update CHANGELOG and bump package.json