why do they release it at 5pm PDT? A lot of people are leaving work on the west coast. The rest of the country people are home eating dinner. EU is sleeping. Really stupid time.
EDIT: Or, indeed, that security patches should be delayed at all.
I meant delayed in the sense that if a patch is available, and fixes anything other than a trivial problem, it should be released as soon as is practicable (appreciating that there may be dependencies they wish to synchronise with, or in this case, trying to mitigate the obvious risks associated with the immediate definition of the exploit). Obviously I'm not limiting myself to gitlab patches here.
Appreciate the heads-up - especially for people with an unfortunate combination of highly exposed systems and inconvenient timezones. : )
Pretty common for security patches to take place out of hours