Ignore provider weights for runtimes

Runtimes are inherently tied to the associated compilers,
and choices among runtimes should be delegated to the compiler
prioritization criteria not the provider weights. This fixes
a bug causing concretization to mix compilers more than necessary
to avoid using the runtime associated with the compiler specified
for the root. E.g. `foo%oneapi` building dependencies with `%gcc`
to minimize edges on which `intel-oneapi-runtime` provides
`fortran-rt`.

Signed-off-by: Gregory Becker <becker33@llnl.gov>

.github/workflows/requirements/style/requirements.txt

@@ -3,5 +3,5 @@ clingo==5.7.1
 flake8==7.1.2
 isort==6.0.1
 mypy==1.15.0
-types-six==1.17.0.20241205
+types-six==1.17.0.20250304
 vermin==1.6.0

lib/spack/spack/solver/concretize.lp

@@ -1682,10 +1682,11 @@ opt_criterion(45, "preferred providers (non-roots)").
 #minimize{ 0@245: #true }.
 #minimize{ 0@45: #true }.
 #minimize{
-    Weight@45+Priority,ProviderNode,Virtual
-    : provider_weight(ProviderNode, Virtual, Weight),
-      not attr("root", ProviderNode),
-      build_priority(ProviderNode, Priority)
+    Weight@45+Priority,X,Provider,Virtual
+    : provider_weight(node(X, Provider), Virtual, Weight),
+      not attr("root", node(X, Provider)),
+      build_priority(node(X, Provider), Priority),
+      not runtime(Provider)
 }.
 
 % Try to minimize the number of compiler mismatches in the DAG.

var/spack/repos/builtin/packages/gasnet/package.py

@@ -12,8 +12,8 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     """GASNet is a language-independent, networking middleware layer that
     provides network-independent, high-performance communication primitives
     including Remote Memory Access (RMA) and Active Messages (AM). It has been
-    used to implement parallel programming models and libraries such as UPC,
-    UPC++, Co-Array Fortran, Legion, Chapel, and many others. The interface is
+    used to implement parallel programming models and libraries including UPC,
+    UPC++, multi-image Fortran, Legion, Chapel, and many others. The interface is
     primarily intended as a compilation target and for use by runtime library
     writers (as opposed to end users), and the primary goals are high
     performance, interface portability, and expressiveness.
@@ -21,12 +21,12 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     ***NOTICE***: The GASNet library built by this Spack package is ONLY intended for
     unit-testing purposes, and is generally UNSUITABLE FOR PRODUCTION USE.
     The RECOMMENDED way to build GASNet is as an embedded library as configured
-    by the higher-level client runtime package (UPC++, Legion, etc), including
+    by the higher-level client runtime package (UPC++, Legion, Chapel, etc), including
     system-specific configuration.
     """
 
     homepage = "https://gasnet.lbl.gov"
-    url = "https://gasnet.lbl.gov/EX/GASNet-2021.3.0.tar.gz"
+    url = "https://gasnet.lbl.gov/EX/GASNet-2024.5.0.tar.gz"
     git = "https://bitbucket.org/berkeleylab/gasnet.git"
 
     maintainers("PHHargrove", "bonachea")
@@ -37,11 +37,26 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     version("main", branch="stable")
     version("master", branch="master")
 
