permutive · snyk-bot · Nov 3, 2021 · Mar 29, 2022 · Jul 22, 2022 · Mar 17, 2023
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -36,26 +36,30 @@ aliases:
 
   - &run_endtoend_test
       name: BrowserStack End to end testing
-      command: echo "127.0.0.1 test.localhost" | sudo tee -a /etc/hosts && gulp e2e-test --host=test.localhost
+      command: gulp e2e-test
 
   # Download and run BrowserStack local
-  - &setup_browserstack
-      name : Download BrowserStack Local binary and start it.
+  - &download_browserstack
+      name : Download BrowserStackLocal binary
       command : |
         # Download the browserstack binary file
         wget "https://www.browserstack.com/browserstack-local/BrowserStackLocal-linux-x64.zip"
         # Unzip it
         unzip BrowserStackLocal-linux-x64.zip
-        # Run the file with user's access key
-        ./BrowserStackLocal ${BROWSERSTACK_ACCESS_KEY} &
+
+  - &start_browserstack
+    name: Start BrowserStackLocal
+    command: ./BrowserStackLocal --key ${BROWSERSTACK_ACCESS_KEY} --automate-only --local-identifier ${CIRCLE_WORKFLOW_JOB_ID}
+    background: true
 
   - &unit_test_steps
     - checkout
     - restore_cache: *restore_dep_cache
     - run: npm ci
     - save_cache: *save_dep_cache
     - run: *install
-    - run: *setup_browserstack
+    - run: *download_browserstack
+    - run: *start_browserstack
     - run: *run_unit_test
 
   - &endtoend_test_steps
@@ -64,7 +68,8 @@ aliases:
     - run: npm install
     - save_cache: *save_dep_cache
     - run: *install
-    - run: *setup_browserstack
+    - run: *download_browserstack
+    - run: *start_browserstack
     - run: *run_endtoend_test
 
 version: 2
@@ -82,16 +87,6 @@ workflows:
   commit:
     jobs:
       - build
-  nightly:
-    triggers:
-      - schedule:
-          cron: "0 0 * * *"
-          filters:
-            branches:
-              only:
-                - master
-    jobs:
-      - e2etest
 
 experimental:
   pipelines: true
diff --git a/.eslintrc.js b/.eslintrc.js
@@ -21,7 +21,8 @@ module.exports = {
   globals: {
     '$$PREBID_GLOBAL$$': false,
     'BROWSERSTACK_USERNAME': false,
-    'BROWSERSTACK_KEY': false
+    'BROWSERSTACK_KEY': false,
+    'FEATURES': 'readonly',
   },
   // use babel as parser for fancy syntax
   parser: '@babel/eslint-parser',
@@ -45,12 +46,19 @@ module.exports = {
     'no-throw-literal': 'off',
     'no-undef': 2,
     'no-useless-escape': 'off',
-    'no-console': 'error'
+    'no-console': 'error',
   },
   overrides: Object.keys(allowedModules).map((key) => ({
     files: key + '/**/*.js',
     rules: {
-      'prebid/validate-imports': ['error', allowedModules[key]]
+      'prebid/validate-imports': ['error', allowedModules[key]],
+      'no-restricted-globals': [
+        'error',
+        {
+          name: 'require',
+          message: 'use import instead'
+        }
+      ]
     }
   })).concat([{
     // code in other packages (such as plugins/eslint) is not "seen" by babel and its parser will complain.

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/issue_tracker.yml b/.github/workflows/issue_tracker.yml
@@ -3,8 +3,13 @@ on:
   issues:
     types:
       - opened
+permissions:
+  contents: read
+
 jobs:
   track_issue:
+    permissions:
+      contents: none
     runs-on: ubuntu-latest
     steps:
       - name: Generate token

diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
@@ -6,8 +6,14 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   update_release_draft:
+    permissions:
+      contents: write  # for release-drafter/release-drafter to create a github release
+      pull-requests: write  # for release-drafter/release-drafter to add label to PR
     runs-on: ubuntu-latest
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "master"

