diff --git a/.gitignore b/.gitignore
index 32472ec..3b21ed4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,5 @@
 /R-3.5.0.tar.gz
 /R-3.5.1.tar.gz
 /curl-7.61.1.tar.bz2
+/curl-7.63.0.tar.bz2
+/R-3.5.2.tar.gz
diff --git a/R.spec b/R.spec
index 2e6b947..d8ee28e 100644
--- a/R.spec
+++ b/R.spec
@@ -107,8 +107,8 @@
 %endif
 
 Name: R
-Version: 3.5.1
-Release: 2%{?dist}
+Version: 3.5.2
+Release: 1%{?dist}
 Summary: A language for data analysis and graphics
 URL: http://www.r-project.org
 Source0: https://cran.r-project.org/src/base/R-3/R-%{version}.tar.gz
@@ -133,7 +133,7 @@ Source106: https://cran.r-project.org/doc/FAQ/R-FAQ.html
 %global bzipv 1.0.6
 %global xzv 5.2.4
 %global pcrev 8.42
-%global curlv 7.61.1
+%global curlv 7.63.0
 Source1000: http://zlib.net/zlib-%{zlibv}.tar.gz
 Source1001: http://www.bzip.org/1.0.6/bzip2-%{bzipv}.tar.gz
 Source1002: http://tukaani.org/xz/xz-%{xzv}.tar.bz2
@@ -1194,6 +1194,9 @@ R CMD javareconf \
 %{_libdir}/libRmath.a
 
 %changelog
+* Mon Jan  7 2019 Tom Callaway <spot@fedoraproject.org> - 3.5.2-1
+- update to 3.5.2
+
 * Fri Dec  7 2018 Tom Callaway <spot@fedoraproject.org> - 3.5.1-2
 - use absolute path in symlink for latex dir (bz1594102)
 
diff --git a/sources b/sources
index 3777c7d..3ec9e3e 100644
--- a/sources
+++ b/sources
@@ -2,5 +2,5 @@ SHA512 (zlib-1.2.11.tar.gz) = 73fd3fff4adeccd4894084c15ddac89890cd10ef105dd5e183
 SHA512 (bzip2-1.0.6.tar.gz) = 00ace5438cfa0c577e5f578d8a808613187eff5217c35164ffe044fbafdfec9e98f4192c02a7d67e01e5a5ccced630583ad1003c37697219b0f147343a3fdd12
 SHA512 (pcre-8.42.tar.bz2) = b47b923108f6ee0c31409b79d0888314271b482a22590e164d02f21d2112fba22dd0342c24f9ba0f5fcc5b8c65550bad08c476e30a2fc79b34ecf4601ed82f3d
 SHA512 (xz-5.2.4.tar.bz2) = 25a548c34a304ba51cdaa63813df0fa4ac2f3cf0ec6dc2d181ec5b62fe586090cd0f1c866ee7ba19e9b264ecabf9ca9f2f1dda7f95313546da4152f3cfaa7e6e
-SHA512 (R-3.5.1.tar.gz) = 382cc6e200469dd168799948edcf3a0b869d7ef3b3176fdfc60752f3f37e6ba356323c47d8815a4d9ab6ad3a21cd045d26ef5e75107c8685328e0ffcfd172f7f
-SHA512 (curl-7.61.1.tar.bz2) = 484d33c0d32109539a95309cdb4404c03c0e7164fdbf7a4724a5b01aa20e2d48fbe6363c7cc53060d4d28050cfa6b43f9ed220ab65d4d389eb00efff5db1bfb5
+SHA512 (curl-7.63.0.tar.bz2) = 2873ef57b15cf12e508626f4546f6e06450cb87b239be1d26d9b3a22f7533d76eebabb5fa00e7b8c5d7fc9854356997ce164afb069411d079b2b9f0bdb00db25
+SHA512 (R-3.5.2.tar.gz) = 53e94f01ecee6c90cecfa07ee9950d62130a331010c0b23baaf88ab5009007856c9352ce97916404ff35d19632495902d41cb655a5fd116a7d2f5d6767d7b447