correct the version number in changelog
warn about tarbomb