diff --git a/git.spec b/git.spec
index f01dd45..4ab882b 100644
--- a/git.spec
+++ b/git.spec
@@ -76,7 +76,7 @@
 %global _package_note_file  %{_builddir}/%{name}-%{version}%{?rcrev}/.package_note-%{name}-%{version}-%{release}.%{_arch}.ld
 
 Name:           git
-Version:        2.38.0
+Version:        2.38.1
 Release:        1%{?rcrev}%{?dist}
 Summary:        Fast Version Control System
 License:        GPLv2
@@ -1006,6 +1006,9 @@ rmdir --ignore-fail-on-non-empty "$testdir"
 %{?with_docs:%{_pkgdocdir}/git-svn.html}
 
 %changelog
+* Tue Oct 18 2022 Todd Zullinger <tmz@pobox.com> - 2.38.1-1
+- update to 2.38.1 (CVE-2022-39253, CVE-2022-39260)
+
 * Mon Oct 03 2022 Todd Zullinger <tmz@pobox.com> - 2.38.0-1
 - update to 2.38.0
 
diff --git a/sources b/sources
index 126f70f..3f9c27f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (git-2.38.0.tar.xz) = 5c475d25b40a01cc62be28478b9b5a1b0cedf91c3e007d4869019a25bdc980b5ef9b761e7ee02d7c581bff6c7dbf2696a624431a718dcd976bad34a3f2be5cb6
-SHA512 (git-2.38.0.tar.sign) = e3fb09d2e520074888d0b63a241427a596bf63648734325316f18343955a83086a4f6be622eb65e965478630ece905a6ae15989358012f84ebf6424abe6419e9
+SHA512 (git-2.38.1.tar.xz) = e62ca6f54f01d2e4ccffb5f94e8e5cd2f3e098b766d909c694a8daf4d00d5cdeb9cc5ff8e9bc55d888406f292ba99433d334d4da9689c0ce5d7299a3c67c90e0
+SHA512 (git-2.38.1.tar.sign) = a10fa332d5d5ea96bf6a0ed0c2a568212dd033acd539d07efbb73def13dd0144640a5a17477ea5cfe4104f1fa166237d7b251de275307eac7b91c6e60ca3de5d