neetob 0.5.83 → 0.5.85

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 580fe72d0904ef8524725b4f9e1bbc41e9347708e7559be5f843bcc848fb7a82
-  data.tar.gz: 0edab938a9ea750dd2dd8e57415d05983de862e0d778b0e708fcacb1d756cea7
+  metadata.gz: 16306ac8fba41db1469e0138632f44a7ff12013c144817937924635899f7f00b
+  data.tar.gz: 3fd69cacef27a582301e59efd916fdc35a4a1217ea5c4411f42e4bcb4415f19c
 SHA512:
-  metadata.gz: d849c140be635bef936f785010a5077cecb1e407eeaa3ed065247a5d15c73cbc7b30d8c576ec0826e4ba0d6dd93f8d33e9689af9a1cf553f09ab7e62d4b27e2a
-  data.tar.gz: a07fd1d571e3b671821eaac254406aa56281857ca63b817c1343e1b00505f4c423f39dc1626297d362b14bcffcc99d31c776c416503eae1b33ece975a99dda2a
+  metadata.gz: b0f4d24a0a4541da437e892fb66c3eaf1d360e4c54c550e472da7ef4c3cba386867cf168289532ddfd1a2e43a51ba5c666a9a5cb1d398fdf075918b2af9f6aac
+  data.tar.gz: a8268492066a76bbd9234284c6009a7c0aebf40b2052fed58566e3199a7ce081aa69c5a5ba08a6976ce8097f3669f1d4c1d324a1d695a00366d92a6ad49ee8b7

data/Gemfile.lock

@@ -1,11 +1,12 @@
 PATH
   remote: .
   specs:
-    neetob (0.5.83)
+    neetob (0.5.85)
       actionview
       activesupport
       brakeman (~> 5.0)
       chronic
+      csv
       dotenv (~> 2.8.1)
       launchy (~> 2.5.0)
       neeto-compliance
@@ -172,6 +173,7 @@ GEM
       unicode (>= 0.4.4.5)
     css_parser (1.21.0)
       addressable
+    csv (3.3.5)
     database_cleaner (2.1.0)
       database_cleaner-active_record (>= 2, < 3)
     database_cleaner-active_record (2.2.0)

data/README.md

@@ -87,7 +87,7 @@ The commands within `neetob` should be used with caution, as improper usage may
 
 ## Source of truth
 
-This [list of repos](https://github.com/bigbinary/neeto-compliance/blob/main/data/neeto_repos.json) is used as the "source of truth".
+This [list of repos](https://github.com/neetozone/neeto-compliance/blob/main/data/neeto_repos.json) is used as the "source of truth".
 
 ## Passing list of heroku apps as option
 
@@ -241,7 +241,7 @@ neetob github protect_branch --branch main --path ~/Desktop/branch-protection-ru
 
 We can also pass the value `all` to the option `--repos` with the above mentioned command so that the
 branch protection rules can be updated for
-all [neeto repos](https://github.com/bigbinary/neeto-compliance/blob/main/data/neeto_repos.json).
+all [neeto repos](https://github.com/neetozone/neeto-compliance/blob/main/data/neeto_repos.json).
 
 ```sh
 neetob github protect_branch --branch main --path ~/Desktop/branch-protection-rules.json \

data/docs/development.md

@@ -3,7 +3,7 @@
 Clone the repository onto your system using the following command:
 
 ```sh
-git clone https://github.com/bigbinary/neetob.git
+git clone https://github.com/neetozone/neetob.git
 ```
 
 Navigate to the root of the application directory.

data/docs/testing.md

@@ -1,6 +1,6 @@
 # Testing instructions
 
-For testing `github` commands use - [neeto-dummy](https://github.com/bigbinary/neeto-dummy) repo.
+For testing `github` commands use - [neeto-dummy](https://github.com/neetozone/neeto-dummy) repo.
 
 For testing `heroku` commands use - [neeto-dummy](https://dashboard.heroku.com/apps/neeto-dummy) app.
 

data/lib/neetob/cli/base.rb

@@ -9,7 +9,7 @@ module Neetob
   class CLI::Base
     include Utils
 
-    NEETO_APPS_LIST_LINK = "https://github.com/bigbinary/neeto-compliance/blob/main/data/neeto_repos.json#L2"
+    NEETO_APPS_LIST_LINK = "https://github.com/neetozone/neeto-compliance/blob/main/data/neeto_repos.json#L2"
 
     attr_reader :ui
 
@@ -142,7 +142,7 @@ module Neetob
       end
 
       def testing_apps(platform_name)
-        [:heroku, :neetodeploy].include?(platform_name) ? ["neeto-dummy"] : ["bigbinary/neeto-dummy"]
+        [:heroku, :neetodeploy].include?(platform_name) ? ["neeto-dummy"] : ["neetozone/neeto-dummy"]
       end
 
       def inform_about_current_working_mode(sandbox_mode, quiet = false)

data/lib/neetob/cli/cloudflare/base.rb

@@ -6,7 +6,7 @@ module Neetob
   class CLI
     module Cloudflare
       class Base < CLI::Base
-        NEETO_DEPLOY_DOCS = "https://github.com/bigbinary/neetob/#working-with-neetodeploy"
+        NEETO_DEPLOY_DOCS = "https://github.com/neetozone/neetob/#working-with-neetodeploy"
 
         ZONE_IDS = {
           "neetoauth.com": "81ade5aa3e075489533f903dc03b1e88",

data/lib/neetob/cli/fetchorupdate_repos/execute.rb

@@ -41,7 +41,7 @@ module Neetob
         end
 
         def clone_repo(repo_name)
-          `git clone git@github.com:bigbinary/#{repo_name}.git`
+          `git clone git@github.com:neetozone/#{repo_name}.git`
           if $?.success?
             puts "------Done cloning #{repo_name}------"
           else

data/lib/neetob/cli/github/gems/release.rb

@@ -23,7 +23,7 @@ module Neetob
             matching_gems.each do |gem|
               ui.info("\nWorking on #{gem}\n")
               begin
-                shallow_clone_repo_in_tmp_dir!("bigbinary/#{gem}")
+                shallow_clone_repo_in_tmp_dir!("neetozone/#{gem}")
                 build_gem(gem)
                 release_gem(gem)
                 if $?.success?

