Reformat release notes

Author: danudey

release-notes/v3.31.6-release-notes.md

@@ -1,30 +1,26 @@
 18 Jun 2026
 
-#### Headline feature 1
-
-#### Headline feature 2
-
 #### Bug fixes
 
-#### Other changes
-
 - calico/node now refreshes the CNI plugin's kubeconfig immediately when the pod's projected ServiceAccount token is rotated, closing a 6-12h window where an externally-invalidated token could cause CNI ADD to fail with "Unauthorized" until the calico-node pod was restarted. [calico 12941](https://github.com/projectcalico/calico/pull/12941) (@skoryk-oleksandr)
-- NONE [calico 12939](https://github.com/projectcalico/calico/pull/12939) (@lucastigera)
-- Upgrade bundled Envoy Gateway to v1.8.0 (adds ListenerSet support) and bump bundled envoy-proxy, envoy-ratelimit, and node-driver-registrar images. [calico 12933](https://github.com/projectcalico/calico/pull/12933) (@lucastigera)
-- Updates LoadBalancer controller to not run when not explicitly configured as part of ENABLED_CONTROLLERS [calico 12932](https://github.com/projectcalico/calico/pull/12932) (@MichalFupso)
 - Fix SNAT being skipped for traffic destined to LoadBalancer-only IPPools by excluding them from the all-ipam-pools ipset. [calico 12857](https://github.com/projectcalico/calico/pull/12857) (@defo89)
 - Fix calico-kube-controllers IPAM GC controller getting stuck when cleaning up nodes during rapid scale-down. [calico 12746](https://github.com/projectcalico/calico/pull/12746) (@haojiwu)
 - ebpf - Fix kube-proxy losing the NodePort externalTrafficPolicy=Local route-fixup trigger after a syncer swap, which could cause stale NAT entries on remote backends. [calico 12744](https://github.com/projectcalico/calico/pull/12744) (@tomastigera)
 - Fixes nft binary segfaults in calico/node when newer nftables is in use elsewhere on the host. [calico 12714](https://github.com/projectcalico/calico/pull/12714) (@caseydavenport)
 - ebpf - Fix transient NodePort connection failures when Felix restarts on a node receiving external NodePort traffic. [calico 12693](https://github.com/projectcalico/calico/pull/12693) (@tomastigera)
 - Fixes a Felix panic that could occur when an IP set selector matched both a NetworkSet CIDR and workload IPs contained within it, with nftables as the active dataplane. [calico 12672](https://github.com/projectcalico/calico/pull/12672) (@caseydavenport)
-- kube-controllers, goldmane: use default secure pprof server (localhost only). Use `kubectl port-forward` for remote access. [calico 12634](https://github.com/projectcalico/calico/pull/12634) (@Behnam-Shobiri)
-- Sanitize log output [calico 12606](https://github.com/projectcalico/calico/pull/12606) (@Behnam-Shobiri)
 - Typha now rejects oversized inbound client gob frames before reading them, preventing a potential denial-of-service caused by excessive memory allocation. [calico 12591](https://github.com/projectcalico/calico/pull/12591) (@Behnam-Shobiri)
 - Fix LoadBalancer IPAM race on kube-controllers startup that could assign multiple addresses to a Service. [calico 12569](https://github.com/projectcalico/calico/pull/12569) (@MichalFupso)
+- Fixed a Felix eBPF cleanup race condition that could cause a nil-pointer panic when an interface disappeared during TC qdisc cleanup. [calico 12481](https://github.com/projectcalico/calico/pull/12481) (@Behnam-Shobiri)
+- Fix nftables segfault on systems with newer nft versions (Debian Trixie, Fedora 42+) by bumping knftables to v0.0.21. [calico 12470](https://github.com/projectcalico/calico/pull/12470) (@caseydavenport)
+
+#### Other changes
+
+- Upgrade bundled Envoy Gateway to v1.8.0 (adds ListenerSet support) and bump bundled envoy-proxy, envoy-ratelimit, and node-driver-registrar images. [calico 12933](https://github.com/projectcalico/calico/pull/12933) (@lucastigera)
+- Updates LoadBalancer controller to not run when not explicitly configured as part of ENABLED_CONTROLLERS [calico 12932](https://github.com/projectcalico/calico/pull/12932) (@MichalFupso)
+- kube-controllers, goldmane: use default secure pprof server (localhost only). Use `kubectl port-forward` for remote access. [calico 12634](https://github.com/projectcalico/calico/pull/12634) (@Behnam-Shobiri)
+- Sanitize log output [calico 12606](https://github.com/projectcalico/calico/pull/12606) (@Behnam-Shobiri)
 - Sanitize calicoctl log output [calico 12537](https://github.com/projectcalico/calico/pull/12537) (@Behnam-Shobiri)
 - app-policy (Dikastes): normalize HTTP request-target before evaluating Application Layer Policy path rules, and reject shapes whose resolved form depends on upstream-specific decoding. Request paths are now RFC 3986 / RFC 7230 normalized (decode percent-escapes once, resolve dot-segments and repeated slashes, fold backslashes, strip matrix parameters per segment) and prefix matches are anchored to path-segment boundaries. Paths whose decoded form still contains percent-encoded path separators (%2e / %2f / %5c), or contains a null byte, are rejected. [calico 12533](https://github.com/projectcalico/calico/pull/12533) (@electricjesus)
 - Sanitize CNI plugin log output. [calico 12527](https://github.com/projectcalico/calico/pull/12527) (@Behnam-Shobiri)
-- Fixed a Felix eBPF cleanup race condition that could cause a nil-pointer panic when an interface disappeared during TC qdisc cleanup. [calico 12481](https://github.com/projectcalico/calico/pull/12481) (@Behnam-Shobiri)
-- Fix nftables segfault on systems with newer nft versions (Debian Trixie, Fedora 42+) by bumping knftables to v0.0.21. [calico 12470](https://github.com/projectcalico/calico/pull/12470) (@caseydavenport)
 - Use cryptographically secure random number generator for X.509 certificate serial numbers. [calico 12467](https://github.com/projectcalico/calico/pull/12467) (@Behnam-Shobiri)