diff --git a/msmtp-1.8.18.tar.xz b/msmtp-1.8.18.tar.xz
deleted file mode 100644
index 2d104c2..0000000
--- a/msmtp-1.8.18.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:14fc62af37ebdcc5ed19a245a05eb8376efe7016118f00c9c594bc999d5560a5
-size 380776
diff --git a/msmtp-1.8.18.tar.xz.sig b/msmtp-1.8.18.tar.xz.sig
deleted file mode 100644
index a472538..0000000
Binary files a/msmtp-1.8.18.tar.xz.sig and /dev/null differ
diff --git a/msmtp-1.8.19.tar.xz b/msmtp-1.8.19.tar.xz
new file mode 100644
index 0000000..a067c2d
--- /dev/null
+++ b/msmtp-1.8.19.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:34a1e1981176874dbe4ee66ee0d9103c90989aa4dcdc4861e4de05ce7e44526b
+size 383100
diff --git a/msmtp-1.8.19.tar.xz.sig b/msmtp-1.8.19.tar.xz.sig
new file mode 100644
index 0000000..637118a
Binary files /dev/null and b/msmtp-1.8.19.tar.xz.sig differ
diff --git a/msmtp.changes b/msmtp.changes
index 9775b09..729dc01 100644
--- a/msmtp.changes
+++ b/msmtp.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Thu Nov  4 17:54:27 UTC 2021 - Benoît Monin <benoit.monin@gmx.fr>
+
+- update to version 1.8.19:
+  * Fixed a security problem in msmtpd: mail addresses starting
+    with '-' could be interpreted as options of the pipe command.
+
 -------------------------------------------------------------------
 Sat Oct 23 08:55:15 UTC 2021 - Benoît Monin <benoit.monin@gmx.fr>
 
diff --git a/msmtp.spec b/msmtp.spec
index 2e62304..8c1b515 100644
--- a/msmtp.spec
+++ b/msmtp.spec
@@ -17,7 +17,7 @@
 
 
 Name:           msmtp
-Version:        1.8.18
+Version:        1.8.19
 Release:        0
 BuildRequires:  gnutls-devel >= 3.4
 BuildRequires:  libidn2-devel