+    # commit hash e2fdec corresponds to tag gex-2025.2.0-snapshot
+    version("2025.2.0-snapshot", commit="e2fdece76d86d7b4fa090fbff9b46eb98ce97177")
+
+    # Versions fetched from git require a Bootstrap step
+    def bootstrap_version():
+        return "@master:,2025.2.0-snapshot"
+
     version("2024.5.0", sha256="f945e80f71d340664766b66290496d230e021df5e5cd88f404d101258446daa9")
     version("2023.9.0", sha256="2d9f15a794e10683579ce494cd458b0dd97e2d3327c4d17e1fea79bd95576ce6")
     version("2023.3.0", sha256="e1fa783d38a503cf2efa7662be591ca5c2bb98d19ac72a9bc6da457329a9a14f")
-    version("2022.9.2", sha256="2352d52f395a9aa14cc57d82957d9f1ebd928d0a0021fd26c5f1382a06cd6f1d")
-    version("2022.9.0", sha256="6873ff4ad8ebee49da4378f2d78095a6ccc31333d6ae4cd739b9f772af11f936")
+    version(
+        "2022.9.2",
+        deprecated=True,
+        sha256="2352d52f395a9aa14cc57d82957d9f1ebd928d0a0021fd26c5f1382a06cd6f1d",
+    )
+    version(
+        "2022.9.0",
+        deprecated=True,
+        sha256="6873ff4ad8ebee49da4378f2d78095a6ccc31333d6ae4cd739b9f772af11f936",
+    )
     version(
         "2022.3.0",
         deprecated=True,
@@ -129,8 +144,8 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     depends_on("mpi", when="conduits=mpi")
     depends_on("libfabric", when="conduits=ofi")
 
-    depends_on("autoconf@2.69", type="build", when="@master:")
-    depends_on("automake@1.16:", type="build", when="@master:")
+    depends_on("autoconf@2.69", type="build", when=bootstrap_version())
+    depends_on("automake@1.16:", type="build", when=bootstrap_version())
 
     conflicts("^hip@:4.4.0", when="+rocm")
 
@@ -139,7 +154,7 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     depends_on("oneapi-level-zero@1.8.0:", when="+level_zero")
 
     def install(self, spec, prefix):
-        if spec.satisfies("@master:"):
+        if spec.satisfies(Gasnet.bootstrap_version()):
             bootstrapsh = Executable("./Bootstrap")
             bootstrapsh()
             # Record git-describe when fetched from git:

var/spack/repos/builtin/packages/glib/package.py

@@ -19,7 +19,7 @@ class Glib(MesonPackage):
     """
 
     homepage = "https://developer.gnome.org/glib/"
-    url = "https://download.gnome.org/sources/glib/2.82/glib-2.82.2.tar.xz"
+    url = "https://download.gnome.org/sources/glib/2.82/glib-2.82.5.tar.xz"
     list_url = "https://download.gnome.org/sources/glib"
     list_depth = 1
 
@@ -28,6 +28,7 @@ class Glib(MesonPackage):
     license("LGPL-2.1-or-later")
 
     # Even minor versions are stable, odd minor versions are development, only add even numbers
+    version("2.82.5", sha256="05c2031f9bdf6b5aba7a06ca84f0b4aced28b19bf1b50c6ab25cc675277cbc3f")
     version("2.82.2", sha256="ab45f5a323048b1659ee0fbda5cecd94b099ab3e4b9abf26ae06aeb3e781fd63")
     version("2.78.3", sha256="609801dd373796e515972bf95fc0b2daa44545481ee2f465c4f204d224b2bc21")
     version("2.78.0", sha256="44eaab8b720877ce303c5540b657b126f12dc94972d9880b52959f43fb537b30")

var/spack/repos/builtin/packages/globalarrays/package.py

@@ -34,8 +34,9 @@ class Globalarrays(AutotoolsPackage):
     version("5.6.1", sha256="b324deed49f930f55203e1d18294ce07dd02680b9ac0728ebc54f94a12557ebc")
     version("5.6", sha256="a228dfbae9a6cfaae34694d7e56f589ac758e959b58f4bc49e6ef44058096767")
 
-    depends_on("c", type="build")  # generated
-    depends_on("fortran", type="build")  # generated
+    depends_on("c", type="build")
+    depends_on("cxx", type="build")
+    depends_on("fortran", type="build")
 
     variant("cxx", default=False, description="Enable C++")
     variant("scalapack", default=False, description="Enable SCALAPACK")
@@ -52,8 +53,6 @@ class Globalarrays(AutotoolsPackage):
 
     depends_on("libfabric", when="armci=ofi")
     depends_on("rdma-core", when="armci=openib")
-
-    depends_on("cxx", type="build", when="+cxx")
     depends_on("scalapack", when="+scalapack")
 
     # See release https://github.com/GlobalArrays/ga/releases/tag/v5.7.1

var/spack/repos/builtin/packages/meson/package.py

@@ -19,7 +19,9 @@ class Meson(PythonPackage):
 
     license("Apache-2.0")
 
