Welcome to Prebid Server 4.0!

This is a major release, so please read through the release notes. If you are already running rc1, there is no need to upgrade as there are no code changes between rc1 and final release.

The release notes only list a summary of changes. There are more details about breaking changes in individual PRs.

This release primarily focuses on infrastructure upgrades and deprecations. This means that host companies should review their configuration as there were some changes.

Major Technology Highlights

• Java 25
• Spring Boot 4.0
• Vert.x 5.0

Major Feature Highlights

• Dependencies: Bump Java, Vertx and Spring Boot to the latest major version (#4520)
• Core: Enable strict RFC 3986 URL compliance by default (#4581)
• Core: Add special Gzip decompression handler (#4498)
• Core: Make vendor-id mandatory for aliases (#4533)
• Core: Add Secondary Bidders support (#4331)
• Core: Update cookie sync to use bidder name instead of cookie family (#4464)

Potentially Breaking Changes

• Magnite adapter: Rebrand Rubicon adapter into Magnite adapter (#4573)
  • Rename rubicon leftovers to magnite (#4580)
  • Important - this update requires a configuration change because magnite is now a material bidder and rubicon is an alias.

Old config:

adapters:
  rubicon:
    aliases:
      magnite: ~

New config:

adapters:
  magnite:
    aliases:
      rubicon: ~

• RadiantFusion adapter: Rename radianfusion to radiantfusion (#4579)
• Bidgency adapter: Rename bidagency to bidgency (#4578)
• ResetDigital adapter: Switch to OpenRTB (#4385) (#4463)
• Intertech adapter: Remove adapter (#4433)
• DXKulture adapter: Remove adapter (#4434)
• Adsinteractive adapter: Remove adapter (#4567)
• Telaria adapter: Remove adapter (#4566)
• Modules: Rename Prebid modules and align hook suffixes across existing modules (#4427)
  • Important - Prebid-maintained modules are renamed to include pb prefix. This will require host companies to update module execution plans.
  • Important - module hooks had a maintenance pass to align the naming. Now all module-declared hooks contain the hook suffix. This will require host companies to update module execution plans.
• Core: Deprecate Video endpoint (#4555)
• Core: Improve and validate bidder adapters by migrating to Vert.x UriTemplate (#4444)
  • Important - bidder URLs now use single curly brackets ({}) for placeholders instead of double curly brackets ({{MACRO}})
• Core: Improve and validate user syncs by migrating to Vert.x UriTemplate (#4569)
  • Important - cookie sync URLs now use single curly brackets ({}) for placeholders instead of double curly brackets ({{MACRO}})
  • Vert.x Template: Fix bugs (#4568)
• Core: Make SetuidHandler bidder lookup case-insensitive (fixes regression introduced in #4464
• ) (#4557)
• Core: Allow duplicate cookie family names (#4316)
  • Core: Allow duplicate cookie family names for priority sync (#4572)
• Core: Rename http-client.use-compression to http-client.use-decompression (#4574)
• Core: Handle GVL deletions (#4519)
  • Important - this introduces a new mandatory configuration property. This property can point to the same place as TCFv2 vendorlist cache directory, but can also be a separate directory.

gdpr:
  vendorlist:
    live:
      startup-cache-dir: /path/to/latest/gvl

• Metrics: Update setuid metrics to use bidder name instead of cookie family name (#4571)

What’s Changed

• Microsoft: New adapter (#4310)
• Modules: Add HTTP method support to module execution plan configuration (#4372)
  • Core: Add http_method field to ExtRequestPrebidServer (#4378)
• Core: Remove deprecated PAAPI-related code (#4514)
• Core: Remove obsolete/unneeded fields from requests to bidders (#4332)
• Core: Remove unused support-cors usersync config (#4429)
• Logger: Replace static logger sampling with a configurable one (#4408)
• Housekeeping: Remove old unused PG classes (#4432)
• Tests Housekeeping: Replace MockServer with WireMock (#4390)

Contributors

@And1sS, @CTMBNara, @Lightwood13, @Net-burst, @marki1an and @osulzhenko

Welcome to Prebid Server 4.0!

This is the first (and most likely the only) Release Candidate release of the 4.0 milestone.

Please be advised that the release notes will be updated with more details over the coming days.

This release primarily focuses on infrastructure upgrades. This means that host companies should review their configuration!

