.io/?https://github.com/${this.owner}/${this.repo}/coverage-preview/${input.remoteCoverageDir}`
     this.tmpCoverDir = input.tmpCoverageDir

.github/workflows/scripts/codepath-notification

@@ -19,3 +19,4 @@ adapters/ix|imp_ix|ix.json|ix.yaml: pdu-supply-prebid@indexexchange.com
 medianet: prebid@media.net
 gumgum: prebid@gumgum.com
 kargo: kraken@kargo.com
+proxistore: proxistore-technics@proxistore.com

.github/workflows/security.yml

@@ -20,7 +20,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Run Trivy
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1  # v0.35.0
         with:
           scan-type: 'fs'
           ignore-unfixed: true

.github/workflows/validate-merge.yml

@@ -12,7 +12,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v5
       with:
-        go-version: 1.24.0
+        go-version: 1.26.2
 
     - name: Checkout Merged Branch
       uses: actions/checkout@v4

.github/workflows/validate.yml

@@ -10,7 +10,7 @@ jobs:
   validate:
     strategy:
       matrix:
-        go-version: [1.23.x, 1.24.x]
+        go-version: [1.25.x, 1.26.x]
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
 
@@ -31,3 +31,4 @@ jobs:
         ./validate.sh --nofmt --cov --race 10
       env:
         GO111MODULE: "on"
+        GOTOOLCHAIN: local

Dockerfile

@@ -1,10 +1,13 @@
-FROM ubuntu:22.04 AS build
+# BASE_IMAGE allows overriding the base image so the build can pull from an
+# internal mirror when docker.io is unreachable. Defaults to upstream ubuntu:22.04.
+ARG BASE_IMAGE=ubuntu:22.04
+FROM ${BASE_IMAGE} AS build
 RUN apt-get update && \
     apt-get -y upgrade && \
     apt-get install -y --no-install-recommends wget ca-certificates
 WORKDIR /tmp
-RUN wget https://dl.google.com/go/go1.24.0.linux-amd64.tar.gz && \
-    tar -xf go1.24.0.linux-amd64.tar.gz && \
+RUN wget https://dl.google.com/go/go1.26.2.linux-amd64.tar.gz && \
+    tar -xf go1.26.2.linux-amd64.tar.gz && \
     mv go /usr/local
 RUN mkdir -p /app/prebid-server/
 WORKDIR /app/prebid-server/
@@ -24,9 +27,9 @@ RUN go mod tidy
 RUN go mod vendor
 ARG TEST="true"
 RUN if [ "$TEST" != "false" ]; then ./validate.sh ; fi
-RUN go build -mod=vendor -ldflags "-X github.com/prebid/prebid-server/v3/version.Ver=`git describe --tags | sed 's/^v//'` -X github.com/prebid/prebid-server/v3/version.Rev=`git rev-parse HEAD`" .
+RUN go build -mod=vendor -ldflags "-X github.com/prebid/prebid-server/v4/version.Ver=`git describe --tags | sed 's/^v//'` -X github.com/prebid/prebid-server/v4/version.Rev=`git rev-parse HEAD`" .
 
-FROM ubuntu:22.04 AS release
+FROM ${BASE_IMAGE} AS release
 LABEL maintainer="hans.hjort@xandr.com" 
 WORKDIR /usr/local/bin/
 COPY --from=build /app/prebid-server .

Makefile

@@ -15,7 +15,7 @@ test: deps
 ifeq "$(adapter)" ""
 	./validate.sh
 else
-	go test github.com/prebid/prebid-server/v3/adapters/$(adapter) -bench=.
+	go test github.com/prebid/prebid-server/v4/adapters/$(adapter) -bench=.
 endif
 
 # build-modules generates modules/builder.go file which provides a list of all available modules

README.md

@@ -44,7 +44,7 @@ Ensure that you deploy the `/static` directory, as Prebid Server requires those
 
 ## Developing
 
-Prebid Server requires [Go](https://go.dev) version 1.23 or newer. You can develop on any operating system that Go supports; however, please note that our helper scripts are written in bash.
+Prebid Server requires [Go](https://go.dev) version 1.26.2 or newer. You can develop on any operating system that Go supports; however, please note that our helper scripts are written in bash.
 
