hep: enable acts +cuda +traccc

* add missing libiconv

* use the virtual provider

.github/workflows/requirements/style/requirements.txt

@@ -3,5 +3,5 @@ clingo==5.7.1
 flake8==7.1.2
 isort==6.0.1
 mypy==1.15.0
-types-six==1.17.0.20241205
+types-six==1.17.0.20250304
 vermin==1.6.0

lib/spack/spack/repo.py

@@ -1406,6 +1406,8 @@ def create_repo(root, namespace=None, subdir=packages_dir_name):
             config.write(f"  namespace: '{namespace}'\n")
             if subdir != packages_dir_name:
                 config.write(f"  subdirectory: '{subdir}'\n")
+            x, y = spack.package_api_version
+            config.write(f"  api: v{x}.{y}\n")
 
     except OSError as e:
         # try to clean up.

share/spack/gitlab/cloud_pipelines/stacks/hep/spack.yaml

@@ -17,7 +17,7 @@ spack:
         tbb: [intel-tbb]
       variants: +mpi
     acts:
-      require: +analysis +dd4hep +edm4hep +examples +fatras +geant4 +hepmc3 +podio +pythia8 +python ~svg +tgeo cxxstd=20
+      require: +alignment +analysis +dd4hep +edm4hep +examples +fatras +fatras_geant4 +geant4 +geomodel +hepmc3 +json +odd +onnx +podio +pythia8 +python +svg +tgeo cxxstd=20
     celeritas:
       require: +geant4 +hepmc3 +root +shared cxxstd=20
     hip:
@@ -109,7 +109,7 @@ spack:
   - yoda +root
 
   # CUDA
-  #- acts +cuda +traccc cuda_arch=80
+  - acts +cuda +traccc cuda_arch=80
   #- celeritas +cuda ~openmp +vecgeom cuda_arch=80
   - root +cuda +cudnn +tmva-gpu
   - vecgeom +cuda cuda_arch=80

var/spack/repos/builtin/packages/acts/package.py

@@ -360,7 +360,9 @@ class Acts(CMakePackage, CudaPackage):
         depends_on("actsvg@0.4.35:", when="@28:")
         depends_on("actsvg@0.4.39:", when="@32:")
         depends_on("actsvg@0.4.40:", when="@32.1:")
-        depends_on("actsvg@0.4.50:", when="@37:")
+        depends_on(
+            "actsvg@0.4.51:", when="@37:"
+        )  # https://github.com/acts-project/actsvg/issues/94
     depends_on("acts-algebra-plugins @0.24:", when="+traccc")
     depends_on("autodiff @0.6:", when="@17: +autodiff")
     depends_on("autodiff @0.5.11:0.5.99", when="@1.2:16 +autodiff")

var/spack/repos/builtin/packages/actsvg/package.py

@@ -19,6 +19,7 @@ class Actsvg(CMakePackage):
 
     license("MPL-2.0")
 
+    version("0.4.51", sha256="937385f7703c0d2d9c0af03bd5083d3f1fdac17ff573476a5fc5b1f8e3cd98b7")
     version("0.4.50", sha256="c97fb1cc75cbf23caebd3c6fb8716354bdbd0a77ad39dc43dae963692f3256e1")
     version("0.4.48", sha256="0f230c31c64b939e4d311afd997dbaa87a375454cf1595661a449b97943412c9")
     version("0.4.47", sha256="11924fddbdd01f6337875797dc3a97b62be565688e678485e992bcfc9bfb142f")

