With the eMudhra situation we saw e.g. Go doing an emergency release that blacklists the certs, while they aren’t shipped with Go, as a protection of dependencies that haven’t caught up.

In this situation, wouldn’t the more responsible behaviour of gitlab be to blacklist Ruby runtimes that enable the CVE?