 1. Clone The Repository
 ``` bash

account/account.go

@@ -6,13 +6,13 @@ import (
 
 	"github.com/prebid/go-gdpr/consentconstants"
 
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/errortypes"
-	"github.com/prebid/prebid-server/v3/metrics"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
-	"github.com/prebid/prebid-server/v3/stored_requests"
-	"github.com/prebid/prebid-server/v3/util/iputil"
-	"github.com/prebid/prebid-server/v3/util/jsonutil"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/errortypes"
+	"github.com/prebid/prebid-server/v4/metrics"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/stored_requests"
+	"github.com/prebid/prebid-server/v4/util/iputil"
+	"github.com/prebid/prebid-server/v4/util/jsonutil"
 )
 
 // GetAccount looks up the config.Account object referenced by the given accountID, with access rules applied

account/account_test.go

@@ -6,13 +6,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/errortypes"
-	"github.com/prebid/prebid-server/v3/metrics"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
-	"github.com/prebid/prebid-server/v3/stored_requests"
-	"github.com/prebid/prebid-server/v3/util/iputil"
-	"github.com/prebid/prebid-server/v3/util/ptrutil"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/errortypes"
+	"github.com/prebid/prebid-server/v4/metrics"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/stored_requests"
+	"github.com/prebid/prebid-server/v4/util/iputil"
+	"github.com/prebid/prebid-server/v4/util/ptrutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 )

adapters/33across/33across.go

@@ -7,11 +7,11 @@ import (
 
 	"github.com/prebid/openrtb/v20/adcom1"
 	"github.com/prebid/openrtb/v20/openrtb2"
-	"github.com/prebid/prebid-server/v3/adapters"
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/errortypes"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
-	"github.com/prebid/prebid-server/v3/util/jsonutil"
+	"github.com/prebid/prebid-server/v4/adapters"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/errortypes"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/util/jsonutil"
 )
 
 type TtxAdapter struct {

adapters/33across/33across_test.go

@@ -3,9 +3,9 @@ package ttx
 import (
 	"testing"
 
-	"github.com/prebid/prebid-server/v3/adapters/adapterstest"
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/adapters/adapterstest"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
 )
 
 func TestJsonSamples(t *testing.T) {

adapters/33across/params_test.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
 )
 
 // This file actually intends to test static/bidder-params/33across.json

adapters/aax/aax.go

@@ -7,11 +7,11 @@ import (
 	"net/url"
 
 	"github.com/prebid/openrtb/v20/openrtb2"
-	"github.com/prebid/prebid-server/v3/adapters"
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/errortypes"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
-	"github.com/prebid/prebid-server/v3/util/jsonutil"
+	"github.com/prebid/prebid-server/v4/adapters"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/errortypes"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/util/jsonutil"
 )
 
 type adapter struct {

adapters/aax/aax_test.go

@@ -5,9 +5,9 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/prebid/prebid-server/v3/adapters/adapterstest"
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/adapters/adapterstest"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
 )
 
 func TestJsonSamples(t *testing.T) {

adapters/aax/params_test.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
 )
 
 // This file actually intends to test static/bidder-params/aax.json

adapters/aceex/aceex.go

@@ -7,12 +7,12 @@ import (
 	"text/template"
 
 	"github.com/prebid/openrtb/v20/openrtb2"
-	"github.com/prebid/prebid-server/v3/adapters"
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/errortypes"
-	"github.com/prebid/prebid-server/v3/macros"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
-	"github.com/prebid/prebid-server/v3/util/jsonutil"
+	"github.com/prebid/prebid-server/v4/adapters"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/errortypes"
+	"github.com/prebid/prebid-server/v4/macros"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/util/jsonutil"
 )
 
 type adapter struct {

adapters/aceex/aceex_test.go

@@ -3,9 +3,9 @@ package aceex
 import (
 	"testing"
 
-	"github.com/prebid/prebid-server/v3/adapters/adapterstest"
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/adapters/adapterstest"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
 	"github.com/stretchr/testify/assert"
 )
 

adapters/aceex/params_test.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
 )
 
 var validParams = []string{

adapters/acuityads/acuityads.go

@@ -7,12 +7,13 @@ import (
 	"text/template"
 
 	"github.com/prebid/openrtb/v20/openrtb2"
-	"github.com/prebid/prebid-server/v3/adapters"
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/errortypes"
-	"github.com/prebid/prebid-server/v3/macros"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
-	"github.com/prebid/prebid-server/v3/util/jsonutil"
+	"github.com/prebid/prebid-server/v4/adapters"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/errortypes"
+	"github.com/prebid/prebid-server/v4/macros"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/util/jsonutil"
+	"github.com/prebid/prebid-server/v4/util/urlutil"
 )
 
 type AcuityAdsAdapter struct {
@@ -107,6 +108,9 @@ func (a *AcuityAdsAdapter) getImpressionExt(imp *openrtb2.Imp) (*openrtb_ext.Ext
 }
 
 func (a *AcuityAdsAdapter) buildEndpointURL(params *openrtb_ext.ExtAcuityAds) (string, error) {
+	if !urlutil.IsSafeHost(params.Host) {
+		return "", &errortypes.BadInput{Message: "Invalid Host"}
+	}
 	endpointParams := macros.EndpointTemplateParams{Host: params.Host, AccountID: params.AccountID}
 	return macros.ResolveMacros(a.endpoint, endpointParams)
 }

adapters/acuityads/acuityads_test.go

@@ -3,9 +3,9 @@ package acuityads
 import (
 	"testing"
 
-	"github.com/prebid/prebid-server/v3/adapters/adapterstest"
-	"github.com/prebid/prebid-server/v3/config"
-	"github.com/prebid/prebid-server/v3/openrtb_ext"
+	"github.com/prebid/prebid-server/v4/adapters/adapterstest"
+	"github.com/prebid/prebid-server/v4/config"
+	"github.com/prebid/prebid-server/v4/openrtb_ext"
 	"github.com/stretchr/testify/assert"
 )