[aleksUIX]

Type of changes

• bugfix

Context

A copied rejection-tracker key with neither an original tracker nor a bidder response future produces a null merge value. Collectors.toMap then aborts the auction with the NPE reported in #4686.

Filter those copied-only keys before merging. Keep existing tracker records for blocked bidders, completed responses and timeout isolation for unfinished secondary bidders.

Rationale

An unknown copied key has no original rejection state or auction participation to retain. Reusing its copied tracker would import state outside the completed bidder set. The guard excludes it without changing known-bidder reconciliation.

The regression reproduces the mismatch through the auction postprocessor seam. The operator's original production request remains unavailable.

Test plan

• The new auction regression fails on unchanged master and passes with the guard.
• All 124 ExchangeService tests pass.
• The required mvn -B package --file extra/pom.xml build passed with JDK 25: 9,560 tests, zero failures or errors, two existing skips. Upstream advanced only release-version metadata afterward; the Java sources are identical, and all 124 exchange tests pass again on the refreshed head.
• Both changed executable lines and their four branches have 100% JaCoCo coverage. Checkstyle reports zero violations.
• An initial package run hit an unrelated hook timing assertion. The complete hook suite and the complete package build passed on rerun without test changes.

Quality check

• Existing code style followed.
• No API or configuration changes.
• Changed-code coverage exceeds 90%.
• No debug output added.

Fixes #4686.

[And1sS]

Hello, I suspect that you may have a custom module that populates the bid rejection tracker internally. Perhaps you populated the tracker at the BidderRequest stage with an entry for a bidder that does not participate in the current auction. Please, provide us with more context so that we can understand problem better.

[zxPhoenix]

Hello, I suspect that you may have a custom module that populates the bid rejection tracker internally. Perhaps you populated the tracker at the BidderRequest stage with an entry for a bidder that does not participate in the current auction. Please, provide us with more context so that we can understand problem better.

Hi @And1sS, I reported this issue, and you were right: the NPE is just a symptom. After investigating further, I found that our not obvious customization caused the issue. The standard Prebid Server code isn’t affected, so I think you can close this.

[aleksUIX]

Closing this. @zxPhoenix traced the NPE in #4686 to their own customization, which adds a tracker entry for a bidder that is not in the auction. That matches @And1sS's read. Without a reproduction on standard Prebid Server Java, this guard is not needed upstream.