diff --git a/git-2.3.6.tar.xz b/git-2.3.6.tar.xz
deleted file mode 100644
index 8845d3d..0000000
--- a/git-2.3.6.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:3ce01c54e92b47366756f57742280e052412efde65344e31f51ad8a48a7c60fc
-size 3621716
diff --git a/git-2.3.7.tar.xz b/git-2.3.7.tar.xz
new file mode 100644
index 0000000..6c572c4
--- /dev/null
+++ b/git-2.3.7.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:eb4696943f82ab55be71048d6e640942b78cd179ec501989aff8706b57f6515b
+size 3621804
diff --git a/git.changes b/git.changes
index 6ab6d4a..1386fa5 100644
--- a/git.changes
+++ b/git.changes
@@ -1,3 +1,18 @@
+-------------------------------------------------------------------
+Tue Apr 28 15:56:38 UTC 2015 - astieger@suse.com
+
+- git 2.3.7:
+ * An earlier update to the parser that disects a URL broke an
+   address, followed by a colon, followed by an empty string (instead
+   of the port number), e.g. ssh://example.com:/path/to/repo.
+ * The completion script (in contrib/) contaminated global namespace
+   and clobbered on a shell variable $x.
+ * The "git push --signed" protocol extension did not limit what the
+   "nonce" that is a server-chosen string can contain or how long it
+   can be, which was unnecessarily lax.  Limit both the length and the
+   alphabet to a reasonably small space that can still have enough
+   entropy.
+
 -------------------------------------------------------------------
 Sun Apr 26 18:09:29 UTC 2015 - astieger@suse.com
 
diff --git a/git.spec b/git.spec
index a65c889..0caf39f 100644
--- a/git.spec
+++ b/git.spec
@@ -26,7 +26,7 @@
 %endif
 
 Name:           git
-Version:        2.3.6
+Version:        2.3.7
 Release:        0
 Summary:        Fast, scalable, distributed revision control system
 License:        GPL-2.0