I think either the changelog or the README both seem pretty reasonable.

Changelog is probably more likely to get eyes when someone is upgrading (vs. README which will mostly get read the first time someone grabs the package)