doc: add PR-URL requirement for security backports

RafaelGSS · aduh95 · commit 9ebf1ffbeb1f · 2026-01-19T19:19:34.000+01:00
Security release automation requires that all backport commits include PR-URL metadata in their commit messages. Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #61256 Refs: nodejs/node-core-utils#1022 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>
diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md
@@ -83,6 +83,8 @@ The current security stewards are documented in the main Node.js
   * Get volunteers for the upcoming security release on the affected release
     lines.
   * Make sure to sync nodejs-private (vN.x) branches with nodejs/node.
+  * **Important:** Ensure that all backport commits include the `PR-URL` metadata
+    in their commit messages. This is required for the security release automation.
 
 * [ ] 7\. **Preparing Pre and Post Release Blog Posts:**
   * [ ] Create a pre-release blog post using `git node security --pre-release`.
