I haven't investigated too much but see this issue: osquery/osquery#8346
I have cloned the latest version and run it with go run ./cmd/release-notes --changelog CHANGELOG.md --last 5.12.1 --new 5.12.2 and indeed it puts in commits that should not be there (they are on master).
Between 5.12.1 and 5.12.2 only 2 commits exists: osquery/osquery@5.12.1...5.12.2