diff --git a/PR_REVIEW.md b/PR_REVIEW.md
@@ -51,11 +51,16 @@ Follow steps above for general review process. In addition, please verify the fo
 - If the adapter being submitted is an alias type, check with the bidder contact that is being aliased to make sure it's allowed.
 - All bidder parameter conventions must be followed:
     - Video params must be read from AdUnit.mediaTypes.video when available; however bidder config can override the ad unit. 
-    - First party data must be read from [`fpd.context` and `fpd.user`](https://docs.prebid.org/dev-docs/publisher-api-reference.html#setConfig-fpd).
+    - First party data must be read from [getConfig('ortb2');](https://docs.prebid.org/dev-docs/publisher-api-reference/setConfig.html#setConfig-fpd).
     - Adapters that accept a floor parameter must also support the [floors module](https://docs.prebid.org/dev-docs/modules/floors.html) -- look for a call to the `getFloor()` function.
     - Adapters cannot accept an schain parameter. Rather, they must look for the schain parameter at bidRequest.schain.
-    - The bidRequest page referrer must checked in addition to any bidder-specific parameter.
+    - The bidderRequest.refererInfo.referer must be checked in addition to any bidder-specific parameter.
     - If they're getting the COPPA flag, it must come from config.getConfig('coppa');
+    - Page position must come from bidrequest.mediaTypes.banner.pos or bidrequest.mediaTypes.video.pos
+    - Global OpenRTB fields should come from [getConfig('ortb2');](https://docs.prebid.org/dev-docs/publisher-api-reference/setConfig.html#setConfig-fpd):
+        - bcat, battr, badv
+    - Impression-specific OpenRTB fields should come from bidrequest.ortb2imp
+        - instl
 - Below are some examples of bidder specific updates that should require docs update (in their dev-docs/bidders/BIDDER.md file):
     - If they support the GDPR consentManagement module and TCF1, add `gdpr_supported: true`
     - If they support the GDPR consentManagement module and TCF2, add `tcf2_supported: true`
@@ -123,6 +128,10 @@ Follow steps above for general review process. In addition:
 - Consider whether the kind of data the module is obtaining could have privacy implications. If so, make sure they're utilizing the `consent` data passed to them.
 - Make sure there's a docs pull request
 
+### Reviewing changes to the `debugging` module
+
+The debugging module cannot import from core in the same way that other modules can. See this [warning](https://github.com/prebid/Prebid.js/blob/master/modules/debugging/WARNING.md) for more details.
+
 ## Ticket Coordinator
 
 Each week, Prebid Org assigns one person to keep an eye on incoming issues and PRs. Every Monday morning a reminder is sent to the prebid-js slack channel with a link to the spreadsheet. If you're on rotation, please check that list each Monday to see if you're on-duty.

diff --git a/README.md b/README.md
@@ -91,7 +91,7 @@ Or for Babel 6:
             }
 ```
 
-Then you can use Prebid.js as any other npm depedendency
+Then you can use Prebid.js as any other npm dependency
 
 ```javascript
 import pbjs from 'prebid.js';
@@ -193,8 +193,43 @@ Most likely your custom `prebid.js` will only change when there's:
 
 Having said that, you are probably safe to check your custom bundle into your project.  You can also generate it in your build process.
 
+**Build once, bundle multiple times**
+
+If you need to generate multiple distinct bundles from the same Prebid version, you can reuse a single build with:
+
+```
+gulp build
+gulp bundle --tag one --modules=one.json
+gulp bundle --tag two --modules=two.json
+```
+
+This generates slightly larger files, but has the advantage of being much faster to run (after the initial `gulp build`). It's also the method used by [the Prebid.org download page](https://docs.prebid.org/download.html).  
+
 <a name="Run"></a>
 
+### Excluding particular features from the build
+
+Since version 7.2.0, you may instruct the build to exclude code for some features - for example, if you don't need support for native ads:
+
+```
+gulp build --disable NATIVE --modules=openxBidAdapter,rubiconBidAdapter,sovrnBidAdapter # substitute your module list
+```
+
+Or, if you are consuming Prebid through npm, with the `disableFeatures` option in your Prebid rule:
+
+```javascript
+  {
+    test: /.js$/,
+    include: new RegExp(`\\${path.sep}prebid\\.js`),
+    use: {
+      loader: 'babel-loader',
+      options: require('prebid.js/babelConfig.js')({disableFeatures: ['NATIVE']})
+    }
+  }
+```
+
+**Note**: this is still a work in progress - at the moment, `NATIVE` is the only feature that can be disabled this way, resulting in a minimal decrease in size (but you can expect that to improve over time).
+
 ## Test locally
 