var/spack/repos/builtin/packages/gasnet/package.py

@@ -12,8 +12,8 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     """GASNet is a language-independent, networking middleware layer that
     provides network-independent, high-performance communication primitives
     including Remote Memory Access (RMA) and Active Messages (AM). It has been
-    used to implement parallel programming models and libraries such as UPC,
+    used to implement parallel programming models and libraries including UPC,
-    UPC++, Co-Array Fortran, Legion, Chapel, and many others. The interface is
+    UPC++, multi-image Fortran, Legion, Chapel, and many others. The interface is
     primarily intended as a compilation target and for use by runtime library
     writers (as opposed to end users), and the primary goals are high
     performance, interface portability, and expressiveness.
@@ -21,12 +21,12 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     ***NOTICE***: The GASNet library built by this Spack package is ONLY intended for
     unit-testing purposes, and is generally UNSUITABLE FOR PRODUCTION USE.
     The RECOMMENDED way to build GASNet is as an embedded library as configured
-    by the higher-level client runtime package (UPC++, Legion, etc), including
+    by the higher-level client runtime package (UPC++, Legion, Chapel, etc), including
     system-specific configuration.
     """
 
     homepage = "https://gasnet.lbl.gov"
-    url = "https://gasnet.lbl.gov/EX/GASNet-2021.3.0.tar.gz"
+    url = "https://gasnet.lbl.gov/EX/GASNet-2024.5.0.tar.gz"
     git = "https://bitbucket.org/berkeleylab/gasnet.git"
 
     maintainers("PHHargrove", "bonachea")
@@ -37,11 +37,26 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     version("main", branch="stable")
     version("master", branch="master")
 
+    # commit hash e2fdec corresponds to tag gex-2025.2.0-snapshot
+    version("2025.2.0-snapshot", commit="e2fdece76d86d7b4fa090fbff9b46eb98ce97177")
+
+    # Versions fetched from git require a Bootstrap step
+    def bootstrap_version():
+        return "@master:,2025.2.0-snapshot"
+
     version("2024.5.0", sha256="f945e80f71d340664766b66290496d230e021df5e5cd88f404d101258446daa9")
     version("2023.9.0", sha256="2d9f15a794e10683579ce494cd458b0dd97e2d3327c4d17e1fea79bd95576ce6")
     version("2023.3.0", sha256="e1fa783d38a503cf2efa7662be591ca5c2bb98d19ac72a9bc6da457329a9a14f")
-    version("2022.9.2", sha256="2352d52f395a9aa14cc57d82957d9f1ebd928d0a0021fd26c5f1382a06cd6f1d")
+    version(
-    version("2022.9.0", sha256="6873ff4ad8ebee49da4378f2d78095a6ccc31333d6ae4cd739b9f772af11f936")
+        "2022.9.2",
+        deprecated=True,
+        sha256="2352d52f395a9aa14cc57d82957d9f1ebd928d0a0021fd26c5f1382a06cd6f1d",
+    )
+    version(
+        "2022.9.0",
+        deprecated=True,
+        sha256="6873ff4ad8ebee49da4378f2d78095a6ccc31333d6ae4cd739b9f772af11f936",
+    )
     version(
         "2022.3.0",
         deprecated=True,
@@ -129,8 +144,8 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     depends_on("mpi", when="conduits=mpi")
     depends_on("libfabric", when="conduits=ofi")
 
-    depends_on("autoconf@2.69", type="build", when="@master:")
+    depends_on("autoconf@2.69", type="build", when=bootstrap_version())
-    depends_on("automake@1.16:", type="build", when="@master:")
+    depends_on("automake@1.16:", type="build", when=bootstrap_version())
 
     conflicts("^hip@:4.4.0", when="+rocm")
 
@@ -139,7 +154,7 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     depends_on("oneapi-level-zero@1.8.0:", when="+level_zero")
 
     def install(self, spec, prefix):
-        if spec.satisfies("@master:"):
+        if spec.satisfies(Gasnet.bootstrap_version()):
             bootstrapsh = Executable("./Bootstrap")
             bootstrapsh()
             # Record git-describe when fetched from git:

var/spack/repos/builtin/packages/glib/package.py

@@ -19,7 +19,7 @@ class Glib(MesonPackage):
     """
 
     homepage = "https://developer.gnome.org/glib/"
-    url = "https://download.gnome.org/sources/glib/2.82/glib-2.82.2.tar.xz"
+    url = "https://download.gnome.org/sources/glib/2.82/glib-2.82.5.tar.xz"
     list_url = "https://download.gnome.org/sources/glib"
     list_depth = 1
 
