diff --git a/nghttp2-1.29.0.tar.xz b/nghttp2-1.29.0.tar.xz
deleted file mode 100644
index 6bf7391..0000000
--- a/nghttp2-1.29.0.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:a7a1b18be57be6a53a7739988ea27d6ec9209e7b0e8372b8483cd911d7838739
-size 1544736
diff --git a/nghttp2-1.31.1.tar.xz b/nghttp2-1.31.1.tar.xz
new file mode 100644
index 0000000..8caf187
--- /dev/null
+++ b/nghttp2-1.31.1.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:65b9c83ae95a7760a14410aeefa9d441c34453027bc938df7a2272520f32e103
+size 1545400
diff --git a/nghttp2.changes b/nghttp2.changes
index 3be1276..6f5251e 100644
--- a/nghttp2.changes
+++ b/nghttp2.changes
@@ -1,3 +1,33 @@
+-------------------------------------------------------------------
+Fri Apr 13 08:40:38 UTC 2018 - tchvatal@suse.com
+
+- Version umpdate to 1.31.1:
+  * Fix bsc#1088639 CVE-2018-1000168
+  * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/
+
+-------------------------------------------------------------------
+Mon Apr  9 10:16:47 UTC 2018 - tchvatal@suse.com
+
+- Version update to 1.31.0:
+  * lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
+  * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
+  * nghttpx: Close listening socket on graceful shutdown
+  * nghttpx: Add an option to accept expired client certificate (GH-1126)
+  * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
+  * nghttpx: Fix potential memory leak
+  * lib: Allow PING frame to be sent after GOAWAY (GH-1103)
+  * nghttpx: Fix bug that h1 backend idle timeout expires sooner
+  * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
+  * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
+  * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
+  * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)
+
+-------------------------------------------------------------------
+Mon Apr  9 08:59:52 UTC 2018 - tchvatal@suse.com
+
+- Drop spdylay dependency as it is deprecated since version 1.28.0
+  and removed from cofnigure.ac since 1.29.0
+
 -------------------------------------------------------------------
 Thu Feb 22 15:10:41 UTC 2018 - fvogt@suse.com
 
diff --git a/nghttp2.spec b/nghttp2.spec
index 4d57120..d3b3235 100644
--- a/nghttp2.spec
+++ b/nghttp2.spec
@@ -21,7 +21,7 @@
 %define soname_asio libnghttp2_asio
 %define sover_asio 1
 Name:           nghttp2
-Version:        1.29.0
+Version:        1.31.1
 Release:        0
 Summary:        Implementation of Hypertext Transfer Protocol version 2 in C
 License:        MIT
@@ -36,15 +36,14 @@ BuildRequires:  automake
 BuildRequires:  gcc-c++
 BuildRequires:  libtool
 BuildRequires:  pkgconfig
+BuildRequires:  python-rpm-macros
 BuildRequires:  python3-Cython
 BuildRequires:  python3-devel
-BuildRequires:  python-rpm-macros
 BuildRequires:  python3-setuptools
 BuildRequires:  pkgconfig(cunit)
 BuildRequires:  pkgconfig(jansson)
 BuildRequires:  pkgconfig(libcares)
 BuildRequires:  pkgconfig(libev)
-BuildRequires:  pkgconfig(libspdylay)
 BuildRequires:  pkgconfig(libsystemd)
 BuildRequires:  pkgconfig(libxml-2.0)
 BuildRequires:  pkgconfig(openssl)
@@ -122,6 +121,8 @@ HTTP/2 client, server and proxy.
 %prep
 %setup -q
 %patch0 -p1
+# fix python shebang
+sed -i -e 's:#!%{_bindir}/env python:#!%{_bindir}/python3:g' script/fetch-ocsp-response
 
 %build
 autoreconf -fiv