Important notice

This release includes a security update that adds a validation to bidder adapters with dynamic hostnames to avoid the possibility of hostname forgery. This has a small chance of impacting exotic Prebid Server host configurations, as certain characters in the hostname are now prohibited. Please consult the list of bidder adapters that were affected by this change here #4522 .

Security updates

• Validate url domain and path (#4522)

What’s Changed

• Core: Log bundle for app channel (#4515)
• Core: TCF 2.3 Disclosed Vendors Support (#4442)
• Bugfix: TcfV1 and DisclosedVendors section (#4512)

Vendor-Specific Updates

• LI module: Use matcher instead of source for eid premission (#4487)
• New Adapter: Adsmovil (#4504)
• New Adapter: Alliance Gravity (#4502)
• New Adapter: BeOp (#4476)
• Alkimi: Adding alkimi vendor-id and user-sync url modification (#4490)
• Seedtag: adds ron id support for seedtag adapter (#4466)
• Medianet: Update cookie sync url (#4443)
• Add cookie family name to 360playvid adapter config (#4489)

Housekeeping

• Dependency: Update GPP library (#4441)

Contributors

@CTMBNara, @Lightwood13, @VelRaj21, @akshatgmnet, @peixunzhang, @przemkaczmarek, @sangarbe and @Net-burst

What’s Changed

• Events: Add new request.ext.prebid.events.enabled toggle (#4479)

Housekeeping

• GitHub: Bump Trivy Security Scanner (#4439)
• Housekeeping: Fix flaky Gpp test (#4474)

Vendor-Specific Updates

• New Adapter: MyCodeMedia - Teqblaze alias (#4471)
• 51Degrees module: extend device detection module with new fields (#4458)
• IX adapter: Handle missing interstitial formats (#4459)
• New Adapter: Harrenmedia - Adverxo alias (#4472)
• New Adapter: Harion - teqblaze alias (#4473)
• Ybidder: New Nexx360 alias (#4467)
• Nativo: Add optional placementId parameter and Prebid Renderer in response (#4380)
• LiveIntent module: Fixing permission logic (#4389)
• New Adapter: 360playvid (#4361)

Contributors

@And1sS, @Net-burst, @SuperIzya, @jcerone, @osulzhenko, @przemkaczmarek, @rafataveira and @zxPhoenix

Housekeeping

• Housekeeping: Update localstack-s3 image for functional tests (#4437)

Vendor-Specific Updates

• New Adapter: TrustX (#4428)
• Mobkoi: Always set TagId with placementId (#4435)
• Kargo: update endpoint to krk2.kargo.com (#4431)
• OMS: Update default publisher ID parameter (#4425)

Contributors

@Lightwood13, @Net-burst, @andresmonc, @osulzhenko and @przemkaczmarek

Housekeeping

• Bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 in /.github/workflows (#4391)
• Housekeeping: Bump Spring Boot minor version (#4387)

Vendor-Specific Updates

• New Adapter: Bidfuse (#4370)
• OMS: Add {{PublisherId}} macro (#4409)
• Xapads: Fix misplaced GVL id (#4398)
• Teal: Add GPP params to usersync (#4379)
• Missena: add GPP params to cookie sync URL (#4383)
• Nexx360: Add usersync (#4396)
• Epsilon: pass prebid server version (#4392)
• Mobilefuse: Add site media types (#4369)
• Flipp: Update endpoint to not use cdn (#4368)
• AdsInteractive: Change to aliases (#4362)
• Adipolo: Add GVL ID (#4397)

Contributors

@CTMBNara, @Net-burst, @dependabot[bot], @dimashirokov, @johnwier, @ollyburns, @osulzhenko, @przemkaczmarek, @ysfbsf and dependabot[bot]

Vendor-Specific Updates

• LiveIntent Module: EID permissions (#4315)
• Teal: new adapter (#4350)
• Aso: Add user sync endpoint to adapter and aliases (#4353)
• New Adapter: Clydo (#4299)
• Adot: Constrain publisher path to an enum list (#4354)
• AdOcean: Remove adapter (#4355)
• Migrate ProgX alias from Vidazoo to Teqblaze adapter (#4356)
• Remove Vimayx alias from SmartHub adapter (#4363)
• Remove Mobupps alias (#4364)
• New Adapter: RadiantFusion - Attekmi alias (#4365)
• Nexx360: Preserve custom imp.ext fields and add vendor id (#4359)

Contributors

@Lightwood13, @Net-burst, @SuperIzya, @ollyburns and @przemkaczmarek

What’s Changed

• Core: EID Permissions extension (#4349)
• Refactoring: Add bidder request post-processing (#4322)
• CI: Update GitHub workflows (#4351)
• CI: Fix vulnerability in cross-repo-issue GitHub action (#4324)