@@ -28,6 +28,7 @@ class Glib(MesonPackage):
     license("LGPL-2.1-or-later")
 
     # Even minor versions are stable, odd minor versions are development, only add even numbers
+    version("2.82.5", sha256="05c2031f9bdf6b5aba7a06ca84f0b4aced28b19bf1b50c6ab25cc675277cbc3f")
     version("2.82.2", sha256="ab45f5a323048b1659ee0fbda5cecd94b099ab3e4b9abf26ae06aeb3e781fd63")
     version("2.78.3", sha256="609801dd373796e515972bf95fc0b2daa44545481ee2f465c4f204d224b2bc21")
     version("2.78.0", sha256="44eaab8b720877ce303c5540b657b126f12dc94972d9880b52959f43fb537b30")

var/spack/repos/builtin/packages/globalarrays/package.py

@@ -34,8 +34,9 @@ class Globalarrays(AutotoolsPackage):
     version("5.6.1", sha256="b324deed49f930f55203e1d18294ce07dd02680b9ac0728ebc54f94a12557ebc")
     version("5.6", sha256="a228dfbae9a6cfaae34694d7e56f589ac758e959b58f4bc49e6ef44058096767")
 
-    depends_on("c", type="build")  # generated
+    depends_on("c", type="build")
-    depends_on("fortran", type="build")  # generated
+    depends_on("cxx", type="build")
+    depends_on("fortran", type="build")
 
     variant("cxx", default=False, description="Enable C++")
     variant("scalapack", default=False, description="Enable SCALAPACK")
@@ -52,8 +53,6 @@ class Globalarrays(AutotoolsPackage):
 
     depends_on("libfabric", when="armci=ofi")
     depends_on("rdma-core", when="armci=openib")
-
-    depends_on("cxx", type="build", when="+cxx")
     depends_on("scalapack", when="+scalapack")
 
     # See release https://github.com/GlobalArrays/ga/releases/tag/v5.7.1

var/spack/repos/builtin/packages/meson/package.py

@@ -19,7 +19,9 @@ class Meson(PythonPackage):
 
     license("Apache-2.0")
 
-    version("1.5.1", sha256="55f6acd5bf72c14d4aa5a781993633f84a1d117bdf2c2057735902ced9b81390")
+    version("1.7.0", sha256="a6ca46e2a11a0278bb6492ecd4e0520ff441b164ebfdef1e012b11beb848d26e")
+    version("1.6.1", sha256="4889795777b536ea1a351982f3ef7c7b06a786ccb47036daba63cc5757c59edb")
+    version("1.5.2", sha256="fb41882bef26ffc02647d9978cba502a4accdf2e94c0a6dc9cc498dd7463381e")
     version("1.4.2", sha256="11d1336fe35e1ade57510a846a31d7dc2e3b6ac1e2491c2831bce5a2a192ba0d")
     version("1.3.2", sha256="683082fb3c5cddf203b21d29bdf4c227e2f7964da5324a15e1a5f7db94322b4b")
     version("1.2.2", sha256="1caa0ef6082e311bdca9836e7907f548b8c3f041a42ed41f0ff916b83ac7dddd")
@@ -27,6 +29,7 @@ class Meson(PythonPackage):
     version("1.0.2", sha256="1f1239c3091668643f7d2086663d6afd8cc87fbab84fe7462bc18b9ba6d65de8")
 
