diff --git a/.gitignore b/.gitignore
index d44ceda..210234e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -56,3 +56,4 @@
 /librepo-1.11.1.tar.gz
 /librepo-1.11.3.tar.gz
 /librepo-1.12.0.tar.gz
+/librepo-1.12.1.tar.gz
diff --git a/librepo.spec b/librepo.spec
index 674def7..5e43d27 100644
--- a/librepo.spec
+++ b/librepo.spec
@@ -28,8 +28,8 @@
 %global dnf_conflict 2.8.8
 
 Name:           librepo
-Version:        1.12.0
-Release:        4%{?dist}
+Version:        1.12.1
+Release:        1%{?dist}
 Summary:        Repodata downloading library
 
 License:        LGPLv2+
@@ -192,6 +192,10 @@ popd
 %endif
 
 %changelog
+* Wed Oct 07 2020 Nicola Sella <nsella@redhat.com> - 1.12.1-1
+* Update to 1.12.1
+- Validate path read from repomd.xml (RhBug:1868639)
+
 * Fri Aug 07 2020 Nicola Sella <nsella@redhat.com> - 1.12.0-4
 spec: Fix building with new cmake macros
 
diff --git a/sources b/sources
index 6bbe635..c603d5b 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (librepo-1.12.0.tar.gz) = 754f42277b4a6eeb0c3a47400ed32b5de3b37f15f28619f9709de6d0bb4b294b60fcce11d489bb4c5a7a8bf3a5f449dbf57aca2fc2fde0b6a70a3fc18a71daf9
+SHA512 (librepo-1.12.1.tar.gz) = eff4eaa5206e6cbe13b253d7cc37b5a6085e05c807a56a75ad25f9b4c4035bf564336292bdea35d83d80e2953eeac299b7336f8dc485eed71480abfec6bcbe69