Vendor-Specific Updates

• RTBHouse: Extract tagid from Imp fields (#4306)
• Ogury: Allow inventory mapping for in-app traffic. (#4321)
• StroeerCore: Use bid.ext as-is from the response (#4317)
• New adapter: Rename adoppler bidder adapter to elementaltv add adoppler as alias t… (#4326)
• Adagio: Remove hardcoded seat name (#4319)
• Adagio: Enable site capability (#4320)
• Optidigital: Add GPP support (#4333)

Contributors

@CTMBNara, @Net-burst, @crepi, @osulzhenko, @pavel-ptashyts, @philipwatson, @pjaworski-rtbh, @przemkaczmarek and @zxPhoenix

What’s Changed

• Core: Support GPP USNat v2 (#3690)
• Core: Decrease the version of the InfluxDB metrics (#4292)
• Rule Engine: Fix eviction policy for rule cache (#4308)
• Tests: Remove post in pr-java-ci.yml (#4307)
• Tests: Fix flaky GPP tests and refactor code (#4309)
• Tests: Update pr-java/functional-ci workflow (#3904)

Vendor-Specific Updates

• CWire: Add userSync (#4288)
• Bugfix: incorrect naming in userSync configs (#4305)
• Criteo: Set geoscope to global (#4303)
• Sharethrough: Add geoscope to config (#4302)
• Smaato: Add geoscope to bidder info (#4301)
• Seedtag: sets bid request's currency to USD (#4296)
• Consumable: updated yaml config (#4139)

Contributors

@And1sS, @AntoxaAntoxic, @EmilNadimanov, @Net-burst, @marki1an, @osulzhenko, @richardngo-consumable and @sangarbe

What’s Changed

• Housekeeping: Bump Groovy-related dependencies (#4276)

Vendor-Specific Updates

• Core: Resolve bean conflict in modules (#4289)
• LiveIntent: Limiting LI ids to configured bidders (#4281)
• Sparteo: add required query params to adapter endpoint (#4225)
• New BoldwinRapid Adapter (#4285)
• New Adapter: Nativery (#4223)
• Nextmillennium: New fields and adapter version update (#4246)
• Adnuntius: Pass targeting to ad server (#4282)
• BidTheatre: Update endpoint and add redirect user sync (#4283)

Contributors

@AntoxaAntoxic, @Net-burst, @SuperIzya, @osulzhenko, @przemkaczmarek and @t-sormonte

What’s Changed

• Core: Add video cache TTL enforcement for /vtrack endpoint (#4136)
• Core: Add module Storage Metrics (#4151)

Vendor-Specific Updates

• Adagio Bidder: Fix Typo (#4275)
• Adagio: Remove max length on params (#4263)
• New adapter: Gravite - reqBlaze Alias (#4273)
• New Adapter: Performist - Limelight Alias (#4272)
• Unruly: Include GPID in request payload (#4259)
• Teqblaze Alias: AppStockSSP (#4265)
• RTBHouse: Add PMP Removal and Publisher ID Extraction (#4229)
• LiveIntent: LI analytics adapter (#4154)
• CpmStar: Adapter Update bidder implementation to allow imp.ext passth… (#4228)
• Rule Engine: Change level for rule parsing log (#4262)
• Omnidex: Add GVL ID (#4266)
• Connatix Bid Adapter: Support GZIP (#4258)

Contributors

@And1sS, @AntoxaAntoxic, @Net-burst, @SuperIzya, @karimMourra, @piotrj-rtbh, @przemkaczmarek and @zxPhoenix

New Features

• Core: Support GET on the /vtrack endpoint (#4073)

Vendor-Specific Updates

• Showheroes: Rename test file (#4253)
• Showheroes bidder (#4190)
• Eplanning: Add support for adomain (#4227)
• mobkoi: remove url endpoint override (#4224)
• optable-targeting: Optimize Optable requests for more precise ranging and performance insights (#4222)
• Sovrn: pass-through imp.ext unaltered (#4197)
• SmileWanted: endpoint now supports dynamic zoneId and integrates prebid server technology (#4109)
• Yandex Bid Adapter : add support for video ads (#4004)
• Improve Digital adapter: switch to HTTPS (#4226)
• Contxtful: New Adapter (#4240)
• Adkernel Alias: Xapads (#4242)
• MetaX: Add redirect user sync (#4243)
• KueezRTB: Remove additionalProperties from schema (#4244)
• fwssp: Add iframe usersync (#4245)
• Kargo: Add email to codepath notification workflow (#4247)

Contributors

@AntoxaAntoxic, @CTMBNara, @DiMurer, @EmilNadimanov, @FilipStamenkovic, @Net-burst, @QuentinGallard, @jbartek25, @mbonnafon, @przemkaczmarek and @softcoder594