 To lint the code:

diff --git a/babelConfig.js b/babelConfig.js
@@ -9,7 +9,7 @@ function useLocal(module) {
   })
 }
 
-module.exports = function (test = false) {
+module.exports = function (options = {}) {
   return {
     'presets': [
       [
@@ -18,12 +18,12 @@ module.exports = function (test = false) {
           'useBuiltIns': 'entry',
           'corejs': '3.13.0',
           // a lot of tests use sinon.stub & others that stopped working on ES6 modules with webpack 5
-          'modules': test ? 'commonjs' : 'auto',
+          'modules': options.test ? 'commonjs' : 'auto',
         }
       ]
     ],
     'plugins': [
-      path.resolve(__dirname, './plugins/pbjsGlobals.js'),
+      [path.resolve(__dirname, './plugins/pbjsGlobals.js'), options],
       useLocal('babel-plugin-transform-object-assign'),
     ],
   }

diff --git a/bundle-template.txt b/bundle-template.txt
@@ -0,0 +1,16 @@
+/* <%= prebid.name %> v<%= prebid.version %>
+Updated: <%= (new Date()).toISOString().substring(0, 10) %>
+Modules: <%= modules %> */
+
+if (!window.<%= prebid.globalVarName %> || !window.<%= prebid.globalVarName %>.libLoaded) {
+ $$PREBID_SOURCE$$
+ <% if(enable) {%>
+   <%= prebid.globalVarName %>.processQueue();
+ <% } %>
+} else {
+ try {
+  if(window.<%= prebid.globalVarName %>.getConfig('debug')) {
+    console.warn('Attempted to load a copy of Prebid.js that clashes with the existing \'<%= prebid.globalVarName %>\' instance. Load aborted.');
+  }
+ } catch (e) {}
+}
diff --git a/features.json b/features.json
@@ -0,0 +1,3 @@
+[
+  "NATIVE"
+]
diff --git a/governance.md b/governance.md
@@ -9,15 +9,9 @@ This document describes the governance model for the Prebid project. The Prebid
 
 ### Roles and Responsibilities:
 - **User:** Any individual who consumes / uses the Prebid.js library.
-- **Contributor:** Any individual who contributes code that is subsequently merged to the project. Contributed code is governed by the Prebid.js [license](https://github.com/prebid/Prebid.js/blob/master/LICENSE). Contributors are required to sign a CLA before any code can be committed (CLA pending).
-- **Core Team Member:** An individual contributor who has been appointed by the Tech Lead on the project to maintain it and further it’s stated goals.
-- **Tech Lead:** The Tech Lead is responsible for overall technical direction of the project. The Tech Lead will work closely with Core Team members to facilitate development and further the project goals.
+- **Contributor:** Any individual who contributes code that is subsequently merged to the project. Contributed code is governed by the Prebid.js [license](https://github.com/prebid/Prebid.js/blob/master/LICENSE).
+- **Core & Review Team Member:** An individual contributor who has been appointed by the Tech Lead on the project to maintain it and further it’s stated goals.
+- **Identity Team Member:** An individual contributor who has been appointed by the Identity PMC to review and maintain the identity modules and further the PMC stated goals.
+- **Tech Lead:** The Tech Lead is responsible for overall technical direction of the project & serves as the PMC chair. The Tech Lead will work closely with Core Team members to facilitate development and further the project goals.
 