data/lib/neetob/cli/github/issues/create_product_sub_issues.rb

@@ -7,7 +7,7 @@ module Neetob
     module Github
       module Issues
         class CreateProductSubIssues < Base
-          SOURCE_REPO = "bigbinary/neeto-engineering-web"
+          SOURCE_REPO = "neetozone/neeto-engineering-web"
 
           def initialize(issue_number, sandbox = false)
             super()

data/lib/neetob/cli/github/make_pr/base.rb

@@ -10,7 +10,7 @@ module Neetob
           BRANCH_NAME = "neeto_compliance"
           PR_TITLE = "Neeto Compliance"
           REPO_SPECIFIC_COMMANDS_BEFORE_BUNDLE_INSTALL = {
-            "bigbinary/neeto-deploy-web" => "sed -i '' '/gem \"karafka\"/d' Gemfile"
+            "neetozone/neeto-deploy-web" => "sed -i '' '/gem \"karafka\"/d' Gemfile"
           }
 
           attr_accessor :branch_name, :pr_title

data/lib/neetob/cli/github/protect_branch.rb

@@ -49,7 +49,7 @@ module Neetob
             all_repos.map! do |repo_config|
               repo_config.is_a?(Hash) ? repo_config.to_a.map { |values| { values[0] => values[1] } } : repo_config
             end
-            all_repos.flatten.map { |repo| (repo.is_a?(Hash) && repo.values[0].dig("semaphore")) ? "bigbinary/#{repo.keys[0]}" : nil }
+            all_repos.flatten.map { |repo| (repo.is_a?(Hash) && repo.values[0].dig("semaphore")) ? "neetozone/#{repo.keys[0]}" : nil }
           end
       end
     end

data/lib/neetob/cli/github/yarn_audit.rb

@@ -39,7 +39,7 @@ module Neetob
         private
 
           def run_yarn_audit(repo)
-            `#{cd_to_repo(repo)} && yarn audit`
+            `#{cd_to_repo(repo)} && yarn audit --json --level high 2>&1`
           end
       end
     end

data/lib/neetob/cli/heroku/base.rb

@@ -6,7 +6,7 @@ module Neetob
   class CLI
     module Heroku
       class Base < CLI::Base
-        NEETO_DEPLOY_DOCS = "https://github.com/bigbinary/neetob/#working-with-neetodeploy"
+        NEETO_DEPLOY_DOCS = "https://github.com/neetozone/neetob/#working-with-neetodeploy"
 
         def initialize
           super()

data/lib/neetob/cli/monthly_audit/commands.rb

@@ -10,9 +10,10 @@ module Neetob
         desc "perform", "Perform the audit"
         option :month, type: :string, aliases: "-m", required: true, desc: "Month. Example: June-2024"
         option :skip_issue, type: :boolean, default: false, desc: "Skip creating GitHub issues"
+        option :verbose, type: :boolean, default: false, desc: "Log issue details (repo, title, assignee) for each issue that would be or is created"
 
         def perform
-          Perform.new(options[:month], options[:sandbox], options[:skip_issue]).run
+          Perform.new(options[:month], options[:sandbox], options[:skip_issue], options[:verbose]).run
         end
       end
     end

data/lib/neetob/cli/monthly_audit/github_issue_creation.rb

@@ -11,20 +11,30 @@ class GithubIssueCreation < Neetob::CLI::Github::Base
   end
 
   def create_issue(repo:, title:, description:, labels: "", assignee: nil)
-    return if Thread.current[:skip_issue]
-    return if repo.include?("bigbinary-website")
-
     full_title = build_full_title(title)
     repo_path = "neetozone/#{repo}"
+    assignee = Neetob::CLI::Github::Repositories::TeamLeads.team_lead_for(repo)
+
+    log_verbose_issue(repo_path:, full_title:, assignee:, description:) if Thread.current[:verbose]
+
+    return if Thread.current[:skip_issue]
+    return if repo.include?("bigbinary-website")
 
     # Check for existing issue with exact title match
     existing_issue = find_existing_issue_by_title(repo_path, full_title)
-    return existing_issue.html_url if existing_issue
+    if existing_issue
+      ui.info(
+        "[verbose] Issue already exists: #{existing_issue.html_url}",
+        print_to_audit_log: false) if Thread.current[:verbose]
+      return existing_issue.html_url
+    end
 
     # Close any existing issues of the same type
     close_existing_issues_of_same_type(repo_path, title)
 
-    create_new_issue(repo_path, full_title, description, labels, assignee)
+    url = create_new_issue(repo_path, full_title, description, labels, assignee)
+    ui.info("[verbose] Created issue: #{url}", print_to_audit_log: false) if Thread.current[:verbose] && url
+    url
   end
 
   private
@@ -72,4 +82,16 @@ class GithubIssueCreation < Neetob::CLI::Github::Base
     def build_issue_body(full_title, description)
       "## #{full_title}\n\n#{description}"
     end
+
+    def log_verbose_issue(repo_path:, full_title:, assignee:, description:)
+      ui.info("--------------------------------", print_to_audit_log: false)
+      assignee_str = assignee.to_s.strip.empty? || assignee == "NO TL FOUND" ? "(none)" : assignee
+      status = Thread.current[:skip_issue] ? "Would create (skipped)" : "Creating"
+      ui.info("[verbose] #{status} issue:", print_to_audit_log: false)
+      ui.info("  repository: #{repo_path}", print_to_audit_log: false)
+      ui.info("  title: #{full_title}", print_to_audit_log: false)
+      ui.info("  assignee: #{assignee_str}", print_to_audit_log: false)
+      desc_preview = description.to_s.gsub(/\s+/, " ")
+      ui.info("  description: #{desc_preview}", print_to_audit_log: false)
+    end
 end

data/lib/neetob/cli/monthly_audit/perform.rb

@@ -9,24 +9,29 @@ module Neetob
   class CLI
     module MonthlyAudit
       class Perform < CLI::Base
-        attr_accessor :sandbox, :month, :skip_issue
+        attr_accessor :sandbox, :month, :skip_issue, :verbose
 
-        def initialize(month, sandbox = false, skip_issue = false)
+        def initialize(month, sandbox = false, skip_issue = false, verbose = false)
           super()
           @month = month
           @sandbox = sandbox
