CGA-28q6-g7p6-mj94

This CVE is a false-positive. The CVE is relevant for the self-hosted Gitlab CE and Enterprise applications, whereas the gitlab-operator[-fips] package is merely an operator that facilitates deploying these applications. The code that this CVE applies to is not included here.