Comment 4 for bug 518317

>According Debian/Ubuntu Policy[1] this file is for changes in package, not for changes in the
>upstream source, for this purpose is the upstream's changelog file.

When you have an upstream update to a package, it is a good practice to list its highlight in the changelog. Remember that the Debian/Ubuntu changelog is the only thing visible to an user before deciding to install.
Also, it will be good to have it for traceability.

>Why this? It depends on the same version PKG_CHECK_MODULES(SRCHILITE, [source-highlight >= 3.1.1])

Thats indeed why, build-depends have to be in accordance to the need of the source package (otherwise, amongst other things, you screw up backports).

>I ran licensecheck and I dont find any files with other license than GPL or with other owners.

Never only rely on licensecheck or any other tool. If you actually take the time to check all the sources (or the diff w.r.t. the previous release) you will find the file I'm talking about. Beside, you REALLY need to check the diff w.r.t. a previous release to do a proper update. How can you update the packaging if you don' t know what was changed upstream!?

>I passed standard checks with make check tests

Is somebody using this package doing a make check or actually using it? A make check can spot problems due to a different build environment, not the problems that an eventual user may be facing.

BTW, you also need to add a closure tag for this bug in the changelog.