Update CHANGES

Whitelist `exists` arel method from SQL injection check
Fix attribution of cyclic ancestors fix
Bump to 2.6.3