Merge pull request #1173 from nodejs/SimenB-patch-1

docs: update contributing to mentions security yarn releases

Author: PeterDaveHello

CONTRIBUTING.md

@@ -8,7 +8,7 @@ New **Node.js** releases are released as soon as possible.
 
 New **NPM** releases are not tracked. We simply use the NPM version bundled in the corresponding Node.js release.
 
-**Yarn** is updated to the latest version only when there is a new Node.js SemVer PATCH release, and it's updated only in the branch with the new release, preferably in the same PR. The `update.sh` script does this automatically when invoked with a specific branch, e.g. `./update.sh 6.10`.
+**Yarn** is updated to the latest version only when there is a new Node.js SemVer PATCH release (unless Yarn has received a security update), and it's updated only in the branch with the new release, preferably in the same PR. The `update.sh` script does this automatically when invoked with a specific branch, e.g. `./update.sh 6.10`.
 
 ## Adding dependencies to the base images