diff --git a/nsd-4.2.2.tar.gz b/nsd-4.2.2.tar.gz
deleted file mode 100644
index f204fce..0000000
--- a/nsd-4.2.2.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:83b333940a25fe6d453bcac6ea39edfa244612a879117c4a624c97eb250246fb
-size 1149182
diff --git a/nsd-4.2.2.tar.gz.asc b/nsd-4.2.2.tar.gz.asc
deleted file mode 100644
index 564fe9b..0000000
--- a/nsd-4.2.2.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCAAdFiEE7fqj8spObrBWga+On28cLX4EX40FAl1aZ5kACgkQn28cLX4E
-X43iQQ/8D3IXpwc1VhdEeySuCuPwS5aikaZA9440te4xbecxaqvsgra3Z8LorJf2
-i+NnDDG/9GlLHheoHvK3ri9v8kPeaKKDI1wrNuddxK9gkmQFRfNRFKMqDm/UQuot
-vSZi+OHIcm8fHlqBFQMJe09PZmKXTsTWWPwS0fiyN5tf9YOL12+f8/er8KtezY5R
-5sCdh4sWBOYkMlqZnEy/PwVgLudCTF1SrPNFiWu1Oh1R8zFP21jrUaArLr/dBd0F
-bKvjEcKJr01iX+QWyFlHMeOx85nSj3KYrGX16OwmZPTZMmHfCnhy/nSbBtGPsmss
-z8JShsDplZpyXA20mQUEUtT3PkYsUL2KbWhtGuJo9eHvumRC7B/yBYqRW0ho33bm
-0P8h6P+FaNvlG75qK8TWEhh0wBG1Jr/Ng8PdVaCjfCqtlKf4HYFWwmrkc0mqgkXP
-dccO2y06pw9XeZw4qGbBSpUaMzytELG1eXnScxKXkkq0HxTCsaded2CFxEucnDQI
-0djnM/Bs6FVWnPeuR1pyJbVnKP9zi33ay0qZ++yG7WI9xyaWjT4mxMN1YM6NW/7B
-BpQrpDaBoY1sz3yv0M+bOO4Gl9q02JLd4pS5tthQE25O5lA5iXWLNeylyMbP9qPz
-zzC/WU/PhjTedAFYpIOP7vIwAK+4b5vyUHoYdUdMR/ULxw4gqjc=
-=1aEu
------END PGP SIGNATURE-----
diff --git a/nsd-4.2.3.tar.gz b/nsd-4.2.3.tar.gz
new file mode 100644
index 0000000..ec07e09
--- /dev/null
+++ b/nsd-4.2.3.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:817d963b39d2af982f6a523f905cfd5b14a3707220a8da8f3013f34cdfe5c498
+size 1148054
diff --git a/nsd-4.2.3.tar.gz.asc b/nsd-4.2.3.tar.gz.asc
new file mode 100644
index 0000000..e7ed60e
--- /dev/null
+++ b/nsd-4.2.3.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEE7fqj8spObrBWga+On28cLX4EX40FAl3U4qwACgkQn28cLX4E
+X426jg/8DPAD1nDOAABljHcc696uwmbbl6D5qsWZN9Vasjt4Y0ho3b9/52oZMytw
+z/dAi6c55YGU/C684AwkZdDB8ru+G5YfIzxqOQze7ZHxjWY4Cmnb1uVf0OElTYTi
+BT85kyERxcW6Q7d3DWivLjJnq8PoEYirJK0W7ZA3x1sh0jQXPKjQnLa5rMf2S26A
+6Ir+1NsuAxl840FIAa0/kVMPv4R1pjjidvvHQIX6r1U8C2QGv7LaAqnBo4Ey6Z/f
+n+L386BnYHWtiF+gFhNemysvJwOhK9qB/DxnmzJjCNfLurxFiw/+hfOAk+r22w8M
+1RZMR1mOm2fBuiqbmENO4oqfa3RxDGmGKx1raiPslU1NCD0dKhyKRb3ahS8gbB3Y
+TyGC11E/FG0ttVWVDme6bMm7jbHzwnt/ANUPF7A+XTgvMyZW7vXa3qS2gfiCMziP
+BgLW/IoiTn3wY7YYY4kW92p93xLbKo8lFKIaNU4ajFT7VihuKRTGJm6pziqpKX/V
+0IWcnF7sVy7hev4gcwM/zKsOhUOjE7BIx5r8NLOxOXD50CAPziGgrbHSGjpXexHh
+8AZZuA0oVP66xOW+4XvAusI3DxDiF5tFkgtI7HubqUzL2aI3BYymdEgy3ZbEcMi5
+otjaq/KCpITVDgVWMKaRpwbNdOi2P4U+lNfT8gK3W3yvJnGEouM=
+=4HO2
+-----END PGP SIGNATURE-----
diff --git a/nsd.changes b/nsd.changes
index b630b77..1344519 100644
--- a/nsd.changes
+++ b/nsd.changes
@@ -1,3 +1,28 @@
+-------------------------------------------------------------------
