diff --git a/NEWS b/NEWS
index 99a6ad08f3..72706fc5e9 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,12 @@
+* crun-1.13
+
+- src: use O_CLOEXEC for all open/openat calls
+- cgroup v1: use "max" when pids limit < 0.
+- improve error message when idmap mount fails because the underlying
+  file system has no support for it.
+- libcrun: fix compilation when building without libseccomp and libcap.
+- fix relative idmapped mount when using the custom annotation.
+
 * crun-1.12
 
 - add new WebAssembly handler: spin.
diff --git a/libocispec b/libocispec
index 19c05670c3..32546870a2 160000
--- a/libocispec
+++ b/libocispec
@@ -1 +1 @@
-Subproject commit 19c05670c37a42c217caa7b141bcaada7867cc15
+Subproject commit 32546870a2967a9194436e2611e3c9765dcb3a7a