-    version("1.5.1", sha256="55f6acd5bf72c14d4aa5a781993633f84a1d117bdf2c2057735902ced9b81390")
+    version("1.7.0", sha256="a6ca46e2a11a0278bb6492ecd4e0520ff441b164ebfdef1e012b11beb848d26e")
+    version("1.6.1", sha256="4889795777b536ea1a351982f3ef7c7b06a786ccb47036daba63cc5757c59edb")
+    version("1.5.2", sha256="fb41882bef26ffc02647d9978cba502a4accdf2e94c0a6dc9cc498dd7463381e")
     version("1.4.2", sha256="11d1336fe35e1ade57510a846a31d7dc2e3b6ac1e2491c2831bce5a2a192ba0d")
     version("1.3.2", sha256="683082fb3c5cddf203b21d29bdf4c227e2f7964da5324a15e1a5f7db94322b4b")
     version("1.2.2", sha256="1caa0ef6082e311bdca9836e7907f548b8c3f041a42ed41f0ff916b83ac7dddd")
@@ -27,6 +29,7 @@ class Meson(PythonPackage):
     version("1.0.2", sha256="1f1239c3091668643f7d2086663d6afd8cc87fbab84fe7462bc18b9ba6d65de8")
 
     with default_args(deprecated=True):
+        version("1.5.1", sha256="55f6acd5bf72c14d4aa5a781993633f84a1d117bdf2c2057735902ced9b81390")
         version("1.2.1", sha256="e1f3b32b636cc86496261bd89e63f00f206754697c7069788b62beed5e042713")
         version("1.2.0", sha256="603489f0aaa6305f806c6cc4a4455a965f22290fc74f65871f589b002110c790")
         version("1.1.0", sha256="f29a3e14062043d75e82d16f1e41856e6b1ed7a7c016e10c7b13afa7ee6364cc")

var/spack/repos/builtin/packages/mfem/package.py

@@ -282,6 +282,7 @@ class Mfem(Package, CudaPackage, ROCmPackage):
 
     depends_on("mpi", when="+mpi")
     depends_on("hipsparse", when="@4.4.0:+rocm")
+    depends_on("hipblas", when="@4.4.0:+rocm")
 
     with when("+mpi"):
         depends_on("hypre")
@@ -986,9 +987,10 @@ def find_optional_library(name, prefix):
             if "^rocprim" in spec and not spec["hip"].external:
                 # rocthrust [via petsc+rocm] has a dependency on rocprim
                 hip_headers += spec["rocprim"].headers
-            if "^hipblas" in spec and not spec["hip"].external:
-                # superlu-dist+rocm needs the hipblas header path
-                hip_headers += spec["hipblas"].headers
+            if "^hipblas" in spec:
+                hipblas = spec["hipblas"]
+                hip_headers += hipblas.headers
+                hip_libs += hipblas.libs
             if "%cce" in spec:
                 # We assume the proper Cray CCE module (cce) is loaded:
                 proc = str(spec.target.family)

var/spack/repos/builtin/packages/netcdf-c/package.py

@@ -27,7 +27,6 @@ class NetcdfC(CMakePackage, AutotoolsPackage):
     license("BSD-3-Clause")
 
     version("main", branch="main")
-    version("4.9.3", sha256="990f46d49525d6ab5dc4249f8684c6deeaf54de6fec63a187e9fb382cc0ffdff")
     version("4.9.2", sha256="bc104d101278c68b303359b3dc4192f81592ae8640f1aee486921138f7f88cb7")
     version("4.9.0", sha256="9f4cb864f3ab54adb75409984c6202323d2fc66c003e5308f3cdf224ed41c0a6")
     version("4.8.1", sha256="bc018cc30d5da402622bf76462480664c6668b55eb16ba205a0dfb8647161dd0")
@@ -330,35 +329,29 @@ def backup_nc_config(self):
 
