That's pretty much the only way to do a security update for something people are going to want to patch asap. warn people in advance it's coming so they can be ready to apply when released, without giving away any details that might help someone find the exploit before it comes.

It would be nice to know what versions are affected now but I can understand that they may not want to reveal that until it's patched to prevent any unauthorized access of private repositories.

There are not a lot of things at GitLab that we don't disclose if we have the option to be open about it. [0]

In this case, we can't disclose any more than we did so far.

We'll probably do a public post-mortem of the entire process once it's behind us.

[0]: https://about.gitlab.com/primer/

Yesterday there wasn't even an official post for 8+ hours after the mail to the mailing list. Great that gitlab notifies people about security issues and tries to fix them... but no points for transparency here