           @skip_issue = skip_issue
+          @verbose = verbose
         end
 
         def run
           Thread.current[:month] = month
           Thread.current[:skip_issue] = skip_issue
+          Thread.current[:verbose] = verbose
           Thread.current[:audit_mode] = true
           markdown_file_name = "audit-report-#{DateTime.now.to_i}.md"
           Thread.current[:markdown_file_name] = markdown_file_name
           ui.success("## Starting the audit for #{month}")
           ui.info "\n"
           ui.say("## Issue creation is #{skip_issue ? 'disabled' : 'enabled'}")
+          ui.say(
+            "## Verbose logging is enabled (logs only in terminal, not in report)",
+            Thor::Shell::Color::YELLOW) if verbose
           ui.info "\n"
           Security::Main.new.run
           ui.info "\n"

data/lib/neetob/cli/monthly_audit/security/code/bundle_audit.rb

@@ -1,13 +1,19 @@
 # frozen_string_literal: true
 
+require "set"
+
 require_relative "../../../github/bundle_audit"
 require_relative "../../github_issue_creation"
+
 module Neetob
   class CLI
     module MonthlyAudit
       module Security
         module Code
           class BundleAudit < CLI::Base
+            # Path where repos are cloned during audit (used to read Gemfile.common.rb).
+            CLONED_REPO_BASE = "/tmp/neetob"
+
             def initialize
               super()
             end
@@ -16,42 +22,188 @@ module Neetob
               ui.success("### 1.1.1. Checking whether running `bundle-audit check` throws any vulnerabilities")
               repo_data = [["Repository", "Vulnerabilities Found", "Comments", "Audit Passed"]]
               ui.info "\n"
+
+              # Track gems that failed bundle-audit and are defined in Gemfile.common.rb (any repo).
+              # Used to create a single issue in neeto-commons-backend at the end of the audit.
+              common_gems_failed_audit = Set.new
+
               last_comment = nil
+
               products_and_nanos_repos(:backend).each do |repo|
                 ui.info("Checking bundle audit run results for #{repo}", print_to_audit_log: false)
                 bundle_audit_result = Neetob::CLI::Github::BundleAudit.new([repo]).run
+
                 vulnerabilities_found = "No"
                 audit_passed = "No"
                 comments = nil
+                advisories = nil
+
                 if bundle_audit_result.nil? || bundle_audit_result.include?("No vulnerabilities found")
+                  # 3. No vulnerabilities: audit passed, no issue created.
                   audit_passed = "Yes"
                 else
-
                   vulnerabilities_found = "Yes"
-                  formatted_result = bundle_audit_result.gsub("\n", "<br>").gsub("~", "\\~")
-                  comments = formatted_result.split("<br><br>").first(3).map { |comment| parse_advisory_block(comment) }.join("<br><br>") + " ... <br><br> (run `bundle-audit check` in #{repo} to see all issues)"
-                  issue_url = GithubIssueCreation.new.create_issue(
-                    repo:, title: "Fix vulnerabilities reported by bundle-audit",
-                    description: comments)
-                  audit_passed += " #{issue_url}"
+                  advisories = parse_bundle_audit_advisories(bundle_audit_result)
+                  common_gem_names = gem_names_from_gemfile_common(repo)
+
+                  # Split advisories into those for gems in Gemfile.common.rb vs app-specific gems.
+                  common_vuln_gem_names = advisories.map { |a|
+ a[:name] }.select { |name| common_gem_names.include?(name) }.to_set
+                  app_advisories = advisories.reject { |a| common_gem_names.include?(a[:name]) }
+
+                  # Record common gems that failed audit (for neeto-commons-backend issue later).
+                  common_gems_failed_audit.merge(common_vuln_gem_names)
+
+                  # --- Issue creation logic (per requirements 1, 2, 4) ---
+                  # Requirement 1: If ALL vulnerabilities are from Gemfile.common.rb gems only:
+                  #   → Flag audit as failed, do NOT create an issue in this app. Track the failed common gems.
+                  # Requirement 2: If SOME vulnerabilities are from common gems and SOME from other gems:
+                  #   → Flag audit as failed. Create an issue in this app ONLY for the non-common gems.
+                  # Requirement 4: At the end of the audit, if any common gems failed anywhere,
+                  #   → Create a single issue in neeto-commons-backend listing all such unique gems.
+                  issue_url = nil
+                  if app_advisories.empty?
+                    # Case 1: Every vulnerability is from a gem in Gemfile.common.rb — no app issue.
+                    common_only_advisories = advisories.select { |a| common_vuln_gem_names.include?(a[:name]) }
+                    comments = build_advisory_comments_summary(common_only_advisories, repo, common_only: true)
+                  else
+                    # Case 2 (mixed) or all app-only: create one issue in this app for app-specific advisories only.
+                    comments = build_advisory_comments_summary(app_advisories, repo, common_only: false)
+                    issue_url = GithubIssueCreation.new.create_issue(
+                      repo:,
+                      title: "Fix vulnerabilities reported by bundle-audit",
+                      description: comments
+                    )
+                  end
+
+                  # Set audit_passed based only on where the vulnerabilities come from,
+                  # not on whether we actually created issues (--skip-issue skips creation but report is unchanged).
