Since a "releaselog" can serve different audiences, here are three tailored drafts. Use the one that best fits your situation: Option 1: The "What's New" (Customer-Facing)
Best for users who want to know how the update improves their experience. Releaselog
Upgraded [Library/Service] to v[Number] to resolve security vulnerability [CVE-ID]. Since a "releaselog" can serve different audiences, here