Patchward has opened fix PRs against public repositories maintained by people with no reason to be kind about it. Outcomes below use literal labels — merged, closed, superseded, open. A PR that did not merge is not described as though it did.
checkdmarc#261 — Patchward flagged a Bandit B110 (try/except/pass) finding. Outcome label: closed — superseded. The PR itself was closed with unmerged commits; the maintainer reviewed it, narrowed the exception catch to UnicodeError, and shipped that fix in v5.17.3. The finding shipped; this PR did not.
verified 2026-08-20
This is the example worth reading closely, and it is why the label matters. A page willing to call this one "merged" would be a page you could not trust on anything else. The scanner found a real defect; the maintainer chose a narrower fix than the one proposed and shipped his own. That is a good outcome and an unmerged PR at the same time.
2 Patchward security-fix PRs merged, both on mpfb2. Which two of the nine merged mpfb2 PRs are Patchward's is not distinguished by any source available to this site, so they are stated as a count and not linked individually.
verified 2026-08-20
Note what is missing: individual links. Attributing specific merged PR numbers to Patchward rather than to its sibling tool is not something any source available to this site supports, so the count is stated and the links are withheld. An unverifiable link is worse than no link.