diff --git a/Gemfile.lock b/Gemfile.lock
index 427b747..a14e5a9 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -468,7 +468,7 @@ GEM
     websocket-driver (0.7.1)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.4)
-    xmlhash (1.3.7)
+    xmlhash (1.3.8)
       pkg-config
     xmlrpc (0.3.0)
     xpath (3.2.0)
diff --git a/obs-bundled-gems.spec b/obs-bundled-gems.spec
index eb49f97..59b2099 100644
--- a/obs-bundled-gems.spec
+++ b/obs-bundled-gems.spec
@@ -19,7 +19,7 @@
 %global rack_version 2.0.8
 Name:           obs-bundled-gems
 Version:        2.10.1
-Release:        4
+Release:        5
 Summary:        The Open Build Service -- Bundled Gems
 License:        GPL-2.0-only OR GPL-3.0-only
 URL:            http://www.openbuildservice.org
@@ -132,6 +132,9 @@ done
 %doc README
 
 %changelog
+* Thu May 12 2022 wangkai <wangkai385@huawei.com> - 2.10.1-5
+- Update xmlhash to 1.3.8
+
 * Wed Dec 01 2021 lingsheng <lingsheng@huawei.com> - 2.10.1-4
 - Fix exec permission in ruby/2.5.0/bin, change require to mariadb-server
 
diff --git a/verdor.obscpio b/verdor.obscpio
index f6d048d..8b12038 100644
Binary files a/verdor.obscpio and b/verdor.obscpio differ