netcdf-c: add comment to PR with CMake option rename

.github/workflows/requirements/style/requirements.txt

@@ -3,5 +3,5 @@ clingo==5.7.1
 flake8==7.1.2
 isort==6.0.1
 mypy==1.15.0
-types-six==1.17.0.20250304
+types-six==1.17.0.20241205
 vermin==1.6.0

var/spack/repos/builtin/packages/gasnet/package.py

@@ -12,8 +12,8 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     """GASNet is a language-independent, networking middleware layer that
     provides network-independent, high-performance communication primitives
     including Remote Memory Access (RMA) and Active Messages (AM). It has been
-    used to implement parallel programming models and libraries including UPC,
-    UPC++, multi-image Fortran, Legion, Chapel, and many others. The interface is
+    used to implement parallel programming models and libraries such as UPC,
+    UPC++, Co-Array Fortran, Legion, Chapel, and many others. The interface is
     primarily intended as a compilation target and for use by runtime library
     writers (as opposed to end users), and the primary goals are high
     performance, interface portability, and expressiveness.
@@ -21,12 +21,12 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     ***NOTICE***: The GASNet library built by this Spack package is ONLY intended for
     unit-testing purposes, and is generally UNSUITABLE FOR PRODUCTION USE.
     The RECOMMENDED way to build GASNet is as an embedded library as configured
-    by the higher-level client runtime package (UPC++, Legion, Chapel, etc), including
+    by the higher-level client runtime package (UPC++, Legion, etc), including
     system-specific configuration.
     """
 
     homepage = "https://gasnet.lbl.gov"
-    url = "https://gasnet.lbl.gov/EX/GASNet-2024.5.0.tar.gz"
+    url = "https://gasnet.lbl.gov/EX/GASNet-2021.3.0.tar.gz"
     git = "https://bitbucket.org/berkeleylab/gasnet.git"
 
     maintainers("PHHargrove", "bonachea")
@@ -37,26 +37,11 @@ class Gasnet(Package, CudaPackage, ROCmPackage):
     version("main", branch="stable")
     version("master", branch="master")
 
-    # commit hash e2fdec corresponds to tag gex-2025.2.0-snapshot
-    version("2025.2.0-snapshot", commit="e2fdece76d86d7b4fa090fbff9b46eb98ce97177")
-
-    # Versions fetched from git require a Bootstrap step
-    def bootstrap_version():
-        return "@master:,2025.2.0-snapshot"
-
     version("2024.5.0", sha256="f945e80f71d340664766b66290496d230e021df5e5cd88f404d101258446daa9")
     version("2023.9.0", sha256="2d9f15a794e10683579ce494cd458b0dd97e2d3327c4d17e1fea79bd95576ce6")
     version("2023.3.0", sha256="e1fa783d38a503cf2efa7662be591ca5c2bb98d19ac72a9bc6da457329a9a14f")
-    version(
-        "2022.9.2",
-        deprecated=True,
-        sha256="2352d52f395a9aa14cc57d82957d9f1ebd928d0a0021fd26c5f1382a06cd6f1d",
-    )
-    version(
-        "2022.9.0",
-        deprecated=True,
-        sha256="6873ff4ad8ebee49da4378f2d78095a6ccc31333d6ae4cd739b9f772af11f936",
-    )
+    version("2022.9.2", sha256="2352d52f395a9aa14cc57d82957d9f1ebd928d0a0021fd26c5f1382a06cd6f1d")
+    version("2022.9.0", sha256="6873ff4ad8ebee49da4378f2d78095a6ccc31333d6ae4cd739b9f772af11f936")
     version(
         "2022.3.0",
         deprecated=True,
@@ -144,8 +129,8 @@ def bootstrap_version():
     depends_on("mpi", when="conduits=mpi")
     depends_on("libfabric", when="conduits=ofi")
 
-    depends_on("autoconf@2.69", type="build", when=bootstrap_version())
-    depends_on("automake@1.16:", type="build", when=bootstrap_version())
+    depends_on("autoconf@2.69", type="build", when="@master:")
+    depends_on("automake@1.16:", type="build", when="@master:")
 
     conflicts("^hip@:4.4.0", when="+rocm")
 
