>> Upgrading to GitLab 19.3.6 on October 22 didn’t fix the vulnerability. The fix isn’t in GitLab’s own code but in a patch to Ruby, which GitLab applies only in its official packages. Our image used standard Ruby, so it didn’t get the patch.

>> The bug is in Ruby’s regular expression engine, so any program that compiles regular expressions from untrusted input is exposed, not only GitLab.

> I feel like this era of constant exploits/patches is really bad for those who build from source or make their own images vs those who rely on provided images and upgrade them often. I really can't think of a decent solution for those people other than being plugged in 24/7 to the latest news which is really unfortunate and must be exhausting...

I see how you might come to that conclusion, but on FreeBSD that CVE was tracked [1] a long time ago. Meaning the Ruby was patched a long time ago. So running the unsupported GitLab on FreeBSD is immune to this vulnerability for a long time because it isn't being deployed with frozen dependencies

It's really hard to get people to grasp this

[1] https://www.vuxml.org/freebsd/2ce1a2f1-0177-11ef-a45e-08002784c58d.html