The 10.0 carries GitLab's name and the bug is Ruby's
Four critical vulnerabilities, three rounds of patches, five weeks, one researcher and a single component: Onigmo, the regular expression engine Ruby carries inside. Each patch left the previous version inside the next advisory's affected range, and the fix for the last one does not travel in GitLab's code but in a patch to the interpreter GitLab packages. We walk through the timeline with exact versions, the 16-bit field behind it, and which row your inventory is missing.