@@ -154,7 +139,7 @@ def bootstrap_version():
     depends_on("oneapi-level-zero@1.8.0:", when="+level_zero")
 
     def install(self, spec, prefix):
-        if spec.satisfies(Gasnet.bootstrap_version()):
+        if spec.satisfies("@master:"):
             bootstrapsh = Executable("./Bootstrap")
             bootstrapsh()
             # Record git-describe when fetched from git:

var/spack/repos/builtin/packages/glib/package.py

@@ -19,7 +19,7 @@ class Glib(MesonPackage):
     """
 
     homepage = "https://developer.gnome.org/glib/"
-    url = "https://download.gnome.org/sources/glib/2.82/glib-2.82.5.tar.xz"
+    url = "https://download.gnome.org/sources/glib/2.82/glib-2.82.2.tar.xz"
     list_url = "https://download.gnome.org/sources/glib"
     list_depth = 1
 
@@ -28,7 +28,6 @@ class Glib(MesonPackage):
     license("LGPL-2.1-or-later")
 
     # Even minor versions are stable, odd minor versions are development, only add even numbers
-    version("2.82.5", sha256="05c2031f9bdf6b5aba7a06ca84f0b4aced28b19bf1b50c6ab25cc675277cbc3f")
     version("2.82.2", sha256="ab45f5a323048b1659ee0fbda5cecd94b099ab3e4b9abf26ae06aeb3e781fd63")
     version("2.78.3", sha256="609801dd373796e515972bf95fc0b2daa44545481ee2f465c4f204d224b2bc21")
     version("2.78.0", sha256="44eaab8b720877ce303c5540b657b126f12dc94972d9880b52959f43fb537b30")

var/spack/repos/builtin/packages/globalarrays/package.py

@@ -34,9 +34,8 @@ class Globalarrays(AutotoolsPackage):
     version("5.6.1", sha256="b324deed49f930f55203e1d18294ce07dd02680b9ac0728ebc54f94a12557ebc")
     version("5.6", sha256="a228dfbae9a6cfaae34694d7e56f589ac758e959b58f4bc49e6ef44058096767")
 
-    depends_on("c", type="build")
-    depends_on("cxx", type="build")
-    depends_on("fortran", type="build")
+    depends_on("c", type="build")  # generated
+    depends_on("fortran", type="build")  # generated
 
     variant("cxx", default=False, description="Enable C++")
     variant("scalapack", default=False, description="Enable SCALAPACK")
@@ -53,6 +52,8 @@ class Globalarrays(AutotoolsPackage):
 
     depends_on("libfabric", when="armci=ofi")
     depends_on("rdma-core", when="armci=openib")
+
+    depends_on("cxx", type="build", when="+cxx")
     depends_on("scalapack", when="+scalapack")
 
     # See release https://github.com/GlobalArrays/ga/releases/tag/v5.7.1

var/spack/repos/builtin/packages/meson/package.py

@@ -19,9 +19,7 @@ class Meson(PythonPackage):
 
     license("Apache-2.0")
 
-    version("1.7.0", sha256="a6ca46e2a11a0278bb6492ecd4e0520ff441b164ebfdef1e012b11beb848d26e")
-    version("1.6.1", sha256="4889795777b536ea1a351982f3ef7c7b06a786ccb47036daba63cc5757c59edb")
-    version("1.5.2", sha256="fb41882bef26ffc02647d9978cba502a4accdf2e94c0a6dc9cc498dd7463381e")
+    version("1.5.1", sha256="55f6acd5bf72c14d4aa5a781993633f84a1d117bdf2c2057735902ced9b81390")
     version("1.4.2", sha256="11d1336fe35e1ade57510a846a31d7dc2e3b6ac1e2491c2831bce5a2a192ba0d")
     version("1.3.2", sha256="683082fb3c5cddf203b21d29bdf4c227e2f7964da5324a15e1a5f7db94322b4b")
     version("1.2.2", sha256="1caa0ef6082e311bdca9836e7907f548b8c3f041a42ed41f0ff916b83ac7dddd")
@@ -29,7 +27,6 @@ class Meson(PythonPackage):
     version("1.0.2", sha256="1f1239c3091668643f7d2086663d6afd8cc87fbab84fe7462bc18b9ba6d65de8")
 
