sync with base master

.devcontainer/Dockerfile

@@ -16,3 +16,6 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
 
 # [Optional] Uncomment this line to install global node packages.
 # RUN su vscode -c "source /usr/local/share/nvm/nvm.sh && npm install -g <your-package-here>" 2>&1
+
+RUN addgroup --system --gid 2001 prebidgroup && adduser --system --uid 1001 --ingroup prebidgroup prebid
+USER prebid

.github/workflows/scripts/codepath-notification

@@ -13,3 +13,7 @@
 # The aim is to find a minimal set of regex patterns that matches any file in these paths
 
 rubicon: header-bidding@magnite.com
+pubmatic: header-bidding@pubmatic.com
+openx: prebid@openx.com
+adapters/ix|imp_ix|ix.json|ix.yaml: pdu-supply-prebid@indexexchange.com
+medianet: prebid@media.net

.github/workflows/security.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   build:
     name: Trivy
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4

.github/workflows/validate-merge.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   validate-merge:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
 
     steps:
     - name: Install Go

.github/workflows/validate.yml

@@ -11,7 +11,7 @@ jobs:
     strategy:
       matrix:
         go-version: [1.23.x, 1.24.x]
-        os: [ubuntu-20.04]
+        os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
 
     steps:

Dockerfile

@@ -1,7 +1,7 @@
-FROM ubuntu:20.04 AS build
+FROM ubuntu:22.04 AS build
 RUN apt-get update && \
     apt-get -y upgrade && \
-    apt-get install -y wget
+    apt-get install -y --no-install-recommends wget ca-certificates
 WORKDIR /tmp
 RUN wget https://dl.google.com/go/go1.24.0.linux-amd64.tar.gz && \
     tar -xf go1.24.0.linux-amd64.tar.gz && \
@@ -14,7 +14,7 @@ ENV GOPROXY="https://proxy.golang.org"
 
 # Installing gcc as cgo uses it to build native code of some modules
 RUN apt-get update && \
-    apt-get install -y git gcc && \
+    apt-get install -y --no-install-recommends git gcc build-essential && \
     apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 # CGO must be enabled because some modules depend on native C code
@@ -26,7 +26,7 @@ ARG TEST="true"
 RUN if [ "$TEST" != "false" ]; then ./validate.sh ; fi
 RUN go build -mod=vendor -ldflags "-X github.com/prebid/prebid-server/v3/version.Ver=`git describe --tags | sed 's/^v//'` -X github.com/prebid/prebid-server/v3/version.Rev=`git rev-parse HEAD`" .
 
-FROM ubuntu:20.04 AS release
+FROM ubuntu:22.04 AS release
 LABEL maintainer="hans.hjort@xandr.com" 
 WORKDIR /usr/local/bin/
 COPY --from=build /app/prebid-server .
@@ -37,10 +37,10 @@ RUN chmod -R a+r static/ stored_requests/data
 
 # Installing libatomic1 as it is a runtime dependency for some modules
 RUN apt-get update && \
-    apt-get install -y ca-certificates mtr libatomic1 && \
+    apt-get install -y --no-install-recommends ca-certificates mtr libatomic1 && \
     apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-RUN adduser prebid_user
-USER prebid_user
+RUN addgroup --system --gid 2001 prebidgroup && adduser --system --uid 1001 --ingroup prebidgroup prebid
+USER prebid
 EXPOSE 8000
 EXPOSE 6060
 ENTRYPOINT ["/usr/local/bin/prebid-server"]