     with default_args(deprecated=True):
+        version("1.5.1", sha256="55f6acd5bf72c14d4aa5a781993633f84a1d117bdf2c2057735902ced9b81390")
         version("1.2.1", sha256="e1f3b32b636cc86496261bd89e63f00f206754697c7069788b62beed5e042713")
         version("1.2.0", sha256="603489f0aaa6305f806c6cc4a4455a965f22290fc74f65871f589b002110c790")
         version("1.1.0", sha256="f29a3e14062043d75e82d16f1e41856e6b1ed7a7c016e10c7b13afa7ee6364cc")

var/spack/repos/builtin/packages/mfem/package.py

@@ -282,6 +282,7 @@ class Mfem(Package, CudaPackage, ROCmPackage):
 
     depends_on("mpi", when="+mpi")
     depends_on("hipsparse", when="@4.4.0:+rocm")
+    depends_on("hipblas", when="@4.4.0:+rocm")
 
     with when("+mpi"):
         depends_on("hypre")
@@ -986,9 +987,10 @@ def find_optional_library(name, prefix):
             if "^rocprim" in spec and not spec["hip"].external:
                 # rocthrust [via petsc+rocm] has a dependency on rocprim
                 hip_headers += spec["rocprim"].headers
-            if "^hipblas" in spec and not spec["hip"].external:
+            if "^hipblas" in spec:
-                # superlu-dist+rocm needs the hipblas header path
+                hipblas = spec["hipblas"]
-                hip_headers += spec["hipblas"].headers
+                hip_headers += hipblas.headers
+                hip_libs += hipblas.libs
             if "%cce" in spec:
                 # We assume the proper Cray CCE module (cce) is loaded:
                 proc = str(spec.target.family)

var/spack/repos/builtin/packages/py-aiojobs/package.py

@@ -0,0 +1,27 @@
+# Copyright Spack Project Developers. See COPYRIGHT file for details.
+#
+# SPDX-License-Identifier: (Apache-2.0 OR MIT)
+
+from spack.package import *
+
+
+class PyAiojobs(PythonPackage):
+    """Jobs scheduler for managing background task (asyncio)."""
+
+    homepage = "https://github.com/aio-libs/aiojobs"
+    pypi = "aiojobs/aiojobs-1.3.0.tar.gz"
+
+    maintainers("alecbcs")
+
+    license("Apache-2.0", checked_by="alecbcs")
+
+    version("1.3.0", sha256="03074c884b3dc388b8d798c0de24ec17d72b2799018497fda8062c0431a494b5")
+
+    variant("aiohttp", default=False, description="Enable aiohttp integration")
+
+    depends_on("python@3.8:", type=("build", "run"))
+
+    depends_on("py-setuptools@46.4:", type="build")
+
+    depends_on("py-async-timeout@4:", type=("build", "run"), when="^python@:3.10")
+    depends_on("py-aiohttp@3.9:", type=("build", "run"), when="+aiohttp")

var/spack/repos/builtin/packages/py-rpy2/package.py

@@ -61,6 +61,8 @@ class PyRpy2(PythonPackage):
 
     depends_on("py-backports-zoneinfo", type=("build", "run"), when="@3.5.17: ^python@:3.8")
 
+    depends_on("iconv", type=("link"))
+
     # These are from 2019 and predate the pyproject.toml config that currently exists
     with when("@3.0.0:3.0.4"):
         # Doesn't support post-distutil removal until 3.5.13

var/spack/repos/builtin/packages/qt-5compat/package.py

@@ -17,6 +17,7 @@ class Qt5compat(QtPackage):
 
     license("LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only")
 
+    version("6.8.2", sha256="9b78a025f17d65eb826ee153f167546e6c12790235d75b7f4fcd03c166d9c689")
     version("6.8.1", sha256="5e51feb8d9362d860017ae72f63daa5caeddf3ec3396e73a4b27c672536fd774")
     version("6.8.0", sha256="0ea312a2d7e7033857712273e5ea42e61d1f485d23420307f7bbf0b8ca701453")
     version("6.7.3", sha256="959634d1a6a53f9a483882e81da87ec182ff44d7747a0cc771c786b0f2cf52e0")

var/spack/repos/builtin/packages/qt-base/package.py

@@ -123,6 +123,11 @@ def setup_dependent_build_environment(self, env, dependent_spec):
         # so we have to point dependencies to the cmake config files.
         env.prepend_path("QT_ADDITIONAL_PACKAGES_PREFIX_PATH", self.spec.prefix)
 