     with default_args(deprecated=True):
-        version("1.5.1", sha256="55f6acd5bf72c14d4aa5a781993633f84a1d117bdf2c2057735902ced9b81390")
         version("1.2.1", sha256="e1f3b32b636cc86496261bd89e63f00f206754697c7069788b62beed5e042713")
         version("1.2.0", sha256="603489f0aaa6305f806c6cc4a4455a965f22290fc74f65871f589b002110c790")
         version("1.1.0", sha256="f29a3e14062043d75e82d16f1e41856e6b1ed7a7c016e10c7b13afa7ee6364cc")

var/spack/repos/builtin/packages/mfem/package.py

@@ -282,7 +282,6 @@ class Mfem(Package, CudaPackage, ROCmPackage):
 
     depends_on("mpi", when="+mpi")
     depends_on("hipsparse", when="@4.4.0:+rocm")
-    depends_on("hipblas", when="@4.4.0:+rocm")
 
     with when("+mpi"):
         depends_on("hypre")
@@ -987,10 +986,9 @@ def find_optional_library(name, prefix):
             if "^rocprim" in spec and not spec["hip"].external:
                 # rocthrust [via petsc+rocm] has a dependency on rocprim
                 hip_headers += spec["rocprim"].headers
-            if "^hipblas" in spec:
-                hipblas = spec["hipblas"]
-                hip_headers += hipblas.headers
-                hip_libs += hipblas.libs
+            if "^hipblas" in spec and not spec["hip"].external:
+                # superlu-dist+rocm needs the hipblas header path
+                hip_headers += spec["hipblas"].headers
             if "%cce" in spec:
                 # We assume the proper Cray CCE module (cce) is loaded:
                 proc = str(spec.target.family)

var/spack/repos/builtin/packages/netcdf-c/package.py

@@ -27,6 +27,7 @@ class NetcdfC(CMakePackage, AutotoolsPackage):
     license("BSD-3-Clause")
 
     version("main", branch="main")
+    version("4.9.3", sha256="990f46d49525d6ab5dc4249f8684c6deeaf54de6fec63a187e9fb382cc0ffdff")
     version("4.9.2", sha256="bc104d101278c68b303359b3dc4192f81592ae8640f1aee486921138f7f88cb7")
     version("4.9.0", sha256="9f4cb864f3ab54adb75409984c6202323d2fc66c003e5308f3cdf224ed41c0a6")
     version("4.8.1", sha256="bc018cc30d5da402622bf76462480664c6668b55eb16ba205a0dfb8647161dd0")
@@ -329,29 +330,35 @@ def backup_nc_config(self):
 
