diff --git a/.gitignore b/.gitignore
index f811ba3..7bc1eff 100644
--- a/.gitignore
+++ b/.gitignore
@@ -106,3 +106,5 @@ pigeonhole-snap0592366457df.tar.bz2
 /dovecot-2.2.26.0.tar.gz
 /dovecot-2.2-pigeonhole-0.4.16.tar.gz
 /dovecot-2.2.27.tar.gz
+/dovecot-2.2.28.tar.gz
+/dovecot-2.2-pigeonhole-0.4.17.tar.gz
diff --git a/dovecot-2.2.22-systemd_w_protectsystem.patch b/dovecot-2.2.22-systemd_w_protectsystem.patch
index 10fe4b8..6fcddac 100644
--- a/dovecot-2.2.22-systemd_w_protectsystem.patch
+++ b/dovecot-2.2.22-systemd_w_protectsystem.patch
@@ -1,7 +1,8 @@
-diff -up dovecot-2.2.22/dovecot.service.in.systemd_w_protectsystem dovecot-2.2.22/dovecot.service.in
---- dovecot-2.2.22/dovecot.service.in.systemd_w_protectsystem	2016-03-16 13:49:46.678894652 +0100
-+++ dovecot-2.2.22/dovecot.service.in	2016-03-16 13:49:46.690894592 +0100
-@@ -33,7 +33,7 @@ ExecStop=@bindir@/doveadm stop
+diff -up dovecot-2.2.28/dovecot.service.in.systemd_w_protectsystem dovecot-2.2.28/dovecot.service.in
+--- dovecot-2.2.28/dovecot.service.in.systemd_w_protectsystem	2017-02-27 10:00:14.647423500 +0100
++++ dovecot-2.2.28/dovecot.service.in	2017-02-27 10:02:18.051377067 +0100
+@@ -20,8 +20,8 @@ ExecReload=@bindir@/doveadm reload
+ ExecStop=@bindir@/doveadm stop
  PrivateTmp=true
  NonBlocking=yes
 -# Enable this if your systemd is new enough to support it:
@@ -9,5 +10,5 @@ diff -up dovecot-2.2.22/dovecot.service.in.systemd_w_protectsystem dovecot-2.2.2
 +# Enable this if your systemd is new enough to support it: (it will make /usr /boot /etc read only for dovecot)
 +ProtectSystem=full
  
- [Install]
- WantedBy=multi-user.target
+ # You can add environment variables with e.g.:
+ #Environment='CORE_OUTOFMEM=1'
diff --git a/dovecot-2.2.27-endian.patch b/dovecot-2.2.27-endian.patch
deleted file mode 100644
index 75c1e37..0000000
--- a/dovecot-2.2.27-endian.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up dovecot-2.2.27/src/lib/sha3.c.than dovecot-2.2.27/src/lib/sha3.c
---- dovecot-2.2.27/src/lib/sha3.c.than	2016-12-13 07:46:26.173797063 -0500
-+++ dovecot-2.2.27/src/lib/sha3.c	2016-12-13 07:45:47.693129174 -0500
-@@ -232,7 +232,7 @@ sha3_finalize(struct sha3_ctx *ctx)
- 			SHA3_CONST(0x8000000000000000UL);
- 	keccakf(ctx->s);
- 
--#ifndef WORDS_BIGENDIAN
-+#ifdef WORDS_BIGENDIAN
- 	{
- 		unsigned i;
- 		for(i = 0; i < SHA3_KECCAK_SPONGE_WORDS; i++) {
diff --git a/dovecot.spec b/dovecot.spec
index a4076ad..f4a5e43 100644
--- a/dovecot.spec
+++ b/dovecot.spec
@@ -3,9 +3,9 @@
 Summary: Secure imap and pop3 server
 Name: dovecot
 Epoch: 1
-Version: 2.2.27
+Version: 2.2.28
 %global prever %{nil}
-Release: 3%{?dist}
+Release: 1%{?dist}
 #dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2
 License: MIT and LGPLv2
 Group: System Environment/Daemons
@@ -14,7 +14,7 @@ URL: http://www.dovecot.org/
 Source: http://www.dovecot.org/releases/2.2/%{name}-%{version}%{?prever}.tar.gz
 Source1: dovecot.init
 Source2: dovecot.pam
-%global pigeonholever 0.4.16
+%global pigeonholever 0.4.17
 Source8: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-%{pigeonholever}.tar.gz
 Source9: dovecot.sysconfig
 Source10: dovecot.tmpfilesd
@@ -33,7 +33,6 @@ Patch7: dovecot-2.2.13-online.patch
 
 Patch8: dovecot-2.2.20-initbysystemd.patch
 Patch9: dovecot-2.2.22-systemd_w_protectsystem.patch
-Patch10: dovecot-2.2.27-endian.patch
 
 Source15: prestartscript
 
@@ -130,7 +129,6 @@ This package provides the development files for dovecot.
 %patch7 -p1 -b .online
 %patch8 -p1 -b .initbysystemd
 %patch9 -p1 -b .systemd_w_protectsystem
-%patch10 -p1 -b .endian
 
 #pushd dovecot-2*2-pigeonhole-%{pigeonholever}
 #popd
@@ -487,6 +485,25 @@ make check
 %{_libdir}/%{name}/dict/libdriver_pgsql.so
 
 %changelog
+* Mon Feb 27 2017 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.28-1
+- dovecot updated to 2.2.28, pigeonhole to 0.4.17
+- auth: Support OAUTHBEARER and XOAUTH2 mechanisms. Also support them
+  in lib-dsasl for client side.
+- imap: SEARCH/SORT may have assert-crashed in
+  client_check_command_hangs
+- imap: FETCH X-MAILBOX may have assert-crashed in virtual mailboxes.
+- search: Using NOT n:* or NOT UID n:* wasn't handled correctly
+- fts: fts_autoindex_exclude = \Special-use caused crashes
+- doveadm-server: Fix leaks and other problems when process is reused
+  for multiple requests (service_count != 1)
+- sdbox: Fix assert-crash on mailbox create race
+- lda/lmtp: deliver_log_format values weren't entirely correct if Sieve
+  was used. especially %{storage_id} was broken.
+- imapsieve plugin: Fixed assert failure occurring when used with virtual
+  mailboxes.
+- doveadm sieve plugin: Fixed crash when setting Sieve script via attribute's
+  string value.
+
 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:2.2.27-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 
diff --git a/sources b/sources
index dbc705a..7d055e1 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-20133518f5bc0e64dd07ce55b83df2fb  dovecot-2.2.27.tar.gz
-e03eed707b39cffc4b2a82867de45d9c  dovecot-2.2-pigeonhole-0.4.16.tar.gz
+SHA512 (dovecot-2.2.28.tar.gz) = 3f40eb52413130dd47da98470d797ede63db3296923c2888b48f1a021e473cfcad064671ad804037d101990457ee57def30f2c27010ede2d758f3d3cfd8ef741
+SHA512 (dovecot-2.2-pigeonhole-0.4.17.tar.gz) = 3ea6faebf04154649c32612f204e909aa131582c99867865bff3d3a78a75593d96109586eeb6403bc915046b8b6f02e8bacbf6cb6733ea186d2e1a209a7e2b79