[thedanbob]

This doesn't look like the actual fix but rather a follow-up refactor. I believe the fix is here: https://gitlab.com/gitlab-org/gitlab/-/commit/abe79e4ec43798...

    - recoverable.send_reset_password_instructions(to: email) if recoverable&.persisted?
    + recoverable.send_reset_password_instructions if recoverable&.persisted?

[1oooqooq]

on GitHub, the fix would be adding a regex to ensure there was no list on the user supplied email.

[progval]

and making send_reset_password_instructions get the email addresses itself from the "recoverable" object.

[alexpls]

Oh yeah, good pickup thanks!