One operational detail worth adding: GitLab's fix shipped as patches to the Ruby bundled in its own packages and images, so anyone running GitLab on a distribution or self-built Ruby stays vulnerable even on the latest GitLab version. Alpine Linux's public instance got caught exactly this way in October - they upgraded GitLab twice and remained exploitable until they pulled a Ruby with the fix. If you run self-managed, check the interpreter (3.3.13 / 3.4.12 / 4.0.9+), not just the GitLab version string. CISA put it in KEV with a November 1 due date for federal agencies, so the window is short.