diff --git a/.gitignore b/.gitignore
index 7a32ee7..67de33d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,3 +51,4 @@
 /requests-v2.27.1.tar.gz
 /requests-v2.28.1.tar.gz
 /requests-v2.28.2.tar.gz
+/requests-v2.31.0.tar.gz
diff --git a/CVE-2023-32681.patch b/CVE-2023-32681.patch
deleted file mode 100644
index 2b4cd79..0000000
--- a/CVE-2023-32681.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 Mon Sep 17 00:00:00 2001
-From: Nate Prewitt <nate.prewitt@gmail.com>
-Date: Mon, 22 May 2023 08:08:57 -0700
-Subject: [PATCH] Merge pull request from GHSA-j8r2-6x86-q33q
-
----
- requests/sessions.py   |  4 +++-
- tests/test_requests.py | 20 ++++++++++++++++++++
- 2 files changed, 23 insertions(+), 1 deletion(-)
-
-diff --git a/requests/sessions.py b/requests/sessions.py
-index 6cb3b4dae3..dbcf2a7b0e 100644
---- a/requests/sessions.py
-+++ b/requests/sessions.py
-@@ -324,7 +324,9 @@ def rebuild_proxies(self, prepared_request, proxies):
-         except KeyError:
-             username, password = None, None
- 
--        if username and password:
-+        # urllib3 handles proxy authorization for us in the standard adapter.
-+        # Avoid appending this to TLS tunneled requests where it may be leaked.
-+        if not scheme.startswith('https') and username and password:
-             headers["Proxy-Authorization"] = _basic_auth_str(username, password)
- 
-         return new_proxies
-diff --git a/tests/test_requests.py b/tests/test_requests.py
-index b1c8dd4534..b420c44d73 100644
---- a/tests/test_requests.py
-+++ b/tests/test_requests.py
-@@ -647,6 +647,26 @@ def test_proxy_authorization_preserved_on_request(self, httpbin):
- 
-         assert sent_headers.get("Proxy-Authorization") == proxy_auth_value
- 
-+
-+    @pytest.mark.parametrize(
-+        "url,has_proxy_auth",
-+        (
-+            ('http://example.com', True),
-+            ('https://example.com', False),
-+        ),
-+    )
-+    def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth):
-+        session = requests.Session()
-+        proxies = {
-+            'http': 'http://test:pass@localhost:8080',
-+            'https': 'http://test:pass@localhost:8090',
-+        }
-+        req = requests.Request('GET', url)
-+        prep = req.prepare()
-+        session.rebuild_proxies(prep, proxies)
-+
-+        assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth
-+
-     def test_basicauth_with_netrc(self, httpbin):
-         auth = ("user", "pass")
-         wrong_auth = ("wronguser", "wrongpass")
diff --git a/python-requests.spec b/python-requests.spec
index 56e98ed..94f1c59 100644
--- a/python-requests.spec
+++ b/python-requests.spec
@@ -5,8 +5,8 @@
 %bcond extras   %{undefined rhel}
 
 Name:           python-requests
-Version:        2.28.2
-Release:        7%{?dist}
+Version:        2.31.0
+Release:        1%{?dist}
 Summary:        HTTP library, written in Python, for human beings
 
 License:        Apache-2.0
@@ -17,9 +17,6 @@ Source:         https://github.com/requests/requests/archive/v%{version}/request
 # https://bugzilla.redhat.com/show_bug.cgi?id=904614
 Patch:          system-certs.patch
 
-# Security fix for CVE-2023-32681
-Patch:          https://github.com/psf/requests/commit/74ea7cf7a6.patch#/CVE-2023-32681.patch
-
 BuildArch:      noarch
 BuildRequires:  python%{python3_pkgversion}-devel
 %if %{with tests}
@@ -80,7 +77,7 @@ sed -i 's/ --doctest-modules//' pyproject.toml
 %pyproject_check_import
 %if %{with tests}
 # test_use_proxy_from_environment needs pysocks
-%pytest -v %{!?with_extras:-k "not test_use_proxy_from_environment"}
+%pytest -v tests %{!?with_extras:-k "not test_use_proxy_from_environment"}
 %endif
 
 
@@ -90,6 +87,10 @@ sed -i 's/ --doctest-modules//' pyproject.toml
 
 
 %changelog
+* Mon Oct 16 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 2.31.0-1
+- Update to 2.31.0
+- Fixes: rhbz#2189970
+
 * Tue Oct 10 2023 Miro Hrončok <mhroncok@redhat.com> - 2.28.2-7
 - Do not package requests[security] and requests[socks] on RHEL
 - Make the package build even when urllib3 won't pull in pysocks
diff --git a/sources b/sources
index 9f2da1e..3e4fef8 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (requests-v2.28.2.tar.gz) = 88c5a92ea51cd18e7edd49a6259d7b56bc0c17f86067f796b5f668ed35202b8bc1395e4811ee2089350e08893dcd304c9801dbf087abfaff1d14859e31bce8ac
+SHA512 (requests-v2.31.0.tar.gz) = 43f536bdb2360fcceb24ef98e995ffa66cdefc2c502629f17a5722445bfa9ad8489201958c846c2aaef37e427f95a4d56e321a91095c69754680abfd83b39150
diff --git a/system-certs.patch b/system-certs.patch
index 1778958..0e323f8 100644
--- a/system-certs.patch
+++ b/system-certs.patch
@@ -1,8 +1,9 @@
-From f21606c102368ad7a6e8bcab5a0c65dcddbbf9e5 Mon Sep 17 00:00:00 2001
-From: Lumir Balhar <lbalhar@redhat.com>
-Date: Thu, 19 Jan 2023 17:35:02 +0100
+From fbe9d1e38da72d8caac365841794b06614523ac9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
+Date: Tue, 17 Oct 2023 10:44:42 +0200
 Subject: [PATCH] system certs
 
+Co-authored-by: Lumir Balhar <lbalhar@redhat.com>
 ---
  requests/certs.py | 7 ++++++-
  setup.cfg         | 1 -
@@ -41,17 +42,17 @@ index bf21c81..906c0f1 100644
      idna>=2.5,<4
      urllib3>=1.21.1,<1.27
 diff --git a/setup.py b/setup.py
-index 092b40d..c6c0ad5 100755
+index 0123545..ec3fd1d 100755
 --- a/setup.py
 +++ b/setup.py
 @@ -62,7 +62,6 @@ requires = [
      "charset_normalizer>=2,<4",
      "idna>=2.5,<4",
-     "urllib3>=1.21.1,<1.27",
+     "urllib3>=1.21.1,<3",
 -    "certifi>=2017.4.17",
  ]
  test_requirements = [
-     "pytest-httpbin==0.0.7",
+     "pytest-httpbin==2.0.0",
 -- 
-2.39.0
+2.41.0