+                  if app_advisories.empty? && !common_vuln_gem_names.empty?
+                    # All vulnerable gems are from Gemfile.common.rb (commons-only case).
+                    audit_passed = "No (common gems only; see neeto-commons-backend)"
+                  elsif issue_url
+                    # App-specific (or mixed) vulnerabilities with an app issue created.
+                    audit_passed = "No #{issue_url}"
+                  elsif !app_advisories.empty?
+                    # App-specific (or mixed) vulnerabilities with issue creation skipped.
+                    audit_passed = "No (vulnerabilities found; run `bundle-audit check` in #{repo} for details)"
+                  end
+
                   same_as_last_vulnerabilities = comments == last_comment
                   last_comment = comments
-                  if same_as_last_vulnerabilities
-                    comments = "''"
-                  end
+                  comments = "''" if same_as_last_vulnerabilities
                 end
+
                 table_comments = comments.nil? ? nil : comments.split("<br>").first(3).join("<br>") + " ..."
+                # When --verbose is enabled, log each advisory as commons vs app-specific (for easier inspection).
+                if Thread.current[:verbose] && vulnerabilities_found == "Yes" && advisories && advisories.any?
+                  common_gem_names = gem_names_from_gemfile_common(repo)
+                  debug_section = build_debug_commons_vs_app(advisories, common_gem_names)
+                  table_comments = [table_comments, debug_section].compact.join("<br><br>")
+                end
                 repo_data << [repo, vulnerabilities_found, table_comments, audit_passed]
               end
+
+              # 4. If any gems from Gemfile.common.rb failed audit, create one issue in neeto-commons-backend.
+              # 5. Add that issue as the last row of the bundle-audit table when created.
+              if common_gems_failed_audit.any?
+                commons_issue_url = create_commons_backend_issue(common_gems_failed_audit)
+                commons_table_comments = "Gems from Gemfile.common.rb with vulnerabilities: " \
+                  "#{common_gems_failed_audit.sort.join(', ')}"
+                audit_passed_cell = commons_issue_url ? "No #{commons_issue_url}" : "No (issue creation skipped)"
+                repo_data << [
+                  "neeto-commons-backend",
+                  "Yes (common gems)",
+                  commons_table_comments,
+                  audit_passed_cell
+                ]
+              end
+
               ui.print_table(repo_data)
             end
 
             private
 
+              # Parses bundle-audit check output into a list of advisories.
+              # Each advisory is a hash with :name (gem name), :block_text (raw block for formatting).
+              def parse_bundle_audit_advisories(report)
+                return [] if report.nil? || report.include?("No vulnerabilities found")
+
+                blocks = report.split(/\n\n+/)
+                advisories = []
+                keys = ["Name:", "Version:", "CVE:", "GHSA:", "Criticality:", "URL:", "Title:", "Solution:"]
+
+                blocks.each do |block|
+                  next unless block.include?("Name:")
+
+                  name_line = block.lines.find { |l| l.strip.start_with?("Name:") }
+                  gem_name = name_line&.strip&.sub(/\AName:\s*/, "")&.strip
+                  next if gem_name.nil? || gem_name.empty?
+
+                  selected = block.lines.select { |line| keys.any? { |key| line.strip.start_with?(key) } }.join("\n")
+                  advisories << { name: gem_name, block_text: selected }
+                end
+                advisories
+              end
+
+              # Returns the set of gem names declared in the repo's Gemfile.common.rb (if present).
+              # Used to decide whether a vulnerability is "common" (fixed in commons) vs app-specific.
+              # Ignores commented-out lines (e.g. # gem 'rails') to avoid false positives.
+              def gem_names_from_gemfile_common(repo)
+                path = File.join(CLONED_REPO_BASE, repo, "Gemfile.common.rb")
+                return Set.new unless File.file?(path)
+
+                content = File.read(path)
+                # Only consider lines that are not blank and do not start with # (after stripping).
+                uncommented = content.each_line
+                  .reject { |line| line.strip.empty? || line.strip.start_with?("#") }
+                  .join
+                # Match gem "name" or gem 'name' (possibly with version/options on same line).
+                uncommented.scan(/gem\s+["']([^"']+)["']/).flatten.map(&:strip).to_set
+              end
+
+              # Verbose logging helper: list each advisory with [commons] or [app-specific].
+              def build_debug_commons_vs_app(advisories, common_gem_names)
+                lines = advisories.map do |a|
+                  label = common_gem_names.include?(a[:name]) ? "[commons]" : "[app-specific]"
+                  "Gem: #{a[:name]} → #{label}"
+                end
+                "[verbose] Commons vs app-specific breakdown:<br>" + lines.join("<br>")
+              end
+
+              # Builds HTML-style comments for issue body and table, from the given advisories.
+              def build_advisory_comments_summary(advisories, repo, common_only: false)
+                formatted = advisories.map do |a|
+                  text = a[:block_text].gsub("\n", "<br>").gsub("~", "\\~")
+                  parse_advisory_block(text)
+                end
+                suffix = if common_only
+                  "(All vulnerabilities are from Gemfile.common.rb; no issue created for this app. " \
+                    "See neeto-commons-backend.)"
+                else
+                  "(run `bundle-audit check` in #{repo} to see all issues)"
+                end
+                formatted.join("<br><br>") + " ... <br><br> " + suffix
+              end
+
               def parse_advisory_block(block)
                 keys = ["Name:", "Version:", "CVE:", "Title:", "Solution:"]
                 block.split("<br>").select { |line| keys.any? { |key| line.strip.start_with?(key) } }.join("<br>")
               end
+
+              # Creates a single issue in neeto-commons-backend listing all unique common gems that failed audit.
