Before I answer your question, it's perhaps worth explaining the purpose of that generated empty metapackage. The purpose is so that if some serious security issue related to our tweaks comes to light, we can push out a security update via our apt repo. It has limitations, and we've never actually used it to the best of my knowledge (certainly not in the last ~8 years) but in theory it may assist us to patch a serious sec issue in the future...

To your question, the version for the built package (and also the generated name of the ISO and other builds when building with buildtasks) comes from the top of the changelog. So if you add a new 18.0 changelog entry, it will build a 18.0 package. E.g. I might add a new entry to the top of the changelog file like this:

turnkey-concrete-cms-18.0 (1) turnkey; urgency=low

  * Updated Concrete CMS to vX.Y.

 -- Jeremy Davis   Web, 2 Aug 2023 22:29:25 +0000

There aren't any hard and fast rules and TBH historically our changelog haven't been very consistent (sometimes going into a fair bit of detail, other times glossing over or not even mentioning relevant changes). So bottom line, we'll likely tweak the changelogs before we do the final/official builds for release. So please don't feel any pressure to write exhaustive changelog entries. Although please feel free to note any changes that you think are worth mentioning (bug fixes and feature changes are always worth mentioning, otherwise it's somewhat up to you).

Thanks again for all your contributions too and apologies on my tardy response(s)!