diff --git a/grafana.spec b/grafana.spec
index cbca255..e7863f3 100644
--- a/grafana.spec
+++ b/grafana.spec
@@ -109,6 +109,8 @@ Recommends: grafana-pcp
 %endif
 
 # vendored golang and node.js build dependencies
+# this is for security purposes, if nodejs-foo ever needs an update,
+# affected packages can be easily identified.
 # Note: generated by the Makefile (see README.md)
 Provides: bundled(golang(cloud.google.com/go/storage)) = 1.8.0
 Provides: bundled(golang(github.com/BurntSushi/toml)) = 0.3.1