+              def create_commons_backend_issue(common_gems_failed_audit)
+                gem_list = common_gems_failed_audit.sort.join(", ")
+                title = "Fix bundle-audit vulnerabilities in Gemfile.common.rb"
+                description = "The following gems (from Gemfile.common.rb in one or more apps) reported " \
+                  "vulnerabilities during the monthly bundle-audit check. Please update and release commons so " \
+                  "apps can pick up the fixes.\n\n**Gems:** #{gem_list}"
+                GithubIssueCreation.new.create_issue(
+                  repo: "neeto-commons-backend",
+                  title:,
+                  description:
+                )
+              end
           end
         end
       end

data/lib/neetob/cli/monthly_audit/security/code/yarn_audit.rb

@@ -1,6 +1,11 @@
 # frozen_string_literal: true
 
+require "set"
+require "net/http"
+require "uri"
+
 require_relative "../../../github/yarn_audit"
+require_relative "../../github_issue_creation"
 
 module Neetob
   class CLI
@@ -8,6 +13,15 @@ module Neetob
       module Security
         module Code
           class YarnAudit < CLI::Base
+            # Severities that count as audit failure (issue creation and commons tracking).
+            HIGH_OR_CRITICAL = %w[high critical].freeze
+
+            # Path where repos are cloned during audit (used to read neeto-commons-frontend/package.json if present).
+            CLONED_REPO_BASE = "/tmp/neetob"
+
+            # Fallback: fetch neeto-commons-frontend package.json from main when not cloned yet (common list is loaded before any clone).
+            COMMONS_FRONTEND_PACKAGE_JSON_URL = "https://raw.githubusercontent.com/neetozone/neeto-commons-frontend/main/package.json"
+
             def initialize
               super()
             end
@@ -16,35 +30,379 @@ module Neetob
               ui.success("### 1.1.2. Checking whether running `yarn audit` throws any vulnerabilities")
               repo_data = [["Repository", "Vulnerabilities Found", "Comments", "Audit Passed"]]
               ui.info "\n"
+
+              # Package names from package-common.json OR neeto-commons-frontend package.json.
+              # "Dependency of" in yarn audit is compared against this set to decide common vs app.
+              common_package_names = common_package_names_from_package_common |
+                common_package_names_from_commons_frontend_package_json
+
+              # Track "Dependency of" package names that are in commons and had high/critical vulns.
+              # Used to create a single issue in neeto-commons-frontend at the end.
+              common_packages_failed_audit = Set.new
+
+              last_comment = nil
+
               products_and_nanos_repos(:frontend).each do |repo|
-                ui.info("Checking yarn audit run results for #{repo}", print_to_audit_log: false)
+                ui.info(
+                  "Checking yarn audit run results for #{repo}",
+                  print_to_audit_log: false) if Thread.current[:verbose]
                 yarn_audit_result = Neetob::CLI::Github::YarnAudit.new([repo]).run
+
                 vulnerabilities_found = "No"
                 audit_passed = "No"
                 comments = nil
-                severity = yarn_audit_result.split("\n").select { |line|
-line.include?("Severity:") }.first&.strip&.gsub("|", ",")
-                if yarn_audit_result && !is_high_critical_vulnerabilities_found?(severity)
+
+                # Only high/critical findings drive failure and issue creation.
+                all_findings = parse_yarn_audit_findings(yarn_audit_result)
+                high_critical = all_findings.select { |f| HIGH_OR_CRITICAL.include?(f[:severity]&.to_s&.downcase) }
+
+                # Fallback: only use the Severity summary line when we couldn't parse any findings.
+                # This handles yarn formats where JSON/table parsing fails but a summary is present.
+                report_has_high_critical = all_findings.empty? ? report_has_high_or_critical?(yarn_audit_result) : false
+                has_high_critical = high_critical.any? || report_has_high_critical
+
+                if yarn_audit_result.nil? || yarn_audit_result.to_s.strip.empty? || !has_high_critical
                   audit_passed = "Yes"
-                else
+                  vulnerabilities_found = (all_findings.any? || report_has_high_critical) ? "Yes" : "No"
+                end
+
+                if has_high_critical
                   vulnerabilities_found = "Yes"
-                  vulnerabilities = yarn_audit_result.split("\n").select { |line|
- line.include?("vulnerabilities found") }.first&.strip
-                  comments = "#{vulnerabilities}<br>#{severity}"
 
-                  issue_url = GithubIssueCreation.new.create_issue(
-                    repo:, title: "Yarn audit: High/Critical vulnerabilities found",
-                    description: comments)
-                  audit_passed += " #{issue_url}"
+                  # Common if "Dependency of" is in commons OR the vulnerable package itself is in commons (e.g. qs).
+                  common_high_critical = high_critical.select { |f| finding_common?(f, common_package_names) }
+                  app_high_critical = high_critical.reject { |f| finding_common?(f, common_package_names) }
+
+                  # Track both dependency_of and vulnerable package when in commons (for neeto-commons-frontend issue).
+                  common_high_critical.each do |f|
+                    if f[:dependency_of] && common_package_names.include?(f[:dependency_of])
+                      common_packages_failed_audit.add(f[:dependency_of])
+                    end
+                    if f[:package] && common_package_names.include?(f[:package])
+                      common_packages_failed_audit.add(f[:package])
+                    end
+                  end
+
+                  # --- Issue creation logic (mirror bundle audit) ---
+                  # When we couldn't parse table blocks, we only have the summary → create one app issue with summary.
+                  # When we have parsed findings: 1) all common → no app issue; 2) mixed or all app → app issue.
+                  issue_url = nil
+                  if high_critical.empty?
+                    # Parser found no high/critical blocks; report summary says high/critical → use summary for issue.
+                    comments = build_summary_only_comments(yarn_audit_result, repo)
+                    issue_url = GithubIssueCreation.new.create_issue(
+                      repo:,
+                      title: "Yarn audit: High/Critical vulnerabilities found",
+                      description: comments
+                    )
+                  elsif app_high_critical.empty?
+                    # All high/critical vulns are from commons packages.