+        # Qt creates SBOM files based on the used SBOM files in the prefix, and
+        # in additional paths for other components.
+        if self.spec.satisfies("@6.9:"):
+            env.prepend_path("QT_ADDITIONAL_SBOM_DOCUMENT_PATHS", self.spec.prefix)
+
 
 class QtBase(QtPackage):
     """Qt Base (Core, Gui, Widgets, Network, ...)"""
@@ -134,6 +139,7 @@ class QtBase(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="9dddbb2ea3c107e20a99b816c1c6ba1483915325918936dda2c762bd73836ad9")
     version("6.8.1", sha256="9b81b83e4079d2f79ae057902973fc0ebb10d566ec022f483e7c0f2294acb19c")
     version("6.8.0", sha256="3e526ceaaf615005bc89a98ee8a52b87db6fefe7155595bf75c40fd82cd1a7ce")
     version("6.7.3", sha256="65771d1618cab08ec5e9bbfdc265b5d2ce2ccf0373143d7d9d139647a7196aec")

var/spack/repos/builtin/packages/qt-declarative/package.py

@@ -15,6 +15,7 @@ class QtDeclarative(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="1c29e98fac88f6d3b8a790248f4e6ad80439fe6e791116339d080e064ad8ae91")
     version("6.8.1", sha256="c3f41f5de5b2f02aa31bc5668f617f65d9adb3fb1939679b2a57a73a98c36ed6")
     version("6.8.0", sha256="d28e15cec7754ee16588deace17ee83d75e2613f4751a79dd60c277721f7480f")
     version("6.7.3", sha256="f39fa4e7e3b4011e52fc55fbde5f41e61815bffea432869abc9b90aa4de07613")

var/spack/repos/builtin/packages/qt-quick3d/package.py

@@ -15,6 +15,7 @@ class QtQuick3d(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="2901927d84fa3e55cd598575fa8a47dd97c770ed3c1893af9c9ee2aa167b7433")
     version("6.8.1", sha256="67878e0ecb9e8b760567364afd3c1b90d8c65087d8f676e9df51cad95df1bf21")
     version("6.8.0", sha256="3fc965c7c867e21d894e5394ec1c3f7626ecb895e335115661133ac499a14408")
     version("6.7.3", sha256="3e68f3a9a330e7b9a92ddf5b8d7a0874a107ea77636c788f598de65e327eb4a0")

var/spack/repos/builtin/packages/qt-quicktimeline/package.py

@@ -15,6 +15,7 @@ class QtQuicktimeline(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="74050e1b87495a500b66d114ba2311e9d2feb5bdadb46979b6986aedf93cd97e")
     version("6.8.1", sha256="29d79b17c0de962ce5dc9f2984eb89b701946522537cf5c90ca803c75148de19")
     version("6.8.0", sha256="3128c0f1a9e944c52ac8d080ecab7e7ed2a37e67cd06ab573dc178b3f8832fb4")
     version("6.7.3", sha256="81ce374a22bf00d53d0a9d5293d6495a224137e9427e4d4913d87f2f0adc5a58")

var/spack/repos/builtin/packages/qt-shadertools/package.py

@@ -17,6 +17,7 @@ class QtShadertools(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="13d62df354ca2ca034d8a28263ee67104a6d94f5671417152556eb5eb3d64839")
     version("6.8.1", sha256="b780ae2746d98fa3fc896c8ea8cd5c17ea360bedb33948e7343946bd9b115c24")
     version("6.8.0", sha256="19a6fce3e958d8e8d6cb2c13501a4a8fa61ad9e5bc0cd0496901b34012f2362e")
     version("6.7.3", sha256="8ec6a48c41d49b6f9595659169b2c69aecd46e96a88131f19f6a4cda394fa3f4")

