Changelog

[ghostdevv]

I've implemented changelog before and what I landed on was (assuming we want to render the changelog, not just link to it)

1. Check the tarball for the CHANGELOG.md file
2. Check the repo for the CHANGELOG.md file
3. Pull from GitHub releases

I'm also looking to re-implement this on the work in progress api, but with better checks for the changelog file since we can process the whole tarball like yarn/algolia does here (although there are even more options I can think of).

con: if adopted by npm they could bring breaking changes like with what css nesting did in sass/scss.

The entire registry is full of inconsistencies so I think we'd be ok!

Have an "npmx" object field and then in there have "changelogs" field (example: {"npmx": {"changelogs": "https://example.pkg/changes"}})

If we could do it without this that'd be cool, especially if it encourages more people to ship a changelog file with their package

Originally posted by @ghostdevv in #501

[ghostdevv]

I've also thought that instead of storing the entire changelog file for each version, we could try to extract the bit of the changelog that is relevant for that specific version and store that. Then whomever is consuming the changelog could stitch them back together. Dependabot does this for example.