+                    comments = build_findings_summary(common_high_critical, repo, common_only: true)
+                  else
+                    comments = build_findings_summary(app_high_critical, repo, common_only: false)
+                    issue_url = GithubIssueCreation.new.create_issue(
+                      repo:,
+                      title: "Yarn audit: High/Critical vulnerabilities found",
+                      description: comments
+                    )
+                  end
+
+                  # "Common packages only" only when ALL high/critical are from commons (no app-specific).
+                  if issue_url.nil? && common_high_critical.any? && app_high_critical.empty?
+                    audit_passed = "No (common packages only; see neeto-commons-frontend)"
+                  elsif issue_url
+                    audit_passed = "No #{issue_url}"
+                  else
+                    audit_passed = "No (run `yarn audit` in #{repo} for details)"
+                  end
+
+                  same_as_last = comments == last_comment
+                  last_comment = comments
+                  comments = "''" if same_as_last
+                end
+
+                summary_line = yarn_audit_result.to_s.split("\n").find { |l|
+ l.include?("vulnerabilities found") }&.strip
+                severity_line = yarn_audit_result.to_s.split("\n").find { |l|
+ l.include?("Severity:") }&.strip&.gsub("|", ",")
+                table_comments = comments.nil? ? nil : (comments.split("<br>").first(3).join("<br>") + " ...")
+                if table_comments.to_s.empty?
+                  table_comments = if summary_line && severity_line
+                    "#{summary_line}<br>#{severity_line}"
+                  elsif all_findings.any?
+                    build_summary_from_findings(all_findings)
+                  else
+                    nil
+                  end
+                end
+                # When --verbose is enabled, log each high/critical finding as commons vs app-specific (for easier inspection).
+                if Thread.current[:verbose] && has_high_critical && high_critical.any?
+                  debug_section = build_debug_commons_vs_app(high_critical, common_package_names)
+                  table_comments = [table_comments, debug_section].compact.join("<br><br>")
                 end
-                repo_data << [repo, vulnerabilities_found, comments, audit_passed]
+                repo_data << [repo, vulnerabilities_found, table_comments, audit_passed]
               end
+
+              # Create one issue in neeto-commons-frontend and add last row when any common packages failed.
+              if common_packages_failed_audit.any?
+                commons_issue_url = create_commons_frontend_issue(common_packages_failed_audit)
+                commons_table_comments = "Packages from commons "\
+                "(Dependency of or vulnerable package) with high/critical vulns: " \
+                  "#{common_packages_failed_audit.sort.join(', ')}"
+                audit_passed_cell = commons_issue_url ? "No #{commons_issue_url}" : "No (issue creation skipped)"
+                repo_data << [
+                  "neeto-commons-frontend",
+                  "Yes (common packages)",
+                  commons_table_comments,
+                  audit_passed_cell
+                ]
+              end
+
               ui.print_table(repo_data)
             end
 
-            def is_high_critical_vulnerabilities_found?(severity)
-              severity&.include?("High") || severity&.include?("Critical")
+            def is_high_critical_vulnerabilities_found?(severity_or_report)
+              return false if severity_or_report.nil? || severity_or_report.to_s.strip.empty?
+
+              severity_or_report.to_s.include?("High") || severity_or_report.to_s.include?("Critical")
             end
+
+            private
+
+              # Fallback when table parser fails: report has high/critical if Severity line contains them.
+              def report_has_high_or_critical?(report)
+                return false if report.nil? || report.to_s.strip.empty?
+
+                severity_line = report.to_s.split("\n").find { |l| l.include?("Severity:") }
+                return false unless severity_line
+
+                # Try to parse counts from a line like:
+                # "Severity: 0 Low | 1 Moderate | 0 High | 0 Critical"
+                if severity_line =~ /Severity:\s*(\d+)\s+Low.*?(\d+)\s+High.*?(\d+)\s+Critical/i
+                  high_count = Regexp.last_match(2).to_i
+                  critical_count = Regexp.last_match(3).to_i
+                  high_count.positive? || critical_count.positive?
+                else
+                  # Fallback: any mention of High/Critical means high/critical vulns are present.
+                  severity_line.include?("High") || severity_line.include?("Critical")
+                end
+              end
+
+              # Load package-common.json from neeto-commons (same structure as neeto-commons-backend).
+              # Returns set of package names from "dependencies" and "devDependencies" keys.
+              # Uses NeetoCompliance::NeetoCommons.path.join("common_files/package-common.json").
+              def common_package_names_from_package_common
+                path = NeetoCompliance::NeetoCommons.path.join("common_files/package-common.json")
+                return Set.new unless path.to_s != "" && File.file?(path.to_s)
+
+                data = read_json_file(path.to_s)
+                deps = data["dependencies"] || {}
+                dev_deps = data["devDependencies"] || {}
+                (deps.keys + dev_deps.keys).to_set
+              rescue NameError, Errno::ENOENT
+                Set.new
+              end
+
+              # Load package.json from neeto-commons-frontend (local clone or GitHub raw).
+              # Common list is built before we iterate repos, so the clone often isn't there yet — fetch from main if needed.
+              # Returns set of package names from "dependencies", "devDependencies", and "peerDependencies".
+              def common_package_names_from_commons_frontend_package_json
+                data = commons_frontend_package_json_data
+                return Set.new unless data.is_a?(Hash)
+
+                deps = data["dependencies"] || {}
+                dev_deps = data["devDependencies"] || {}
+                peer_deps = data["peerDependencies"] || {}
+                (deps.keys + dev_deps.keys + peer_deps.keys).to_set
+              rescue JSON::ParserError
+                Set.new
+              end
+
+              # Returns parsed package.json from neeto-commons-frontend: local file if present, else fetch from main.
