We’re talking about a consumer who overrides src on a package and then also consumes meta.changelog on that package (if you don’t explicitly consume it, nothing breaks), and the choices are between an incorrect value and an error. I’d argue the error is preferable, though it’s a niche enough scenario that I don’t think anyone should care strongly either way.
I’m skeptical about the wisdom of this, but I could get behind adding a passthru.releaseUrl attribute to fetchFromGitHub (and other forge fetchers, as needed), and then packagers could write meta.changelog = finalAttrs.src.releaseUrl; if they don’t have a better changelog to which to link, similar to how meta.homepage is often inherited from src.