Tip: grep your Ruby code for regexes built from user input before deciding the Onigmo fix can wait
Search:rg -n "Regexp\.(new|union|compile)|/#\{" app lib and check whether any argument can come from params, headers, uploaded config or database fields users can edit (search filters, CI rules and webhook rules are common).
Prioritize: anything multi-tenant or internet-facing that accepts patterns gets Ruby 4.0.9, 3.4.12 or 3.3.13 first. Rebuild container images; a Gemfile change does not update the interpreter.
Interim: replace user-supplied regexes with plain substring matching or Regexp.escape, which removes the attacker's control over pattern structure. Ruby says timeouts and length caps do not protect you.