+              def commons_frontend_package_json_data
+                path = File.join(CLONED_REPO_BASE, "neeto-commons-frontend", "package.json")
+                return read_json_file(path) if File.file?(path)
+
+                uri = URI(COMMONS_FRONTEND_PACKAGE_JSON_URL)
+                response = Net::HTTP.get_response(uri)
+                return {} unless response.is_a?(Net::HTTPSuccess)
+
+                JSON.parse(response.body)
+              rescue Errno::ENOENT, JSON::ParserError, SocketError, Net::OpenTimeout
+                {}
+              end
+
+              # Prefer JSON output (yarn audit --json) for accurate "Dependency of" → common vs app.
+              # Fall back to table parsing if report is not JSON lines.
+              def parse_yarn_audit_findings(report)
+                return [] if report.nil? || report.to_s.strip.empty?
+
+                findings = parse_yarn_audit_json(report)
+                return findings if findings.any?
+
+                parse_yarn_audit_table(report)
+              end
+
+              # Yarn 1: yarn audit --json outputs one JSON object per line (auditAdvisory, auditSummary).
+              # data.advisory.severity, data.advisory.module_name; data.resolution.path = "dep@ver > vuln@ver" → first segment = Dependency of.
+              def parse_yarn_audit_json(report)
+                findings = []
+                report.to_s.each_line do |line|
+                  line = line.strip
+                  next if line.empty?
+
+                  obj = JSON.parse(line)
+                  next unless obj["type"] == "auditAdvisory"
+
+                  data = obj["data"] || {}
+                  advisory = data["advisory"] || {}
+                  resolution = data["resolution"] || {}
+                  severity = (advisory["severity"] || "").to_s.downcase
+                  package = (advisory["module_name"] || "").to_s.strip
+                  path = (resolution["path"] || "").to_s.strip
+                  path_segments = path.split(" > ").map { |segment| segment.sub(/@[^@]*\z/, "") }.reject(&:empty?)
+                  # First segment of path is the direct dependency ("Dependency of" in human table).
+                  dependency_of = path.split(" > ").first.to_s.strip
+                  dependency_of = dependency_of.sub(/@[^@]*\z/, "") if dependency_of.include?("@")
+
+                  next if package.empty?
+
+                  block_text = [
+                    "Package: #{package}",
+                    "Severity: #{severity}",
+                    "Dependency of: #{dependency_of}",
+                    "Path: #{path}",
+                    advisory["url"] ? "More info: #{advisory['url']}" : nil
+                  ].compact.join("\n")
+
+                  findings << {
+                    severity:,
+                    package:,
+                    dependency_of:,
+                    path:,
+                    path_segments:,
+                    block_text:
+                  }
+                rescue JSON::ParserError
+                  next
+                end
+                findings
+              end
+
+              # Parse human-readable table (box-drawing); used when --json not available.
+              def parse_yarn_audit_table(report)
+                return [] if report.nil? || report.to_s.strip.empty?
+
+                blocks = report.split(/\n(?=┌─)/)
+                findings = []
+
+                blocks.each do |block|
+                  next unless block.include?("Package") && block.include?("Dependency of")
+
+                  row_key = nil
+                  parsed = {}
+
+                  block.each_line do |line|
+                    next unless line.include?("│")
+
+                    parts = line.split("│").map(&:strip)
+                    key = parts[1].to_s.strip
+                    value = parts[2].to_s.strip
+
+                    if key != ""
+                      row_key = key
+                      parsed[row_key] = value
+                    elsif row_key && value != ""
+                      parsed[row_key] = "#{parsed[row_key]} #{value}"
+                    end
+                  end
+
+                  severity = parsed.keys.find { |k|
+ %w[low moderate high critical].include?(k.to_s.downcase) }&.to_s&.downcase
+                  package = parsed["Package"]
+                  dependency_of = parsed["Dependency of"]
+                  next if package.to_s.empty?
+
+                  keys = ["Package", "Patched in", "Dependency of", "Path", "More info"]
+                  block_text = parsed.slice(*keys).map { |k, v| "#{k}: #{v}" }.join("\n")
+
+                  findings << {
+                    severity:,
+                    package:,
+                    dependency_of:,
+                    block_text:
+                  }
+                end
+
+                findings
+              end
+
+              def build_findings_summary(findings, repo, common_only: false)
+                lines = findings.first(5).map { |f| f[:block_text].gsub("\n", "<br>").gsub("|", "\\|") }
+                suffix = if common_only
+                  "(All high/critical vulnerabilities are from packages in package-common.json; " \
+                    "no issue created for this app. See neeto-commons-frontend.)"
+                else
+                  "(run `yarn audit` in #{repo} to see all issues)"
+                end
+                lines.join("<br><br>") + " ... <br><br> " + suffix
+              end
+
+              # Build summary line from parsed findings (e.g. when report was JSON and had no human summary).
+              def build_summary_from_findings(findings)
+                return nil if findings.nil? || findings.empty?
+
+                by_sev = findings.group_by { |f| f[:severity]&.to_s&.downcase || "unknown" }
+                counts = { "low" => 0, "moderate" => 0, "high" => 0, "critical" => 0 }
+                by_sev.each { |sev, list| counts[sev] = list.size if counts.key?(sev) }
+                parts = %w[low moderate high critical].map { |s|
+ "#{counts[s]} #{s.capitalize}" if counts[s].positive? }.compact
+                "#{findings.size} vulnerabilities found<br>Severity: #{parts.join(' , ')}"
+              end
+
+              # A finding is commons if "Dependency of" is in common set OR the vulnerable package is in common set.
+              def finding_common?(finding, common_package_names)
+                dependency_of = finding[:dependency_of]
+                package = finding[:package]
+                path_segments = finding[:path_segments] || []
+
+                common_package_names.include?(dependency_of) ||
+                  common_package_names.include?(package) ||
+                  path_segments.any? { |name| common_package_names.include?(name) }
+              end
+
+              # Verbose logging helper: list each high/critical finding with [commons] or [app-specific].
