diff --git a/.gitignore b/.gitignore
index c57723a..a9ec5b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 /websockets-11.0.3.tar.gz
+/websockets-14.2.tar.gz
diff --git a/python-websockets.spec b/python-websockets.spec
index d820921..a71121d 100644
--- a/python-websockets.spec
+++ b/python-websockets.spec
@@ -1,23 +1,19 @@
 %global pypi_name websockets
 
-%ifarch x86_64
-%bcond_without tests
-%endif
-
 Name:           python-%{pypi_name}
-Version:        11.0.3
-Release:        6%{?dist}
+Version:        14.2
+Release:        1%{?dist}
 Summary:        Implementation of the WebSocket Protocol for Python
 
-License:        BSD
+License:        BSD-3-Clause
 URL:            https://github.com/aaugustin/websockets
 Source0:        %{url}/archive/%{version}/%{pypi_name}-%{version}.tar.gz
 
+# remove shell=True from experiments/compression/corpus.py
+Patch0:         remove-shell-true.patch
+
 BuildRequires:  gcc
 
-%if %{with tests}
-BuildRequires:  python3dist(pytest)
-%endif
 
 %global _description %{expand:
 websockets is a library for developing WebSocket servers and clients in
@@ -39,26 +35,6 @@ BuildRequires:  python3-devel
 %prep
 %autosetup -n %{pypi_name}-%{version} -p1
 
-# Upstream uses a src package but does not specify this explicitly in the
-# pyproject.toml. This causes the build to fail on CentOS Stream 9 and RHEL 9.
-# Workaround this problem by adding a very small setup.cfg file that specifies where
-# the source code lives inside `src`.
-%if %{defined el9}
-cat << EOF > setup.cfg
-[metadata]
-name = websockets
-
-[options]
-package_dir=
-    =src
-packages=find:
-
-[options.packages.find]
-where=src
-EOF
-%endif
-
-
 %generate_buildrequires
 %pyproject_buildrequires
 
@@ -72,17 +48,15 @@ EOF
 %check
 %pyproject_check_import
 
-%if %{with tests}
-# Skip some tests that require network connectivity and/or a running daemon.
-# Investigate: test_server_shuts_down_* tests hang or fail on Python 3.12
-%pytest -v --ignore compliance --ignore tests/sync -k "not test_explicit_host_port and not test_server_shuts_down"
-%endif
-
 
 %files -n python3-%{pypi_name} -f %{pyproject_files}
 %doc README.rst
 
 %changelog
+* Tue Sep 09 2025 Kseniia Nivnia <knivnia@redhat.com> - 14.2-1
+- Update to 14.2 and add patch to remove shell=True
+  Resolves: RHEL-113034
+
 * Tue Jan 30 2024 Major Hayden <mhayden@redhat.com> - 11.0.3-6
 - Bump revision to add gating.yaml
 
diff --git a/remove-shell-true.patch b/remove-shell-true.patch
new file mode 100644
index 0000000..b84c667
--- /dev/null
+++ b/remove-shell-true.patch
@@ -0,0 +1,37 @@
+diff --git a/experiments/compression/corpus.py b/experiments/compression/corpus.py
+index 56e2621..c8bd343 100644
+--- a/experiments/compression/corpus.py
++++ b/experiments/compression/corpus.py
+@@ -10,16 +10,17 @@ import time
+ 
+ def github_commits():
+     OAUTH_TOKEN = getpass.getpass("OAuth Token? ")
+-    COMMIT_API = (
+-        f'curl -H "Authorization: token {OAUTH_TOKEN}" '
+-        f"https://api.github.com/repos/python-websockets/websockets/git/commits/:sha"
+-    )
++
++    def fetch_commit(sha):
++        url = f"https://api.github.com/repos/python-websockets/websockets/git/commits/{sha}"
++        headers = ["-H", f"Authorization: token {OAUTH_TOKEN}"]
++        cmd = ["curl"] + headers + [url]
++        return subprocess.check_output(cmd)
+ 
+     commits = []
+ 
+     head = subprocess.check_output(
+-        "git rev-parse origin/main",
+-        shell=True,
++        ["git", "rev-parse", "origin/main"],
+         text=True,
+     ).strip()
+     todo = [head]
+@@ -27,7 +28,7 @@ def github_commits():
+ 
+     while todo:
+         sha = todo.pop(0)
+-        commit = subprocess.check_output(COMMIT_API.replace(":sha", sha), shell=True)
++        commit = fetch_commit(sha)
+         commits.append(commit)
+         seen.add(sha)
+         for parent in json.loads(commit)["parents"]:
diff --git a/sources b/sources
index 2851491..d1a0471 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (websockets-11.0.3.tar.gz) = 37a84d7c57da7a3e48870abf992ba96ee454b342610d51c06f7dfc7ee082b7fb51304518c208379c3dbd039eafb1a85444c257fed20b4605a52dc8fc938a4cca
+SHA512 (websockets-14.2.tar.gz) = b5b5ce455e5b68a14993ac1d02c6f417db6cc89cdb9b21e12ba1e1975050fdf7e1935e08a35d8fcb41f5e255385c72834627c989f0734d7015bc1817f6067fe9