Major Technology Highlights

• Java 25
• Spring Boot 4.0
• Vert.x 5.0

Major Feature Highlights

• Dependencies: Bump Java, Vertx and Spring Boot to the latest major version (#4520)
• Core: Enable strict RFC 3986 URL compliance by default (#4581)
• Core: Add special Gzip decompression handler (#4498)
• Core: Make vendor-id mandatory for aliases (#4533)
• Core: Add Secondary Bidders support (#4331)
• Core: Update cookie sync to use bidder name instead of cookie family (#4464)

Potentially Breaking Changes

• Magnite adapter: Rebrand Rubicon adapter into Magnite adapter (#4573)
  • Rename rubicon leftovers to magnite (#4580)
• RadiantFusion adapter: Rename radianfusion to radiantfusion (#4579)
• Bidgency adapter: Rename bidagency to bidgency (#4578)
• ResetDigital adapter: Switch to OpenRTB (#4385) (#4463)
• Intertech adapter: Remove adapter (#4433)
• DXKulture adapter: Remove adapter (#4434)
• Adsinteractive adapter: Remove adapter (#4567)
• Telaria adapter: Remove adapter (#4566)
• Modules: Rename Prebid modules and align hook suffixes across existing modules (#4427)
• Core: Deprecate Video endpoint (#4555)
• Core: Improve and validate bidder adapters by migrating to Vert.x UriTemplate (#4444)
• Core: Improve and validate user syncs by migrating to Vert.x UriTemplate (#4569)
  • Vert.x Template: Fix bugs (#4568)
• Core: Make SetuidHandler bidder lookup case-insensitive (fixes regression introduced in #4464
• ) (#4557)
• Core: Allow duplicate cookie family names (#4316)
  • Core: Allow duplicate cookie family names for priority sync (#4572)
• Core: Rename http-client.use-compression to http-client.use-decompression (#4574)
• Metrics: Update setuid metrics to use bidder name instead of cookie family name (#4571)

What’s Changed

• Microsoft: New adapter (#4310)
• Modules: Add HTTP method support to module execution plan configuration (#4372)
  • Core: Add http_method field to ExtRequestPrebidServer (#4378)
• Core: Handle GVL deletions (#4519)
• Core: Remove deprecated PAAPI-related code (#4514)
• Core: Remove obsolete/unneeded fields from requests to bidders (#4332)
• Core: Remove unused support-cors usersync config (#4429)
• Logger: Replace static logger sampling with a configurable one (#4408)
• Housekeeping: Remove old unused PG classes (#4432)
• Tests Housekeeping: Replace MockServer with WireMock (#4390)

Contributors

@And1sS, @CTMBNara, @Lightwood13, @Net-burst, @marki1an and @osulzhenko

Important notice

This release includes a security update that adds a validation to bidder adapters with dynamic hostnames to avoid the possibility of hostname forgery. This has a small chance of impacting exotic Prebid Server host configurations, as certain characters in the hostname are now prohibited. Please consult the list of bidder adapters that were affected by this change here #4522 .

Security updates

• Validate url domain and path (#4522)

What’s Changed

• Core: Log bundle for app channel (#4515)
• Core: TCF 2.3 Disclosed Vendors Support (#4442)
• Bugfix: TcfV1 and DisclosedVendors section (#4512)

Vendor-Specific Updates

• LI module: Use matcher instead of source for eid premission (#4487)
• New Adapter: Adsmovil (#4504)
• New Adapter: Alliance Gravity (#4502)
• New Adapter: BeOp (#4476)
• Alkimi: Adding alkimi vendor-id and user-sync url modification (#4490)
• Seedtag: adds ron id support for seedtag adapter (#4466)
• Medianet: Update cookie sync url (#4443)
• Add cookie family name to 360playvid adapter config (#4489)

Housekeeping

• Dependency: Update GPP library (#4441)

Contributors

@CTMBNara, @Lightwood13, @VelRaj21, @akshatgmnet, @peixunzhang, @przemkaczmarek, @sangarbe and @Net-burst

What’s Changed

• Events: Add new request.ext.prebid.events.enabled toggle (#4479)

Housekeeping

• GitHub: Bump Trivy Security Scanner (#4439)
• Housekeeping: Fix flaky Gpp test (#4474)

Vendor-Specific Updates

• New Adapter: MyCodeMedia - Teqblaze alias (#4471)
• 51Degrees module: extend device detection module with new fields (#4458)
• IX adapter: Handle missing interstitial formats (#4459)
• New Adapter: Harrenmedia - Adverxo alias (#4472)
• New Adapter: Harion - teqblaze alias (#4473)
• Ybidder: New Nexx360 alias (#4467)
• Nativo: Add optional placementId parameter and Prebid Renderer in response (#4380)
• LiveIntent module: Fixing permission logic (#4389)
• New Adapter: 360playvid (#4361)

Contributors

@And1sS, @Net-burst, @SuperIzya, @jcerone, @osulzhenko, @przemkaczmarek, @rafataveira and @zxPhoenix

Housekeeping

• Housekeeping: Update localstack-s3 image for functional tests (#4437)

Vendor-Specific Updates

• New Adapter: TrustX (#4428)
• Mobkoi: Always set TagId with placementId (#4435)
• Kargo: update endpoint to krk2.kargo.com (#4431)
• OMS: Update default publisher ID parameter (#4425)

Contributors

@Lightwood13, @Net-burst, @andresmonc, @osulzhenko and @przemkaczmarek

Housekeeping

• Bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 in /.github/workflows (#4391)
• Housekeeping: Bump Spring Boot minor version (#4387)

Vendor-Specific Updates

• New Adapter: Bidfuse (#4370)
• OMS: Add {{PublisherId}} macro (#4409)
• Xapads: Fix misplaced GVL id (#4398)
• Teal: Add GPP params to usersync (#4379)
• Missena: add GPP params to cookie sync URL (#4383)
• Nexx360: Add usersync (#4396)
• Epsilon: pass prebid server version (#4392)
• Mobilefuse: Add site media types (#4369)
• Flipp: Update endpoint to not use cdn (#4368)
• AdsInteractive: Change to aliases (#4362)
• Adipolo: Add GVL ID (#4397)

Contributors

@CTMBNara, @Net-burst, @dependabot[bot], @dimashirokov, @johnwier, @ollyburns, @osulzhenko, @przemkaczmarek, @ysfbsf and dependabot[bot]

Vendor-Specific Updates

• LiveIntent Module: EID permissions (#4315)
• Teal: new adapter (#4350)
• Aso: Add user sync endpoint to adapter and aliases (#4353)
• New Adapter: Clydo (#4299)
• Adot: Constrain publisher path to an enum list (#4354)
• AdOcean: Remove adapter (#4355)
• Migrate ProgX alias from Vidazoo to Teqblaze adapter (#4356)
• Remove Vimayx alias from SmartHub adapter (#4363)
• Remove Mobupps alias (#4364)
• New Adapter: RadiantFusion - Attekmi alias (#4365)
• Nexx360: Preserve custom imp.ext fields and add vendor id (#4359)

Contributors

@Lightwood13, @Net-burst, @SuperIzya, @ollyburns and @przemkaczmarek

What’s Changed

• Core: EID Permissions extension (#4349)
• Refactoring: Add bidder request post-processing (#4322)
• CI: Update GitHub workflows (#4351)
• CI: Fix vulnerability in cross-repo-issue GitHub action (#4324)

Vendor-Specific Updates

• RTBHouse: Extract tagid from Imp fields (#4306)
• Ogury: Allow inventory mapping for in-app traffic. (#4321)
• StroeerCore: Use bid.ext as-is from the response (#4317)
• New adapter: Rename adoppler bidder adapter to elementaltv add adoppler as alias t… (#4326)
• Adagio: Remove hardcoded seat name (#4319)
• Adagio: Enable site capability (#4320)
• Optidigital: Add GPP support (#4333)

Contributors

@CTMBNara, @Net-burst, @crepi, @osulzhenko, @pavel-ptashyts, @philipwatson, @pjaworski-rtbh, @przemkaczmarek and @zxPhoenix

What’s Changed

• Core: Support GPP USNat v2 (#3690)
• Core: Decrease the version of the InfluxDB metrics (#4292)
• Rule Engine: Fix eviction policy for rule cache (#4308)
• Tests: Remove post in pr-java-ci.yml (#4307)
• Tests: Fix flaky GPP tests and refactor code (#4309)
• Tests: Update pr-java/functional-ci workflow (#3904)

Vendor-Specific Updates

• CWire: Add userSync (#4288)
• Bugfix: incorrect naming in userSync configs (#4305)
• Criteo: Set geoscope to global (#4303)
• Sharethrough: Add geoscope to config (#4302)
• Smaato: Add geoscope to bidder info (#4301)
• Seedtag: sets bid request's currency to USD (#4296)
• Consumable: updated yaml config (#4139)

Contributors

@And1sS, @AntoxaAntoxic, @EmilNadimanov, @Net-burst, @marki1an, @osulzhenko, @richardngo-consumable and @sangarbe

What’s Changed

• Housekeeping: Bump Groovy-related dependencies (#4276)

Vendor-Specific Updates

• Core: Resolve bean conflict in modules (#4289)
• LiveIntent: Limiting LI ids to configured bidders (#4281)
• Sparteo: add required query params to adapter endpoint (#4225)
• New BoldwinRapid Adapter (#4285)
• New Adapter: Nativery (#4223)
• Nextmillennium: New fields and adapter version update (#4246)
• Adnuntius: Pass targeting to ad server (#4282)
• BidTheatre: Update endpoint and add redirect user sync (#4283)

Contributors

@AntoxaAntoxic, @Net-burst, @SuperIzya, @osulzhenko, @przemkaczmarek and @t-sormonte