+              def build_debug_commons_vs_app(high_critical, common_package_names)
+                lines = high_critical.map do |f|
+                  label = finding_common?(f, common_package_names) ? "[commons]" : "[app-specific]"
+                  "Package: #{f[:package]} | Severity: #{f[:severity]} | Dependency of: #{f[:dependency_of]} → #{label}"
+                end
+                "[verbose] Commons vs app-specific breakdown:<br>" + lines.join("<br>")
+              end
+
+              # Used when we detected high/critical from summary line but couldn't parse table blocks.
+              def build_summary_only_comments(report, repo)
+                summary = report.to_s.split("\n").find { |l| l.include?("vulnerabilities found") }&.strip
+                severity = report.to_s.split("\n").find { |l| l.include?("Severity:") }&.strip&.gsub("|", ",")
+                parts = [summary, severity].compact
+                parts << "(run `yarn audit` in #{repo} to see full details)"
+                parts.join("<br>")
+              end
+
+              def create_commons_frontend_issue(common_packages_failed_audit)
+                package_list = common_packages_failed_audit.sort.join(", ")
+                title = "Fix yarn audit high/critical vulnerabilities in package-common.json"
+                description = "The following packages (from package-common.json or" \
+                  " neeto-commons-frontend package.json, " \
+                  "as 'Dependency of' or vulnerable package in yarn audit) reported high or critical vulnerabilities " \
+                  "during the monthly yarn audit. Please update and release commons so apps can pick up the fixes." \
+                  "\n\n**Packages:** #{package_list}"
+                GithubIssueCreation.new.create_issue(
+                  repo: "neeto-commons-frontend",
+                  title:,
+                  description:
+                )
+              end
           end
         end
       end

data/lib/neetob/cli/sre/check_essential_env.rb

@@ -60,7 +60,7 @@ module Neetob
           end
 
           def check_envs_neetodeploy(app)
-            # TODO: Optimize once github.com/bigbinary/neeto-deploy-web/issues/3745 is done
+            # TODO: Optimize once github.com/neetozone/neeto-deploy-web/issues/3745 is done
             begin
               env_table = `bundle exec neetodeploy env list -a #{app}`
               json_parse_result = JSON.parse(env_table) rescue nil

data/lib/neetob/cli/users/audit.rb

@@ -105,7 +105,7 @@ module Neetob
           end
 
           def clean_repo_name(repo)
-            repo.gsub("bigbinary/", "")
+            repo.gsub("neetozone/", "")
           end
 
           def invalid_email?(email)

data/lib/neetob/cli/users/commits.rb

@@ -67,7 +67,7 @@ module Neetob
           def html_table_row(app, commit_id, email, time, date, title)
             starting_7_characters_of_commit = commit_id[0..6]
             "<tr>
-              <td class='commit'><a href='https://github.com/bigbinary/#{app}/commit/#{commit_id}'
+              <td class='commit'><a href='https://github.com/neetozone/#{app}/commit/#{commit_id}'
               target='_blank'>#{starting_7_characters_of_commit}</a></td>
               <td class='project'>#{app}</td>
               <td class='time'>#{time}</td>

data/lib/neetob/exception_handler.rb

@@ -36,7 +36,7 @@ module Neetob
           " Use \"neetob github login\" command to update or set the token.")
       when Octokit::Forbidden
         ui.error(
-          "You don't have enough permissions to access 'bigbinary' organization."\
+          "You don't have enough permissions to access 'neetozone' organization."\
           " Please grant access to this org while authorizing via the browser.")
       when Errno::ENOENT
         ui.error(

data/lib/neetob/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Neetob
-  VERSION = "0.5.83"
+  VERSION = "0.5.85"
 end

data/neetob.gemspec

@@ -10,13 +10,13 @@ Gem::Specification.new do |spec|
 
   spec.summary = "Provides a set of helper scripts for Github and Heroku."
   spec.description = "This gem gives different commands for interacting with Github and Heroku instances of existing neeto repos."
-  spec.homepage = "https://github.com/bigbinary/neetob"
+  spec.homepage = "https://github.com/neetozone/neetob"
   spec.license = "MIT"
   spec.required_ruby_version = ">= 3.1.3"
 
   spec.metadata["homepage_uri"] = spec.homepage
-  spec.metadata["source_code_uri"] = "https://github.com/bigbinary/neetob"
-  spec.metadata["changelog_uri"] = "https://github.com/bigbinary/neetob/blob/main/CHANGELOG.md"
+  spec.metadata["source_code_uri"] = "https://github.com/neetozone/neetob"
+  spec.metadata["changelog_uri"] = "https://github.com/neetozone/neetob/blob/main/CHANGELOG.md"
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
@@ -42,6 +42,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "actionview" # for helpers
   spec.add_dependency "activesupport" # for helpers
   spec.add_dependency "pry" # for debugging
+  spec.add_dependency "csv" # required by httparty; extracted from stdlib in Ruby 3.4+
 
   # To add the files from submodules
   `git submodule --quiet foreach pwd`.split($\).each do |submodule_path|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: neetob
 version: !ruby/object:Gem::Version
-  version: 0.5.83
+  version: 0.5.85
 platform: ruby
 authors:
 - Udai Gupta
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-02-09 00:00:00.000000000 Z
+date: 2026-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -178,6 +178,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: csv
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: This gem gives different commands for interacting with Github and Heroku
   instances of existing neeto repos.
 email:
@@ -378,13 +392,13 @@ files:
 - scripts/workflows/sparkpost.ts
 - tsconfig.json
 - yarn.lock
-homepage: https://github.com/bigbinary/neetob
+homepage: https://github.com/neetozone/neetob
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/bigbinary/neetob
-  source_code_uri: https://github.com/bigbinary/neetob
-  changelog_uri: https://github.com/bigbinary/neetob/blob/main/CHANGELOG.md
+  homepage_uri: https://github.com/neetozone/neetob
+  source_code_uri: https://github.com/neetozone/neetob
+  changelog_uri: https://github.com/neetozone/neetob/blob/main/CHANGELOG.md
 post_install_message:
 rdoc_options: []
 require_paths: