@zekjur cherry-pick does only work if it has been committed already. If you receive a patch by email, you have to apply it first. IMO this is clearly an attack vector for projects.