`Patches.parse` doesn't seem to be initializing `secure_hash` for any of the patches. Is this intentional?