Add release notes

Author: danudey

release-notes/v3.31.7-release-notes.md

@@ -0,0 +1,29 @@
+20 Aug 2026
+
+#### Headline feature 1
+
+#### Headline feature 2
+
+#### Bug fixes
+
+#### Other changes
+
+- None required. CI-only change. [calico 13578](https://github.com/projectcalico/calico/pull/13578) (@song-jiang)
+- Refresh the node-driver-registrar dependency patch to remediate CVEs (grpc v1.82.1, x/net, x/text). [calico 13520](https://github.com/projectcalico/calico/pull/13520) (@skoryk-oleksandr)
+- Update bundled Envoy images (envoy-gateway v1.8.2, envoy-proxy v1.38.3) and refresh dependency patches to remediate CVEs. [calico 13502](https://github.com/projectcalico/calico/pull/13502) (@skoryk-oleksandr)
+- ebpf: Fixed IPv6 session affinity entries being randomly deleted (or never expiring) due to a struct layout mismatch when Felix read the affinity timestamp, which could re-balance sticky connections to a different backend. [calico 13460](https://github.com/projectcalico/calico/pull/13460) (@tomastigera)
+- Fixes an issue in nftables mode where IP set members could be left unprogrammed after the nftables table was deleted and recreated. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport)
+- Fixes an issue in nftables mode where Felix could panic when reading back an IP set member it could not parse. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport)
+- Fixes an issue where IP sets containing overlapping CIDRs could fail to program correctly in nftables mode after a member was removed. [calico 13441](https://github.com/projectcalico/calico/pull/13441) (@caseydavenport)
+- Fixes CALICO_IPV6POOL_VXLAN being ignored in IPv6-only clusters where the IPv4 pool is disabled (CALICO_IPV4POOL_CIDR=none), which left the IPv6 pool without VXLAN encapsulation. [calico 13439](https://github.com/projectcalico/calico/pull/13439) (@caseydavenport)
+- [eBPF] Fix a window in which a new connection to a local workload could skip that workload's ingress policy, when the connection was started while the workload's route was still being programmed. [calico 13390](https://github.com/projectcalico/calico/pull/13390) (@tomastigera)
+- The default CNI configuration now declares cniVersion 1.0.0 (previously 0.3.1), enabling Calico as a multus delegate on OpenShift 4.23+. Requires containerd v1.6+ or CRI-O v1.24+. [calico 13378](https://github.com/projectcalico/calico/pull/13378) (@sridhartigera)
+- Fixed the bundled Envoy Gateway crash-looping on clusters whose Gateway API CRD set omits ListenerSet, TLSRoute or BackendTLSPolicy, such as OpenShift or GKE's managed Gateway API addon. [calico 13367](https://github.com/projectcalico/calico/pull/13367) (@electricjesus)
+- Fixed a bug where Calico could advertise a Service IP over BGP from a node whose local endpoint was not Ready, causing connection failures. [calico 13255](https://github.com/projectcalico/calico/pull/13255) (@MichalFupso)
+- Fixed a kernel dmesg spew ("could not enable bpf_trace_printk events") on eBPF-dataplane nodes running with kernel lockdown=confidentiality (e.g. Talos). [calico 13234](https://github.com/projectcalico/calico/pull/13234) (@tomastigera)
+- Fixed a rare start-of-day deadlock that could prevent Felix from restarting when a restart-requiring configuration change (e.g. the node IP being set) arrived while Felix was still starting up. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
+- Fixed a latent bug where EnsureBlock could allocate an IPv6 block from the wrong IP pool when an explicit IPv6 pool selector was provided (Windows host-local IPAM block reservation). [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
+- eBPF: fix state explosion in the BPF verifier (resulting in programs not loading) caused by debug logs on a certain path. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
+- eBPF dataplane: fix loss of connectivity to the Kubernetes API server service after the API server is unavailable for a period, when using bpfNetworkBootstrap. Felix no longer clears the API server service's NAT backend when its endpoints transiently empty, so connectivity recovers without a calico-node restart. [calico 13066](https://github.com/projectcalico/calico/pull/13066) (@lucastigera)
+- calicoctl cluster diags now collects additional cluster state (v3 API resources, Multus network-attachment-definitions, unsupported-annotation usage) and collects eBPF map dumps as machine-parseable JSON, falling back to legacy text output against older calico-node versions. [calico 13020](https://github.com/projectcalico/calico/pull/13020) (@tomastigera)
+- Fixed a bug where Felix's periodic route resync did not detect (and repair) Calico-owned routes that had been modified in place by another process. Fixed unnecessary reprogramming of unchanged IPv6 multi-path routes on resync, and a corner case where removing an IPAM block route could trigger a spurious conntrack cleanup for a workload owning the block's network address. [calico 12959](https://github.com/projectcalico/calico/pull/12959) (@fasaxc)