diff --git a/git.spec b/git.spec
index 6988bb2..ddd935b 100644
--- a/git.spec
+++ b/git.spec
@@ -80,7 +80,7 @@
 %global _package_note_file  %{_builddir}/%{name}-%{version}%{?rcrev}/.package_note-%{name}-%{version}-%{release}.%{_arch}.ld
 
 Name:           git
-Version:        2.39.0
+Version:        2.39.1
 Release:        1%{?rcrev}%{?dist}
 Summary:        Fast Version Control System
 License:        BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT
@@ -1032,6 +1032,9 @@ rmdir --ignore-fail-on-non-empty "$testdir"
 %{?with_docs:%{_pkgdocdir}/git-svn.html}
 
 %changelog
+* Tue Jan 17 2023 Todd Zullinger <tmz@pobox.com> - 2.39.1-1
+- update to 2.39.1 (CVE-2022-41903, CVE-2022-23521)
+
 * Mon Dec 12 2022 Todd Zullinger <tmz@pobox.com> - 2.39.0-1
 - update to 2.39.0
 
diff --git a/sources b/sources
index 01d2443..7924f69 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (git-2.39.0.tar.xz) = f072cae7738279b1c0f8202e83a243ff0164b03d3be22895aa875caa265150a5773e1f062724b3eb82bc64b163730b6f451b82fa0c904167a8fa53ced5d3b1df
-SHA512 (git-2.39.0.tar.sign) = 61f8b98c86ecada0784aa9d86bb7c88ed3fb836dee8ee91c16bdf6fba56226c6db424debd2b0f1485b67bdbb5261626b8ff9f362e32d7b93449461f0f873559a
+SHA512 (git-2.39.1.tar.xz) = b1821a814947f01adf98206a7e9a01da9daa617b1192e8ef6968b05af8d874f028fb26b5f828a9c48f734ef2c276f4d23bdc898ba46fb7aaa96dbe68081037e9
+SHA512 (git-2.39.1.tar.sign) = b6295e186263654b686fd0f0814a68dfbd04635ff4d613a09fa9d13897b584d06611903bc0205ecee6f01932c4065d20671bd91f8e6239a5f9c6a2fc6c38b87d