Reorder release notes

diff --git a/doc/notes/notes-9.21.8.rst b/doc/notes/notes-9.21.8.rst
index d728e03cc53d443ec995a0540895a957a61e28a9..b30ec38accbe78cf62911b5b0d27f0464d2a8e82 100644 (file)
--- a/doc/notes/notes-9.21.8.rst
+++ b/doc/notes/notes-9.21.8.rst
@@ -36,6 +36,22 @@ New Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
+- Return DNS COOKIE and NSID with BADVERS.
+
+  This change allows the client to identify a server that returns a
+  BADVERS response and to provide a DNS SERVER COOKIE to be included in
+  the resent request. :gl:`#5235`
+
+- Disable separate memory context for libxml2 memory allocations on
+  macOS.
+
+  As of macOS Sequoia 15.4, custom memory allocation functions are no
+  longer supported by the system-wide version of libxml2. This prevents
+  tracking libxml2 memory allocations in a separate :iscman:`named`
+  memory context, so the latter has been disabled on macOS; the system
+  allocator is now directly used for libxml2 memory allocations on that
+  operating system. :gl:`#5268`
+
 - Use Jinja2 templates in system tests.
 
   `python-jinja2` is now required to run system tests. :gl:`#4938`
@@ -43,6 +59,11 @@ Feature Changes
 Bug Fixes
 ~~~~~~~~~
 
+- Return the correct NSEC3 records for NXDOMAIN responses.
+
+  The wrong NSEC3 records were sometimes returned as proof that the
+  QNAME did not exist. This has been fixed. :gl:`#5292`
+
 - Fix EDNS YAML output in :iscman:`dig`.
 
   :iscman:`dig` was producing invalid YAML when displaying some EDNS
@@ -67,22 +88,6 @@ Bug Fixes
 
   :gl:`#5014`
 
-- Return DNS COOKIE and NSID with BADVERS.
-
-  This change allows the client to identify a server that returns a
-  BADVERS response and to provide a DNS SERVER COOKIE to be included in
-  the resent request. :gl:`#5235`
-
-- Disable separate memory context for libxml2 memory allocations on
-  macOS.
-
-  As of macOS Sequoia 15.4, custom memory allocation functions are no
-  longer supported by the system-wide version of libxml2. This prevents
-  tracking libxml2 memory allocations in a separate :iscman:`named`
-  memory context, so the latter has been disabled on macOS; the system
-  allocator is now directly used for libxml2 memory allocations on that
-  operating system. :gl:`#5268`
-
 - Fix RDATA checks for PRIVATEOID keys.
 
   In PRIVATEOID keys, the key data begins with a length byte followed by
@@ -98,8 +103,3 @@ Bug Fixes
   responses were not returned immediately for names in domains delegated
   from authoritative zones configured on the resolver. This has been
   fixed. :gl:`#5275`
-
-- Return the correct NSEC3 records for NXDOMAIN responses.
-
-  The wrong NSEC3 records were sometimes returned as proof that the
-  QNAME did not exist. This has been fixed. :gl:`#5292`