On the GitLab point: if you self-host CE and don’t need the newest features, the boring-but-effective posture is pinning to the last patch of the previous minor and only jumping on security releases — then a weekly unattended check of the release notes beats reading every announcement. Two things that actually bite people in practice:

1. The unauthenticated RCE class of bugs usually needs an exposed web endpoint, so an instance that’s only reachable over Tailscale/WireGuard buys you far more than rushing every patch. Network exposure first, patch cadence second.

2. When you do patch, snapshot the VM/container first — GitLab upgrades have historically had the same failure mode as major database migrations: fine on the test instance, wedged on yours because of a leftover custom config. A rollback point turns a scary maintenance window into a five-minute revert.

Also relevant to this week’s Bitwarden note: if the dual-license direction worries you, Vaultwarden keeps your server-side options open regardless of what the official clients do later — the data format is still exportable, so the real risk is forgetting to take regular unencrypted-format backups.