+Wed Nov 20 13:33:09 UTC 2019 - Adam Majer <adam.majer@suse.de>
+
+- New upstream release 4.2.3:
+  * confine-to-zone configures NSD to not return out-of-zone
+    additional information.
+  * pidfile "" allows to run NSD without a pidfile
+  * adds support for readiness notification with READY_FD
+  * fix excessive logging of ixfr failures, it stops the log when
+    fallback to axfr is possible. log is enabled at high verbosity.
+  * Fixup warnings during --disable-ipv6 compile.
+  * The nsd.conf includes are sorted ascending, for include statements
+    with a '*' from glob.
+  * Fix log address and failure reason with tls handshake errors,
+    squelches (the same as unbound) some unless high verbosity is used.
+  * Number of different UDP handlers has been reduced to one.
+    recvmmsg and sendmmsg implementations are now used on all platforms.
+  * Socket options are now set in designated functions for easy reuse.
+  * Socket setup has been simplified for easy reuse.
+  * Configuration parser is now aware of the context in which
+    an option was specified.
+  * document that remote-control is a top-level nsd.conf attribute.
+
+- Remove legacy upgrade of nsd users in %post (boo#1157331)boo#1157331)
+
 -------------------------------------------------------------------
 Sun Sep  8 14:13:02 UTC 2019 - Michael Ströder <michael@stroeder.com>
 
diff --git a/nsd.spec b/nsd.spec
index 6f5e96e..2cbf909 100644
--- a/nsd.spec
+++ b/nsd.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package nsd
 #
-# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -23,7 +23,7 @@
 %define zonesdir   %{configdir}/zones
 %define pidfile    %{_rundir}/nsd/nsd.pid
 Name:           nsd
-Version:        4.2.2
+Version:        4.2.3
 Release:        0
 #
 Summary:        An authoritative-only domain name server
@@ -104,20 +104,6 @@ getent passwd _nsd >/dev/null || \
 systemd-tmpfiles --create  %{_tmpfilesdir}/%{name}.conf || :
 %service_add_post %{name}.service
 
-# On upgrade, we migrate from old "nsd" user to new "_nsd" user for
-# config, home and default logging directories
-#
-# This is only used for special case of upgrading server:dns/nsd users
-# as 'nsd' user was never part of openSUSE:Factory
-if [ "x"$1 = "x2" ] && [ "x"`stat -c '%%G' %{home}/nsd.db` = 'xnsd' ]; then
-    echo "Changing legacy group from user/group nsd:nsd to _nsd:_nsd"
-    %{_bindir}/find %{_localstatedir}/log/nsd %{home} %{_rundir}/nsd -exec %{_bindir}/chown -v _nsd:_nsd {} \+
-    %{_bindir}/find %{configdir} -exec %{_bindir}/chgrp -v _nsd {} \+
-
-    # force restart because we need to remove users here
-    %{_bindir}/systemctl try-restart %{name}.service ||:
-fi
-
 %preun
 %service_del_preun %{name}.service