 class CMakeBuilder(AnyBuilder, cmake.CMakeBuilder):
     def cmake_args(self):
-        # In 4.9.3, all CMake options were prefixed.
-        # Ref. https://github.com/Unidata/netcdf-c/pull/2895
-        nc = "NETCDF_" if self.spec.satisfies("@4.9.3:") else ""
         base_cmake_args = [
             self.define_from_variant("BUILD_SHARED_LIBS", "shared"),
-            self.define_from_variant(nc + "ENABLE_BYTERANGE", "byterange"),
-            self.define(nc + "BUILD_UTILITIES", True),
-            self.define(nc + "ENABLE_NETCDF_4", True),
-            self.define_from_variant(nc + "ENABLE_DAP", "dap"),
-            self.define_from_variant(nc + "ENABLE_HDF4", "hdf4"),
-            self.define(nc + "ENABLE_PARALLEL_TESTS", False),
-            self.define_from_variant(nc + "ENABLE_FSYNC", "fsync"),
-            self.define(nc + "ENABLE_LARGE_FILE_SUPPORT", True),
+            self.define_from_variant("ENABLE_BYTERANGE", "byterange"),
+            self.define("BUILD_UTILITIES", True),
+            self.define("ENABLE_NETCDF_4", True),
+            self.define_from_variant("ENABLE_DAP", "dap"),
+            self.define_from_variant("ENABLE_HDF4", "hdf4"),
+            self.define("ENABLE_PARALLEL_TESTS", False),
+            self.define_from_variant("ENABLE_FSYNC", "fsync"),
+            self.define("ENABLE_LARGE_FILE_SUPPORT", True),
             self.define_from_variant("NETCDF_ENABLE_LOGGING", "logging"),
         ]
         if "+parallel-netcdf" in self.pkg.spec:
-            base_cmake_args.append(self.define(nc + "ENABLE_PNETCDF", True))
+            base_cmake_args.append(self.define("ENABLE_PNETCDF", True))
         if self.pkg.spec.satisfies("@4.3.1:"):
-            base_cmake_args.append(self.define(nc + "ENABLE_DYNAMIC_LOADING", True))
+            base_cmake_args.append(self.define("ENABLE_DYNAMIC_LOADING", True))
         if "platform=windows" in self.pkg.spec:
             # Enforce the usage of the vendored version of bzip2 on Windows:
             base_cmake_args.append(self.define("Bz2_INCLUDE_DIRS", ""))
-
-        # FIND_SHARED_LIBS has different prefix
-        nc = "NETCDF_" if self.spec.satisfies("@4.9.3:") else "NC_"
         if "+shared" in self.pkg.spec["hdf5"]:
-            base_cmake_args.append(self.define(nc + "FIND_SHARED_LIBS", True))
+            base_cmake_args.append(self.define("NC_FIND_SHARED_LIBS", True))
         else:
-            base_cmake_args.append(self.define(nc + "FIND_SHARED_LIBS", False))
+            base_cmake_args.append(self.define("NC_FIND_SHARED_LIBS", False))
         return base_cmake_args
 
     @run_after("install")

var/spack/repos/builtin/packages/py-aiojobs/package.py

@@ -0,0 +1,27 @@
+# Copyright Spack Project Developers. See COPYRIGHT file for details.
+#
+# SPDX-License-Identifier: (Apache-2.0 OR MIT)
+
+from spack.package import *
+
+
+class PyAiojobs(PythonPackage):
+    """Jobs scheduler for managing background task (asyncio)."""
+
+    homepage = "https://github.com/aio-libs/aiojobs"
+    pypi = "aiojobs/aiojobs-1.3.0.tar.gz"
+
+    maintainers("alecbcs")
+
+    license("Apache-2.0", checked_by="alecbcs")
+
+    version("1.3.0", sha256="03074c884b3dc388b8d798c0de24ec17d72b2799018497fda8062c0431a494b5")
+
+    variant("aiohttp", default=False, description="Enable aiohttp integration")
+
+    depends_on("python@3.8:", type=("build", "run"))
+
+    depends_on("py-setuptools@46.4:", type="build")
+
+    depends_on("py-async-timeout@4:", type=("build", "run"), when="^python@:3.10")
+    depends_on("py-aiohttp@3.9:", type=("build", "run"), when="+aiohttp")

var/spack/repos/builtin/packages/qt-5compat/package.py

@@ -17,6 +17,7 @@ class Qt5compat(QtPackage):
 
     license("LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only")
 