var/spack/repos/builtin/packages/qt-svg/package.py

@@ -17,6 +17,7 @@ class QtSvg(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="b2d1f8acc7471658c963cacf8dc99912fd20e7072b3bdf7a53ccf99ba41788e8")
     version("6.8.1", sha256="288f233991686bc411a11cc331fb1be5f12ed43be03e29639158e545685ce7c9")
     version("6.8.0", sha256="ec3112668b7b8cfd1790bf4f936268dd6d32251ea81bb20d3aa4c4bac2031866")
     version("6.7.3", sha256="2852d8f1f52b60f0624ca5edf479125e4b32d579b1177d8b76d8e28fac98a701")
@@ -37,7 +38,8 @@ class QtSvg(QtPackage):
     version("6.4.0", sha256="375eb69f320121e42d5dc107f9455008980c149646931b8ace19e6bc235dcd80")
     version("6.3.2", sha256="781055bca458be46ef69f2fff147a00226e41f3a23d02c91238b0328a7156518")
 
-    depends_on("cxx", type="build")  # generated
+    depends_on("c", type="build")
+    depends_on("cxx", type="build")
 
     variant("widgets", default=False, description="Build SVG widgets.")
 

var/spack/repos/builtin/packages/qt-tools/package.py

@@ -19,6 +19,7 @@ class QtTools(QtPackage):
     license("BSD-3-Clause")
 
     # src/assistant/qlitehtml is a submodule that is not in the git archive
+    version("6.8.2", commit="8aa2456d4461516f54c98916fcd699557afb41ad", submodules=True)
     version("6.8.1", commit="b0d66c51cbda17b213bed73d379f0900c77f457c", submodules=True)
     version("6.8.0", commit="3dd2b6ad0dd1a0480628b4cc74cb7b89a89e4a61", submodules=True)
     version("6.7.3", commit="ec4747e62a837a0262212a5f4fb03734660c7360", submodules=True)

var/spack/repos/builtin/packages/raja/package.py

@@ -175,6 +175,13 @@ class Raja(CachedCMakePackage, CudaPackage, ROCmPackage):
         when="^hip@6.0",
     )
 
+    # Fix compilation issue reported by Intel from their new compiler version
+    patch(
+        "https://github.com/LLNL/RAJA/pull/1668.patch?full_index=1",
+        sha256="c0548fc5220f24082fb2592d5b4e8b7c8c783b87906d5f0950d53953d25161f6",
+        when="@2024.02.1:2024.02.99 %oneapi@2025:",
+    )
+
     variant("openmp", default=False, description="Build OpenMP backend")
     variant("shared", default=False, description="Build shared libs")
     variant("desul", default=False, description="Build desul atomics backend")

var/spack/repos/builtin/packages/tcl/package.py

@@ -182,6 +182,12 @@ def setup_dependent_build_environment(self, env, dependent_spec):
 class AutotoolsBuilder(AnyBuilder, spack.build_systems.autotools.AutotoolsBuilder):
     configure_directory = "unix"
 
+    # if TCL is present on the system this may be set to the system's
+    # existing TCL so ensure it is unset
+    # https://wiki.tcl-lang.org/page/TCL%5FLIBRARY
+    def setup_build_environment(self, env):
+        env.set("TCL_LIBRARY", "")
+
     def install(self, pkg, spec, prefix):
         with working_dir(self.build_directory):
             make("install")

var/spack/repos/builtin/packages/vecgeom/package.py

@@ -19,11 +19,17 @@ class Vecgeom(CMakePackage, CudaPackage):
 
     maintainers("drbenmorgan", "sethrj")
 
