diff --git a/dnspython-2.6.1.tar.gz b/dnspython-2.6.1.tar.gz
deleted file mode 100644
index 0f8199e..0000000
--- a/dnspython-2.6.1.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:e8f0f9c23a7b7cb99ded64e6c3a6f3e701d78f50c55e002b839dea7225cff7cc
-size 332727
diff --git a/dnspython-2.7.0.tar.gz b/dnspython-2.7.0.tar.gz
new file mode 100644
index 0000000..d674705
--- /dev/null
+++ b/dnspython-2.7.0.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ce9c432eda0dc91cf618a5cedf1a4e142651196bbcd2c80e89ed5a907e5cfaf1
+size 345197
diff --git a/python-dnspython.changes b/python-dnspython.changes
index 8159e5a..bbf8a16 100644
--- a/python-dnspython.changes
+++ b/python-dnspython.changes
@@ -1,3 +1,47 @@
+-------------------------------------------------------------------
+Tue Oct  8 20:19:23 UTC 2024 - Martin Hauke <mardnh@gmx.de>
+
+- Skip some tests
+  * that require a working resolver and external DNS resolution
+  * that require an openssl3 version with support for
+    ECDSA with deterministic signature (RFC 6979)"
+
+-------------------------------------------------------------------
+Sun Oct  6 07:03:50 UTC 2024 - Martin Hauke <mardnh@gmx.de>
+
+- Update to version 2.7.0
+  * dns.query.https() and dns.asyncquery.https() now support
+    HTTP/3 and the http_version parameter may be used to specify
+    which version to use.
+  * If the cryptography module is installed, then dnspython will
+    now create deterministic ECDSA signatures by default.
+  * The RESINFO and WALLET RdataTypes are now supported.
+  * The COOKIE and Report-Channel EDNS0 options are now supported.
+  * All supported RdataTypes can now be imported at a single time
+    rather than lazily on first use by calling
+    dns.rdata.load_all_types().
+  * The SVCB and HTTPS records now support the ohttp parameter.
+  * xfr() and inbound_xfr() now share a common implementation.
+  * Tokens are now supported for QUIC and HTTP/3.
+  * dns.message.from_wire() now saves the input wire format in the
+    Message’s “wire” attribute. Likewise,
+    dns.message.Message.to_wire() now records the generated wire
+    format in that attribute.
+  * The dns.message.Message object now has a get_options() helper
+    to retrieve EDNS0 options of a specified type, and an
+    extended_errors() helper to retrieve the list of EDE options
+    in a message (if any).
+  * dns.message.make_response() now has a copy mode which controls
+    how sections are copied. By default, a copy mode appropriate
+    for the opcode is used.
+    This is currently dns.message.CopyMode.QUESTION for all opcodes
+  * If an IP address is used as the hostname in a URL, the https
+    query code now passes the sni_hostname to httpx as this is
+    required to get httpx to validate the certificate and check for
+    an IP subject alternative name.
+  * The minimum supported aioquic version is now 1.0.0.
+  * The minimum supported Python version is now 3.9.
+
 -------------------------------------------------------------------
 Thu Jun 20 12:26:09 UTC 2024 - Martin Hauke <mardnh@gmx.de>
 
diff --git a/python-dnspython.spec b/python-dnspython.spec
index 0b0021e..d37f272 100644
--- a/python-dnspython.spec
+++ b/python-dnspython.spec
@@ -27,7 +27,7 @@
 %define skip_python2 1
 %{?sle15_python_module_pythons}
 Name:           python-dnspython%{psuffix}
-Version:        2.6.1
+Version:        2.7.0
 Release:        0
 Summary:        A DNS toolkit for Python
 License:        ISC
@@ -41,12 +41,14 @@ BuildRequires:  %{python_module poetry-core}
 BuildRequires:  fdupes
 BuildRequires:  python-rpm-macros
 # dnssec
-Requires:       python-cryptography
+Requires:       python-cryptography >= 43.0
 Requires:       python-httpx
 # idna
 Requires:       python-idna >= 2.1
 # HTTP/2 support in httpx
 Recommends:     python-h2
+# quic
+Recommends:     python-aioquic
 # trio
 Suggests:       python-trio >= 0.14.0
 BuildArch:      noarch
@@ -55,8 +57,10 @@ BuildArch:      noarch
 BuildRequires:  %{python_module cryptography}
 # BuildRequires:  %%{python_module curio >= 1.2}
 BuildRequires:  %{python_module h2}
-# doh:
+# doh
 BuildRequires:  %{python_module httpx}
+# quic
+BuildRequires:  %{python_module aioquic}
 # idna
 BuildRequires:  %{python_module idna}
 BuildRequires:  %{python_module pytest}
@@ -111,6 +115,17 @@ chmod -x dns/win32util.py
 
 %if %{with test}
 %check
+# remove tests that require a working resolver and external DNS resolution
+rm tests/test_async.py
+rm tests/test_doh.py
+rm tests/test_resolver.py
+rm tests/test_resolver_override.py
+# remove dnssec related tests since those require an openssl version with
+# support for supports "ECDSA with deterministic signature (RFC 6979)"
+# https://github.com/pyca/cryptography/pull/10369
+# TODO: reenable once TW ships openssl >= 3.2.0
+rm tests/test_dnssec.py
+rm tests/test_dnssecalgs.py
 %pytest
 %endif