+    version("6.8.2", sha256="9b78a025f17d65eb826ee153f167546e6c12790235d75b7f4fcd03c166d9c689")
     version("6.8.1", sha256="5e51feb8d9362d860017ae72f63daa5caeddf3ec3396e73a4b27c672536fd774")
     version("6.8.0", sha256="0ea312a2d7e7033857712273e5ea42e61d1f485d23420307f7bbf0b8ca701453")
     version("6.7.3", sha256="959634d1a6a53f9a483882e81da87ec182ff44d7747a0cc771c786b0f2cf52e0")

var/spack/repos/builtin/packages/qt-base/package.py

@@ -123,6 +123,11 @@ def setup_dependent_build_environment(self, env, dependent_spec):
         # so we have to point dependencies to the cmake config files.
         env.prepend_path("QT_ADDITIONAL_PACKAGES_PREFIX_PATH", self.spec.prefix)
 
+        # Qt creates SBOM files based on the used SBOM files in the prefix, and
+        # in additional paths for other components.
+        if self.spec.satisfies("@6.9:"):
+            env.prepend_path("QT_ADDITIONAL_SBOM_DOCUMENT_PATHS", self.spec.prefix)
+
 
 class QtBase(QtPackage):
     """Qt Base (Core, Gui, Widgets, Network, ...)"""
@@ -134,6 +139,7 @@ class QtBase(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="9dddbb2ea3c107e20a99b816c1c6ba1483915325918936dda2c762bd73836ad9")
     version("6.8.1", sha256="9b81b83e4079d2f79ae057902973fc0ebb10d566ec022f483e7c0f2294acb19c")
     version("6.8.0", sha256="3e526ceaaf615005bc89a98ee8a52b87db6fefe7155595bf75c40fd82cd1a7ce")
     version("6.7.3", sha256="65771d1618cab08ec5e9bbfdc265b5d2ce2ccf0373143d7d9d139647a7196aec")

var/spack/repos/builtin/packages/qt-declarative/package.py

@@ -15,6 +15,7 @@ class QtDeclarative(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="1c29e98fac88f6d3b8a790248f4e6ad80439fe6e791116339d080e064ad8ae91")
     version("6.8.1", sha256="c3f41f5de5b2f02aa31bc5668f617f65d9adb3fb1939679b2a57a73a98c36ed6")
     version("6.8.0", sha256="d28e15cec7754ee16588deace17ee83d75e2613f4751a79dd60c277721f7480f")
     version("6.7.3", sha256="f39fa4e7e3b4011e52fc55fbde5f41e61815bffea432869abc9b90aa4de07613")

var/spack/repos/builtin/packages/qt-quick3d/package.py

@@ -15,6 +15,7 @@ class QtQuick3d(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="2901927d84fa3e55cd598575fa8a47dd97c770ed3c1893af9c9ee2aa167b7433")
     version("6.8.1", sha256="67878e0ecb9e8b760567364afd3c1b90d8c65087d8f676e9df51cad95df1bf21")
     version("6.8.0", sha256="3fc965c7c867e21d894e5394ec1c3f7626ecb895e335115661133ac499a14408")
     version("6.7.3", sha256="3e68f3a9a330e7b9a92ddf5b8d7a0874a107ea77636c788f598de65e327eb4a0")

var/spack/repos/builtin/packages/qt-quicktimeline/package.py

@@ -15,6 +15,7 @@ class QtQuicktimeline(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="74050e1b87495a500b66d114ba2311e9d2feb5bdadb46979b6986aedf93cd97e")
     version("6.8.1", sha256="29d79b17c0de962ce5dc9f2984eb89b701946522537cf5c90ca803c75148de19")
     version("6.8.0", sha256="3128c0f1a9e944c52ac8d080ecab7e7ed2a37e67cd06ab573dc178b3f8832fb4")
     version("6.7.3", sha256="81ce374a22bf00d53d0a9d5293d6495a224137e9427e4d4913d87f2f0adc5a58")

