---
title: "Release 146"
description: "Automatic malware scanning of DSP creatives, three new DSP partner types, OpenRTB app inventory, in-place dashboard widget editing, and a custom-parameter fix for PHP publishers."
type: "reference"
audience: [network-manager, admin]
keywords: [release 146, release notes, creative scan, DSP partners, app inventory, dashboard widgets]
---

Fetch the complete documentation index at: https://epom.com/ad-server/docs/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Release 146

**Released:** April — May 2026. The headline is automatic malware and policy scanning of
programmatic creatives; the release also expands DSP integrations, adds app inventory to
OpenRTB, and makes dashboards editable in place.

## New features

### DSP creative scan — automatic malware and policy protection

Creatives arriving in DSP bid responses are now scanned for malware and policy violations
by a third-party scanning provider. Blocked creatives are dropped from the auction — the runner-up bid
wins instead. A new admin grid at **Admin → DSP Creative Scan** shows every creative's state
and verdict. The feature stays **off** until Epom sets up the scanning provider for the network and a
scan provider is enabled on individual DSP partners. See
[Protect your inventory from bad creatives](https://epom.com/ad-server/docs/use-cases/creative-policy-protection.md).

### Three new DSP partner types

HilltopAds, Galaksion and RollerAds are available as [DSP partner](https://epom.com/ad-server/docs/guides/admin/dsp-partners.md)
types, each with native popunder handling.

> **Note:** in the same release the *Force First Price* partner parameter default flipped
> from off to on — auctions with DSP partners are now **first-price by default** unless the
> parameter is explicitly set to second-price.

### App inventory for OpenRTB

[Sites](https://epom.com/ad-server/docs/guides/inventory/sites.md) can now be declared as **App** inventory in addition
to Website: a new inventory-type selector and a **Bundle** field carry the app-store bundle
identifier into OpenRTB bid requests (`app.bundle`). App-type sites can be saved without a
URL.

### DSP analytics sync for Epom white-label partners

For Epom white-label DSP partners, outgoing bid requests now carry a per-placement /
banner / country reference, and a new scheduled sync pulls the partner's delivery metrics
back and maps them onto your placements, banners and countries, so daily and hourly reports
stay consistent. Configure it per partner in the new *Analytics Sync* fieldset on the
[DSP partner](https://epom.com/ad-server/docs/guides/admin/dsp-partners.md) edit page.

## Improvements

### Edit dashboard widgets in place

Every dashboard widget now has a gear tool that reopens its creation dialog pre-filled with
the current settings. Saving updates the widget in place — position on the dashboard is
preserved — instead of forcing you to delete and recreate it. A drag-and-drop layout
corruption when rearranging widgets was fixed in the same change. See
[Dashboards](https://epom.com/ad-server/docs/guides/analytics/dashboards.md).

### Android 16 and 17 targeting

Android 16 and Android 17 are available in OS version
[targeting](https://epom.com/ad-server/docs/reference/targeting-dimensions.md).

### More connected devices recognized

VR headsets and smart speakers are now classified as Connected Device (Smart TV family) and
kiosks as Desktop, improving device targeting and analytics for those traffic types.

### Configurable iframe sandbox flags

The sandbox attributes Epom bakes into ad iframes can now be overridden per network (for
example, to drop `allow-top-navigation-by-user-activation` after observing redirect abuse)
through server configuration — ask Epom support or your account manager — without waiting for a product change.

## Bug fixes

- **PHP publishers were silently losing all custom parameters.** PHP rewrites `.` to `_`
  in query keys, so PHP-based integrations re-emitted `cp.foo` as `cp_foo` — and every
  custom parameter (targeting, attribution, default-value substitution, action tracking)
  was dropped end-to-end. Both `cp.` and `cp_` prefixes are now accepted everywhere.
- **Email ad tracking no longer errors on deleted or mismatched placements.** A tracking
  hit that referenced an unresolvable placement returned a server error (and email image
  proxies kept retrying it); it now returns an empty response like any other no-ad case.
- **"No bid" responses sent as an empty HTTP 200** by some DSPs are handled as a normal
  no-bid instead of raising internal errors.
- **Synced partner analytics now update hourly reports too**, not just daily totals, so
  hour-level and day-level reports agree.
- **Daisy-chaining REST endpoint no longer errors** on placements with no daisy chain
  configured.
- **Removed an invalid `Permissions-Policy` header** that Chrome rejected with console
  errors on every ad response.

## Under the hood

Platform upgrades and reliability work.

## Related

- [What's new in Epom Ad Server](https://epom.com/ad-server/docs/releases.md)
- [Release 147](https://epom.com/ad-server/docs/releases/release-147.md)
- [Release 145](https://epom.com/ad-server/docs/releases/release-145.md)