diff --git a/git.rpmlintrc b/git.rpmlintrc
index 9fd93ce..b83cb0a 100644
--- a/git.rpmlintrc
+++ b/git.rpmlintrc
@@ -1,5 +1,3 @@
-from Config import *
-
 # the dictionary is a bit limited
 addFilter("git.* spelling-error %description .* subpackages")
 addFilter("git-subtree.* spelling-error %description .* (subdirectory|subproject|subtree)")
@@ -23,5 +21,19 @@ addFilter("git-core\..*: W: no-manual-page-for-binary")
 # similarly ignore the warning when git-cvs and git-p4 are disabled
 addFilter("git.* obsolete-not-provided git-(cvs|gnome-keyring|p4)")
 
-# we BR emacs which requires emacs-common and provides %{_emacs_version}
-addFilter("git.(spec|src): .* Possible unexpanded macro in: Requires:.*emacs-filesystem >= %{_emacs_version}")
+# git-svn has both man and html docs and only a single command
+addFilter('git-svn\..*: W: package-with-huge-docs')
+
+# ignore potential "bashisms" in docs
+addFilter('git-core-doc\.noarch: W: potential-bashisms /usr/share/doc/git/')
+
+# ignore unused-direct-shlib-dependency for libpcre; while it probably could be
+# removed from some binaries, the cost of doing so isn't worth the gain.
+addFilter('git-(core|daemon)\..*: W: unused-direct-shlib-dependency .* /lib64/libpcre2-.*')
+
+# ignore duplicate gvimdiff/nvimdiff files; they are only 29 bytes, sourcing the same base
+# vimdiff mergetool
+addFilter('git-core\..*: W: files-duplicate /usr/libexec/git-core/mergetools/[gn]vimdiff')
+
+# ignore non-standard-dir-in-var for gitweb (#479613)
+addFilter('gitweb.noarch: W: non-standard-dir-in-var www')
diff --git a/git.spec b/git.spec
index 2d1fab2..4ab882b 100644
--- a/git.spec
+++ b/git.spec
@@ -76,7 +76,7 @@
 %global _package_note_file  %{_builddir}/%{name}-%{version}%{?rcrev}/.package_note-%{name}-%{version}-%{release}.%{_arch}.ld
 
 Name:           git
-Version:        2.37.3
+Version:        2.38.1
 Release:        1%{?rcrev}%{?dist}
 Summary:        Fast Version Control System
 License:        GPLv2
@@ -478,6 +478,7 @@ Requires:       perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $versi
 
 %package subtree
 Summary:        Git tools to merge and split repositories
+BuildArch:      noarch
 Requires:       git-core = %{version}-%{release}
 %description subtree
 Git subtrees allow subprojects to be included within a subdirectory
@@ -800,7 +801,7 @@ GIT_SKIP_TESTS=""
 # to limit the maximum stack size.
 # t5541.36 'push 2000 tags over http'
 # t5551.25 'clone the 2,000 tag repo to check OS command line overflow'
-GIT_SKIP_TESTS="$GIT_SKIP_TESTS t5541.36 t5551.25"
+GIT_SKIP_TESTS="$GIT_SKIP_TESTS t5541.37 t5551.25"
 %endif
 # endif aarch64 %%{arm} %%{power64}
 
@@ -1005,6 +1006,22 @@ rmdir --ignore-fail-on-non-empty "$testdir"
 %{?with_docs:%{_pkgdocdir}/git-svn.html}
 
 %changelog
+* Tue Oct 18 2022 Todd Zullinger <tmz@pobox.com> - 2.38.1-1
+- update to 2.38.1 (CVE-2022-39253, CVE-2022-39260)
+
+* Mon Oct 03 2022 Todd Zullinger <tmz@pobox.com> - 2.38.0-1
+- update to 2.38.0
+
+* Wed Sep 28 2022 Todd Zullinger <tmz@pobox.com> - 2.38.0-0.2.rc2
+- update to 2.38.0-rc2
+
+* Wed Sep 21 2022 Todd Zullinger <tmz@pobox.com> - 2.38.0-0.1.rc1
+- update to 2.38.0-rc1
+- git-subtree sub-package is noarch
+
+* Fri Sep 16 2022 Todd Zullinger <tmz@pobox.com> - 2.38.0-0.0.rc0
+- update to 2.38.0-rc0
+
 * Tue Aug 30 2022 Todd Zullinger <tmz@pobox.com> - 2.37.3-1
 - update to 2.37.3
 - remove %%changelog entries prior to 2020
diff --git a/sources b/sources
index 4f304df..3f9c27f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (git-2.37.3.tar.xz) = 9120050b01d8ac8d9f9e85f19cb84dc90c28f3beadc3ea94da94845f2eb5e35aa83eee8447a7ecef5190b8eb5d01be621be2e82bb3020e51e05037cd1fa9b58f
-SHA512 (git-2.37.3.tar.sign) = ca2b0396c7d5f47822578f654588580b101ce97e0a4913071b6987cdbb470e3fad456b967cf6ec5928c85d56aa8a8eeff123e0e9aaa4ce1cbfc79c30a2af3b03
+SHA512 (git-2.38.1.tar.xz) = e62ca6f54f01d2e4ccffb5f94e8e5cd2f3e098b766d909c694a8daf4d00d5cdeb9cc5ff8e9bc55d888406f292ba99433d334d4da9689c0ce5d7299a3c67c90e0
+SHA512 (git-2.38.1.tar.sign) = a10fa332d5d5ea96bf6a0ed0c2a568212dd033acd539d07efbb73def13dd0144640a5a17477ea5cfe4104f1fa166237d7b251de275307eac7b91c6e60ca3de5d