-    version("master", branch="master")
+    version("master", branch="master", get_full_repo=True)
+    version(
+        "2.0.0-surfacedev.1",
+        tag="v2.0.0-surfacedev.1",
+        commit="1d9797ea47e3b35ab0114e72ce5925ecbd59cbf4",
+    )
     version(
         "1.2.10",
         url="https://gitlab.cern.ch/-/project/981/uploads/8e0a94013efdd1b2d4f44c3fbb10bcdf/VecGeom-v1.2.10.tar.gz",
         sha256="3e0934842694452e4cb4a265428cb99af1ecc45f0e2d28a32dfeaa0634c21e2a",
+        preferred=True,
     )
     version(
         "1.2.9",
@@ -88,6 +94,7 @@ class Vecgeom(CMakePackage, CudaPackage):
     variant("geant4", default=False, description="Support Geant4 geometry construction")
     variant("root", default=False, description="Support ROOT geometry construction")
     variant("shared", default=True, description="Build shared libraries")
+    variant("surface", default=False, when="@2:", description="Use surface frame representation")
 
     depends_on("veccore")
     depends_on("veccore@0.8.1:", when="+cuda")
@@ -97,6 +104,9 @@ class Vecgeom(CMakePackage, CudaPackage):
 
     conflicts("+cuda", when="@:1.1.5")
 
+    # NOTE: surface branch doesn't yet compile with volume
+    conflicts("~surface", when="@=2.0.0-surfacedev.1")
+
     # Fix empty -Xcompiler= with nvcc
     patch(
         "https://gitlab.cern.ch/VecGeom/VecGeom/-/commit/0bf9b675ab70eb5cb9409ff73c1152fd1326dbf4.diff",
@@ -159,6 +169,8 @@ def cmake_args(self):
                     raise InstallError("Exactly one cuda_arch must be specified")
                 args.append(define("CUDA_ARCH", arch[0]))
 
+        args.append(from_variant("VECGEOM_USE_SURF", "surface"))
+
         # Set testing flags
         build_tests = self.run_tests
         args.append(define("BUILD_TESTING", build_tests))

var/spack/repos/builtin/packages/xz/package.py

@@ -27,8 +27,10 @@ class Xz(MSBuildPackage, AutotoolsPackage, SourceforgePackage):
 
     license("GPL-2.0-or-later AND Public-Domain AND LGPL-2.1-or-later", checked_by="tgamblin")
 
-    # NOTE: don't add XZ 5.6 until this compromise is resolved:
+    version("5.6.3", sha256="a95a49147b2dbb5487517acc0adcd77f9c2032cf00664eeae352405357d14a6c")
-    # https://www.openwall.com/lists/oss-security/2024/03/29/4
+    version("5.6.2", sha256="e12aa03cbd200597bd4ce11d97be2d09a6e6d39a9311ce72c91ac7deacde3171")
+    # ALERT: don't add XZ 5.6.0 or 5.6.1, https://nvd.nist.gov/vuln/detail/CVE-2024-3094
+    version("5.4.7", sha256="9976ed9cd0764e962d852d7d519ee1c3a7f87aca3b86e5d021a45650ba3ecb41")
     version("5.4.6", sha256="913851b274e8e1d31781ec949f1c23e8dbcf0ecf6e73a2436dc21769dd3e6f49")
     version("5.4.5", sha256="8ccf5fff868c006f29522e386fb4c6a1b66463fbca65a4cfc3c4bd596e895e79")
     version("5.4.1", sha256="dd172acb53867a68012f94c17389401b2f274a1aa5ae8f84cbfb8b7e383ea8d3")
@@ -60,6 +62,7 @@ class Xz(MSBuildPackage, AutotoolsPackage, SourceforgePackage):
     conflicts("platform=windows", when="+pic")  # no pic on Windows
     # prior to 5.2.3, build system is for MinGW only, not currently supported by Spack
     conflicts("platform=windows", when="@:5.2.3")
+    conflicts("platform=windows", when="@5.6:")  # CMake is required
 
     patch(
         "nvhpc.patch",