Taking a look at cve.org's version of the rules, I see a changelog starting on section 6. Which is great!
Less great is that the changelog seems to be itself volatile and resistant to consistent numbering. The most recent change will always be "6.1," so all prior changes will renumber every time a new change lands. This kind of sucks for referencing and deeplinking.
So, more long-term sensible strategy (in my opinion) would be to add changes to the bottom of the list if you're going to number the sections like this, swapping 4.1.0 for 4.2.0, and building your changelog downwards in order to retain the numbering consistency. That way, 4.2.0's changes will always be section 6.2, and 4.3.0 will be 6.3, etc. It's a minor thing, but it'll become irritating after a couple of years' worth of changes.
Taking a look at cve.org's version of the rules, I see a changelog starting on section 6. Which is great!
Less great is that the changelog seems to be itself volatile and resistant to consistent numbering. The most recent change will always be "6.1," so all prior changes will renumber every time a new change lands. This kind of sucks for referencing and deeplinking.
So, more long-term sensible strategy (in my opinion) would be to add changes to the bottom of the list if you're going to number the sections like this, swapping 4.1.0 for 4.2.0, and building your changelog downwards in order to retain the numbering consistency. That way, 4.2.0's changes will always be section 6.2, and 4.3.0 will be 6.3, etc. It's a minor thing, but it'll become irritating after a couple of years' worth of changes.