As we note on bug 40275, there are times where we lookup the patron using cardnumber or userid when we really should be using borrowernumber where possible. Not all Koha users will have a cardnumber plus we have on-going issues around uniqueness of cardnumber and userid whereas borrowernumber is an internal persistent and unique identifier.
After applying 40275 I notice there's still a lot of times where we lookup borrowers using cardnumber. grep -R --exclude-dir="node_modules" --exclude-dir="t" --exclude-dir=".git" -- "->find.*cardnumber" | wc -l This returns 27 occurrences. Some of these will be legitimate but we've got lots of weird ones like reserve/request.pl where we use the cardnumber in koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt instead of the borrowernumber koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt is an interesting one. There we use circulation.pl?findborrower with a cardnumber... and that is probably OK because the data at hand is the cardnumber. -- Anyway, this will take some investigating and teasing apart overall. Best to do in other dependence reports I think.