Merge tag '0.8.21' into integrate/0.8.21

diff --cc NEWS
index 1709fbc38ae79d22c6cc4b39b8745b7881402659,34bb76a332ae25173ed2ddf8a196ced1c1637bfe..b55b1b4ddcdc3c1afe7dc991c5a8989e27f9c9a7
--- 1/NEWS
--- 2/NEWS
+++ b/NEWS
@@@ -1,64 -1,12 +1,73 @@@
- v0.8.21-head 2016-xx-xx  The Irssi team <staff@irssi.org>
++v0.8.22-head 2017-xx-xx  The Irssi team <staff@irssi.org>
 +      * Removed --disable-ipv6
 +      * /connect Network now aborts with an error if no servers have been
 +        added to that network.
 +      * /dcc commands now use quotes around spaces consistently.
 +      + irssiproxy can now forward all tags through a single port.
 +      + irssiproxy can also listen on unix sockets.
 +      + send channel -botcmds immediately when no mask is specified (#175).
 +      + the kill buffer now remembers consecutive kills.
 +        New bindings were added: yank_next_cutbuffer and append_next_kill
 +      + connections will avoid looking up IPv6 addresses if the machine does
 +        not have an IPv6 address assigned (exact behaviour is implementation
 +        defined).
 +      + Fix potential crash if scripts insert undef values into the completion
 +        list.
 +      + Paste warning is now also shown on pasting overlong lines.
 +      + autolog_ignore_targets and activity_hide_targets learn a new syntax
 +            tag/* and * to ignore whole networks or everything.
 +      + /hilight got a -matchcase flag to hilight case sensitively (#421).
 +      + Always build irssi with TLS support.
 +      + Rename SSL to TLS in the code and add -tls_* versions of the -ssl_*
 +        options to /CONNECT and /SERVER, but make sure the -ssl_* options continue
 +        to work.
 +      + Use TLS for Freenode, EFnet, EsperNet, OFTC, Rizon, and IRC6 in the default
 +        configuration.
 +      + Display TLS connection information upon connect. You can disable this by
 +        setting tls_verbose_connect to FALSE.
 +      + Add -tls_pinned_cert and -tls_pinned_pubkey for x509 and public key pinning.
 +
 +        The values needed for -tls_pinned_cert and -tls_pinned_pubkey is shown
 +        when connecting to a TLS enabled IRC server, but you can also find the
 +        values like this: Start by downloading the certificate from a given IRC
 +        server:
 +
 +            $ openssl s_client -connect chat.freenode.net:6697 < /dev/null 2>/dev/null | \
 +              openssl x509 > freenode.cert
 +
 +        Find the value for -tls_pinned_cert:
 +
 +            $ openssl x509 -in freenode.cert -fingerprint -sha256 -noout
 +
 +        Find the value for -tls_pinned_pubkey:
 +
 +            $ openssl x509 -in freenode.cert -pubkey -noout | \
 +              openssl pkey -pubin -outform der | \
 +              openssl dgst -sha256 -c | \
 +              tr a-z A-Z
 +
 +      + Remove support for DANE validation of TLS certificates.
 +
 +        There wasn't enough support in the IRC community to push for this on the
 +        majority of bigger IRC networks. If you believe this should be
 +        reintroduced into irssi, then please come up with an implementation that
 +        does not rely on the libval library. It is causing a lot of troubles for
 +        our downstream maintainers.
 +
 +      - IP addresses are no longer stored when resolve_reverse_lookup is
 +        used.
 +      - /names and $[...] now uses utf8 string operations (#40, #411).
 +      - Removed broken support for curses.
 +
+ v0.8.21 2017-01-03  The Irssi team <staff@irssi.org>
+       - Correct a NULL pointer dereference in the nickcmp function found by
+         Joseph Bisch (GL#1)
+       - Correct an out of bounds read in certain incomplete control codes
+         found by Joseph Bisch (GL#2)
+       - Correct an out of bounds read in certain incomplete character
+         sequences found by Hanno Böck and independently by J. Bisch (GL#3)
+       - Correct an error when receiving invalid nick message (GL#4, #466)
+ 
  v0.8.20 2016-09-16  The Irssi team <staff@irssi.org>
        - Correct the name of an emitted sasl signal (#484)
        - Correct the prototype for the 'message private' signal (#515)

diff --cc configure.ac
index 53d6567179ac5db4d6c1cd944d76b5e8c58dab90,59f5ce5784b2f1a55e5f4cb7cdded712bb77245d..c0f8e842ba6a6ee49f908f119118cbf3b4fe61a0
--- 1/configure.ac
--- 2/configure.ac
+++ b/configure.ac
@@@ -1,4 -1,4 +1,4 @@@
- AC_INIT(irssi, 0.8.21-head)
 -AC_INIT(irssi, 0.8.21)
++AC_INIT(irssi, 0.8.22-head)
  AC_CONFIG_SRCDIR([src])
  AC_CONFIG_AUX_DIR(build-aux)
  AC_PREREQ(2.50)