Add CHANGELOG entry for js responder security fix