From a29d125ee7a8f84790c6ca14fcdc145d2aecec29 Mon Sep 17 00:00:00 2001
From: Chris Hennick <4961925+Pr0methean@users.noreply.github.com>
Date: Thu, 9 May 2024 19:50:38 -0700
Subject: [PATCH] Update pull_request_template.md

Signed-off-by: Chris Hennick <4961925+Pr0methean@users.noreply.github.com>
---
 pull_request_template.md | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/pull_request_template.md b/pull_request_template.md
index b3f11c75..079b0f35 100644
--- a/pull_request_template.md
+++ b/pull_request_template.md
@@ -1,5 +1,16 @@
 <!-- 
-We welcome your pull request, but we have some requirements that a lot of PRs don't meet:
+We welcome your pull request, but because this crate is downloaded about 1.7 million times per month (see https://crates.io/crates/zip),
+and because ZIP file processing has caused security issues in the past (see 
+https://www.cvedetails.com/vulnerability-search.php?f=1&vendor=&product=zip&cweid=&cvssscoremin=&cvssscoremax=&publishdatestart=&publishdateend=&updatedatestart=&updatedateend=&cisaaddstart=&cisaaddend=&cisaduestart=&cisadueend=&page=1
+for the gory details), we have some requirements that help ensure the crate remains secure and panic-free, and that a lot of PRs 
+don't meet.
+
+We don't filter out "ZIP bombs" because extreme compression ratios and shallow file copies have legitimate uses; but
+we expect the tools we provide for checking that extraction is safe, such as the `ZipArchive::decompressed_size` method in
+https://github.com/zip-rs/zip2/blob/master/src/read.rs, to remain reliably effective. We also expect all the crate's methods to
+remain panic-free, so that this crate can be used on servers without creating a denial-of-service vulnerability.
+
+These are our requirements for PRs, in addition to the usual functionality and readability requirements:
 - This codebase sometimes changes rapidly. Please rebase your branch before opening a pull request, and 
   grant @Pr0methean write access to the source branch (so he can fix later conflicts without being subject 
   to the limitations of the web UI) if EITHER of the following apply:
@@ -11,6 +22,10 @@ We welcome your pull request, but we have some requirements that a lot of PRs do
   repo is no longer maintained and will be archived once the pre-existing issues are closed.
 - Your changes must build against the MSRV (see README.md) AND the latest stable Rust version AND the latest nightly Rust version, 
   with `--no-default-features` AND with `--all-features` AND with the default features.
+- PRs must pass `cargo clippy --all-targets` and `cargo fmt --check --all`,
+  with `--no-default-features` AND with `--all-features` AND with the default features.
+  If you need to add a new `#[allow]` attribute, please place a comment on the same line or just above it, explaining what the
+  exception applies to and why it's needed.
 - Commit messages and the PR title must conform to [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) and start 
   with one of the types specified by the [Angular convention](https://github.com/angular/angular/blob/22b96b9/CONTRIBUTING.md#type).
 - All commits must be signed and display a "Verified" badge; see