-### Current Prebid.js Core Team
-- @mkendall07 (Tech Lead)
-- @jsnellbaker
-- @matthewlane
-- @jaiminpanchal27
-- @snapwich
-- @harpere
-- @mike-chowla
+The Core team is currently visible at https://github.com/orgs/prebid/teams/core/members to project members. 
diff --git a/gulpHelpers.js b/gulpHelpers.js
@@ -6,9 +6,12 @@ const MANIFEST = 'package.json';
 const through = require('through2');
 const _ = require('lodash');
 const gutil = require('gulp-util');
-const submodules = require('./modules/.submodules.json');
+const dependencyMap = require('./modules/.submodules.json');
+const submodules = dependencyMap.parentModules;
+const libraries = dependencyMap.libraries;
 
 const MODULE_PATH = './modules';
+const LIBRARY_PATH = './libraries';
 const BUILD_PATH = './build/dist';
 const DEV_PATH = './build/dev';
 const ANALYTICS_PATH = '../analytics';
@@ -68,34 +71,68 @@ module.exports = {
       }
     });
 
+    Object.keys(libraries).forEach(library => {
+      if (!modules.includes(library) && modules.some(module => libraries[library].dependants.includes(module))) {
+        modules.unshift(library);
+      }
+    });
+
     return modules;
   },
+  getParentLibraries(moduleName) {
+    const libraryNames = [];
+    Object.keys(libraries).forEach(libraryName => {
+      const library = libraries[libraryName];
+      if (library.dependants.includes(moduleName)) {
+        libraryNames.push(libraryName);
+      }
+    });
+    return libraryNames;
+  },
+  getLibraryFiles(name) {
+    const library = libraries[name];
+    const files = library.files.map((file) => path.resolve('./libraries/', name, file))
+    return files;
+  },
+  isLibrary(name) {
+    return !!libraries[name];
+  },
   getModules: _.memoize(function(externalModules) {
     externalModules = externalModules || [];
     var internalModules;
     try {
+      var getInternalModules = function(absolutePath) {
+        return fs.readdirSync(absolutePath)
+          .filter(file => (/^[^\.]+(\.js)?$/).test(file))
+          .reduce((memo, file) => {
+            var moduleName = file.split(new RegExp('[.\\' + path.sep + ']'))[0];
+            var modulePath = path.join(absolutePath, file);
+            if (fs.lstatSync(modulePath).isDirectory()) {
+              modulePath = path.join(modulePath, 'index.js')
+            }
+            if (fs.existsSync(modulePath)) {
+              memo[modulePath] = moduleName;
+            }
+            return memo;
+          }, {});
+      };
+
       var absoluteModulePath = path.join(__dirname, MODULE_PATH);
-      internalModules = fs.readdirSync(absoluteModulePath)
-        .filter(file => (/^[^\.]+(\.js)?$/).test(file))
-        .reduce((memo, file) => {
-          var moduleName = file.split(new RegExp('[.\\' + path.sep + ']'))[0];
-          var modulePath = path.join(absoluteModulePath, file);
-          if (fs.lstatSync(modulePath).isDirectory()) {
-            modulePath = path.join(modulePath, 'index.js')
-          }
-          if (fs.existsSync(modulePath)) {
-            memo[modulePath] = moduleName;
-          }
-          return memo;
-        }, {});
+      var absoluteLibraryPath = path.join(__dirname, LIBRARY_PATH);
+
+      internalModules = getInternalModules(absoluteModulePath);
+      var internalLibraries = getInternalModules(absoluteLibraryPath);
+      Object.assign(internalModules, internalLibraries);
     } catch (err) {
       internalModules = {};
     }
     return Object.assign(externalModules.reduce((memo, module) => {
       try {
         // prefer internal project modules before looking at project dependencies
-        var modulePath = require.resolve(module, {paths: ['./modules']});
-        if (modulePath === '') modulePath = require.resolve(module);
+        var modulePath = require.resolve(module, {paths: [MODULE_PATH, LIBRARY_PATH]});
+        if (modulePath === '') {
+          modulePath = require.resolve(module);
+        }
 
         memo[modulePath] = module;
       } catch (err) {
@@ -169,5 +206,11 @@ module.exports = {
     }
 
     return options;
-  }
+  },
+  getDisabledFeatures() {
+    return (argv.disable || '')
+      .split(',')
+      .map((s) => s.trim())
+      .filter((s) => s);
+  },
 };