var/spack/repos/builtin/packages/qt-shadertools/package.py

@@ -17,6 +17,7 @@ class QtShadertools(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="13d62df354ca2ca034d8a28263ee67104a6d94f5671417152556eb5eb3d64839")
     version("6.8.1", sha256="b780ae2746d98fa3fc896c8ea8cd5c17ea360bedb33948e7343946bd9b115c24")
     version("6.8.0", sha256="19a6fce3e958d8e8d6cb2c13501a4a8fa61ad9e5bc0cd0496901b34012f2362e")
     version("6.7.3", sha256="8ec6a48c41d49b6f9595659169b2c69aecd46e96a88131f19f6a4cda394fa3f4")

var/spack/repos/builtin/packages/qt-svg/package.py

@@ -17,6 +17,7 @@ class QtSvg(QtPackage):
 
     license("BSD-3-Clause")
 
+    version("6.8.2", sha256="b2d1f8acc7471658c963cacf8dc99912fd20e7072b3bdf7a53ccf99ba41788e8")
     version("6.8.1", sha256="288f233991686bc411a11cc331fb1be5f12ed43be03e29639158e545685ce7c9")
     version("6.8.0", sha256="ec3112668b7b8cfd1790bf4f936268dd6d32251ea81bb20d3aa4c4bac2031866")
     version("6.7.3", sha256="2852d8f1f52b60f0624ca5edf479125e4b32d579b1177d8b76d8e28fac98a701")
@@ -37,7 +38,8 @@ class QtSvg(QtPackage):
     version("6.4.0", sha256="375eb69f320121e42d5dc107f9455008980c149646931b8ace19e6bc235dcd80")
     version("6.3.2", sha256="781055bca458be46ef69f2fff147a00226e41f3a23d02c91238b0328a7156518")
 
-    depends_on("cxx", type="build")  # generated
+    depends_on("c", type="build")
+    depends_on("cxx", type="build")
 
     variant("widgets", default=False, description="Build SVG widgets.")
 

var/spack/repos/builtin/packages/qt-tools/package.py

@@ -19,6 +19,7 @@ class QtTools(QtPackage):
     license("BSD-3-Clause")
 
     # src/assistant/qlitehtml is a submodule that is not in the git archive
+    version("6.8.2", commit="8aa2456d4461516f54c98916fcd699557afb41ad", submodules=True)
     version("6.8.1", commit="b0d66c51cbda17b213bed73d379f0900c77f457c", submodules=True)
     version("6.8.0", commit="3dd2b6ad0dd1a0480628b4cc74cb7b89a89e4a61", submodules=True)
     version("6.7.3", commit="ec4747e62a837a0262212a5f4fb03734660c7360", submodules=True)

var/spack/repos/builtin/packages/seacas/package.py

@@ -246,7 +246,6 @@ class Seacas(CMakePackage):
     # Always depends on netcdf-c
     depends_on("netcdf-c@4.8.0:+mpi+parallel-netcdf", when="+mpi")
     depends_on("netcdf-c@4.8.0:~mpi", when="~mpi")
-    depends_on("netcdf-c@:4.9.2", when="@:2024-08-15")
     depends_on("hdf5+hl~mpi", when="~mpi")
     depends_on("hdf5+hl+mpi", when="+mpi")
 

var/spack/repos/builtin/packages/tcl/package.py

@@ -182,6 +182,12 @@ def setup_dependent_build_environment(self, env, dependent_spec):
 class AutotoolsBuilder(AnyBuilder, spack.build_systems.autotools.AutotoolsBuilder):
     configure_directory = "unix"
 
+    # if TCL is present on the system this may be set to the system's
+    # existing TCL so ensure it is unset
+    # https://wiki.tcl-lang.org/page/TCL%5FLIBRARY
+    def setup_build_environment(self, env):
+        env.set("TCL_LIBRARY", "")
+
     def install(self, pkg, spec, prefix):
         with working_dir(self.build_directory):
             make("install")

var/spack/repos/builtin/packages/vecgeom/package.py

@@ -19,11 +19,17 @@ class Vecgeom(CMakePackage, CudaPackage):
 
     maintainers("drbenmorgan", "sethrj")
 
-    version("master", branch="master")
+    version("master", branch="master", get_full_repo=True)
+    version(
+        "2.0.0-surfacedev.1",
+        tag="v2.0.0-surfacedev.1",
+        commit="1d9797ea47e3b35ab0114e72ce5925ecbd59cbf4",
+    )
     version(
         "1.2.10",
         url="https://gitlab.cern.ch/-/project/981/uploads/8e0a94013efdd1b2d4f44c3fbb10bcdf/VecGeom-v1.2.10.tar.gz",
         sha256="3e0934842694452e4cb4a265428cb99af1ecc45f0e2d28a32dfeaa0634c21e2a",
+        preferred=True,
     )
     version(
         "1.2.9",
@@ -88,6 +94,7 @@ class Vecgeom(CMakePackage, CudaPackage):
     variant("geant4", default=False, description="Support Geant4 geometry construction")
     variant("root", default=False, description="Support ROOT geometry construction")
     variant("shared", default=True, description="Build shared libraries")
+    variant("surface", default=False, when="@2:", description="Use surface frame representation")
 
     depends_on("veccore")
     depends_on("veccore@0.8.1:", when="+cuda")
@@ -97,6 +104,9 @@ class Vecgeom(CMakePackage, CudaPackage):
 
     conflicts("+cuda", when="@:1.1.5")
 
+    # NOTE: surface branch doesn't yet compile with volume
+    conflicts("~surface", when="@=2.0.0-surfacedev.1")
+
     # Fix empty -Xcompiler= with nvcc
     patch(
         "https://gitlab.cern.ch/VecGeom/VecGeom/-/commit/0bf9b675ab70eb5cb9409ff73c1152fd1326dbf4.diff",
@@ -159,6 +169,8 @@ def cmake_args(self):
                     raise InstallError("Exactly one cuda_arch must be specified")
                 args.append(define("CUDA_ARCH", arch[0]))
 
+        args.append(from_variant("VECGEOM_USE_SURF", "surface"))
+
         # Set testing flags
         build_tests = self.run_tests
         args.append(define("BUILD_TESTING", build_tests))

var/spack/repos/builtin/packages/xz/package.py

@@ -27,8 +27,10 @@ class Xz(MSBuildPackage, AutotoolsPackage, SourceforgePackage):
 
     license("GPL-2.0-or-later AND Public-Domain AND LGPL-2.1-or-later", checked_by="tgamblin")
 
-    # NOTE: don't add XZ 5.6 until this compromise is resolved:
-    # https://www.openwall.com/lists/oss-security/2024/03/29/4
+    version("5.6.3", sha256="a95a49147b2dbb5487517acc0adcd77f9c2032cf00664eeae352405357d14a6c")
+    version("5.6.2", sha256="e12aa03cbd200597bd4ce11d97be2d09a6e6d39a9311ce72c91ac7deacde3171")
+    # ALERT: don't add XZ 5.6.0 or 5.6.1, https://nvd.nist.gov/vuln/detail/CVE-2024-3094
+    version("5.4.7", sha256="9976ed9cd0764e962d852d7d519ee1c3a7f87aca3b86e5d021a45650ba3ecb41")
     version("5.4.6", sha256="913851b274e8e1d31781ec949f1c23e8dbcf0ecf6e73a2436dc21769dd3e6f49")
     version("5.4.5", sha256="8ccf5fff868c006f29522e386fb4c6a1b66463fbca65a4cfc3c4bd596e895e79")
     version("5.4.1", sha256="dd172acb53867a68012f94c17389401b2f274a1aa5ae8f84cbfb8b7e383ea8d3")
@@ -60,6 +62,7 @@ class Xz(MSBuildPackage, AutotoolsPackage, SourceforgePackage):
     conflicts("platform=windows", when="+pic")  # no pic on Windows
     # prior to 5.2.3, build system is for MinGW only, not currently supported by Spack
     conflicts("platform=windows", when="@:5.2.3")
+    conflicts("platform=windows", when="@5.6:")  # CMake is required
 
     patch(
         "nvhpc.patch",