Comment by akersten
4 hours ago
> If you use our alpinelinux/gitlab container image, pull alpinelinux/gitlab:19.3.6 again. The image published on October 27 contains Ruby 3.3.13. Any 19.3.6 image you pulled before October 27, and all older tags, are vulnerable.
shouldn't they tag a new version instead of re-releasing a fixed 19.3.6, if earlier 19.3.6 are vulnerable?
Image tags are not are versions and shouldn't be treated as such. The tag "19.3.6" refers to the version of Gitlab, which hasn't changed. This is why everyone should pin their images to a specific sha and setup a process to get notified on changes
Using Renovate can be one of those processes.