doc: add suggestion for OpenSSL only sec releases

Fixes: nodejs/TSC#1187 Signed-off-by: Michael Dawson <[email protected]> PR-URL: #42456 Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Danielle Adams <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>
nodejs · Apr 4, 2022 · 607a5ca · 607a5ca
1 parent 4dfc29d
commit 607a5ca
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md
@@ -74,6 +74,17 @@ The current security stewards are documented in the main Node.js
   (Re-PR the pre-approved branch from nodejs-private/nodejs.org-private to
   nodejs/nodejs.org)
 
+  If the security release will only contain an OpenSSL update consider
+  adding the following to the pre-release announcement:
+
+  ```text
+  Since this security release will only include updates for OpenSSL, if you're using
+  a Node.js version which is part of a distribution which uses a system
+  installed OpenSSL, this Node.js security update might not concern you. You may
+  instead need to update your system OpenSSL libraries, please check the
+  security announcements for the distribution.
+  ```
+
 * [ ] Pre-release announcement [email][]: _**LINK TO EMAIL**_
   * Subject: `Node.js security updates for all active release lines, Month Year`
   * Body: