For the changelog, I would suggest to start with the next version, report changes from the first Apache version on.
Concerning the NOTICE file, I tried to follow that guide. As far as as I understood it, we need to have the notices of all dependencies that we ship. I took a look at what some of the other Apache and Apache Licensed projects did (Netty, Spark, Derby) and tried to follow that style. 1. For any dependency whose bits are bundled <http://www.apache.org/dev/licensing-howto.html#bundled-vs-non-bundled>, consider whether LICENSE and NOTICE need to be modified. (DO NOT modify LICENSE or NOTICE for dependencies whose bits are not bundled.)