 class CMakeBuilder(AnyBuilder, cmake.CMakeBuilder):
     def cmake_args(self):
+        # In 4.9.3, all CMake options were prefixed.
+        # Ref. https://github.com/Unidata/netcdf-c/pull/2895
+        nc = "NETCDF_" if self.spec.satisfies("@4.9.3:") else ""
         base_cmake_args = [
             self.define_from_variant("BUILD_SHARED_LIBS", "shared"),
-            self.define_from_variant("ENABLE_BYTERANGE", "byterange"),
-            self.define("BUILD_UTILITIES", True),
-            self.define("ENABLE_NETCDF_4", True),
-            self.define_from_variant("ENABLE_DAP", "dap"),
-            self.define_from_variant("ENABLE_HDF4", "hdf4"),
-            self.define("ENABLE_PARALLEL_TESTS", False),
-            self.define_from_variant("ENABLE_FSYNC", "fsync"),
-            self.define("ENABLE_LARGE_FILE_SUPPORT", True),
+            self.define_from_variant(nc + "ENABLE_BYTERANGE", "byterange"),
+            self.define(nc + "BUILD_UTILITIES", True),
+            self.define(nc + "ENABLE_NETCDF_4", True),
+            self.define_from_variant(nc + "ENABLE_DAP", "dap"),
+            self.define_from_variant(nc + "ENABLE_HDF4", "hdf4"),
+            self.define(nc + "ENABLE_PARALLEL_TESTS", False),
+            self.define_from_variant(nc + "ENABLE_FSYNC", "fsync"),
+            self.define(nc + "ENABLE_LARGE_FILE_SUPPORT", True),
             self.define_from_variant("NETCDF_ENABLE_LOGGING", "logging"),
         ]
         if "+parallel-netcdf" in self.pkg.spec:
-            base_cmake_args.append(self.define("ENABLE_PNETCDF", True))
+            base_cmake_args.append(self.define(nc + "ENABLE_PNETCDF", True))
         if self.pkg.spec.satisfies("@4.3.1:"):
-            base_cmake_args.append(self.define("ENABLE_DYNAMIC_LOADING", True))
+            base_cmake_args.append(self.define(nc + "ENABLE_DYNAMIC_LOADING", True))
         if "platform=windows" in self.pkg.spec:
             # Enforce the usage of the vendored version of bzip2 on Windows:
             base_cmake_args.append(self.define("Bz2_INCLUDE_DIRS", ""))
+
+        # FIND_SHARED_LIBS has different prefix
+        nc = "NETCDF_" if self.spec.satisfies("@4.9.3:") else "NC_"
         if "+shared" in self.pkg.spec["hdf5"]:
-            base_cmake_args.append(self.define("NC_FIND_SHARED_LIBS", True))
+            base_cmake_args.append(self.define(nc + "FIND_SHARED_LIBS", True))
         else:
-            base_cmake_args.append(self.define("NC_FIND_SHARED_LIBS", False))
+            base_cmake_args.append(self.define(nc + "FIND_SHARED_LIBS", False))
         return base_cmake_args
 
     @run_after("install")

var/spack/repos/builtin/packages/py-aiojobs/package.py

@@ -1,27 +0,0 @@
-# Copyright Spack Project Developers. See COPYRIGHT file for details.
-#
-# SPDX-License-Identifier: (Apache-2.0 OR MIT)
-
-from spack.package import *
-
-
-class PyAiojobs(PythonPackage):
-    """Jobs scheduler for managing background task (asyncio)."""
-
-    homepage = "https://github.com/aio-libs/aiojobs"
-    pypi = "aiojobs/aiojobs-1.3.0.tar.gz"
-
-    maintainers("alecbcs")
-
-    license("Apache-2.0", checked_by="alecbcs")
-
-    version("1.3.0", sha256="03074c884b3dc388b8d798c0de24ec17d72b2799018497fda8062c0431a494b5")
-
-    variant("aiohttp", default=False, description="Enable aiohttp integration")
-
-    depends_on("python@3.8:", type=("build", "run"))
-
-    depends_on("py-setuptools@46.4:", type="build")
-
-    depends_on("py-async-timeout@4:", type=("build", "run"), when="^python@:3.10")
-    depends_on("py-aiohttp@3.9:", type=("build", "run"), when="+aiohttp")

var/spack/repos/builtin/packages/qt-5compat/package.py

@@ -17,7 +17,6 @@ class Qt5compat(QtPackage):
 
     license("LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only")
 
-    version("6.8.2", sha256="9b78a025f17d65eb826ee153f167546e6c12790235d75b7f4fcd03c166d9c689")
     version("6.8.1", sha256="5e51feb8d9362d860017ae72f63daa5caeddf3ec3396e73a4b27c672536fd774")
     version("6.8.0", sha256="0ea312a2d7e7033857712273e5ea42e61d1f485d23420307f7bbf0b8ca701453")
     version("6.7.3", sha256="959634d1a6a53f9a483882e81da87ec182ff44d7747a0cc771c786b0f2cf52e0")

var/spack/repos/builtin/packages/qt-base/package.py

@@ -123,11 +123,6 @@ def setup_dependent_build_environment(self, env, dependent_spec):
         # so we have to point dependencies to the cmake config files.
         env.prepend_path("QT_ADDITIONAL_PACKAGES_PREFIX_PATH", self.spec.prefix)
 
-        # Qt creates SBOM files based on the used SBOM files in the prefix, and
-        # in additional paths for other components.
-        if self.spec.satisfies("@6.9:"):
-            env.prepend_path("QT_ADDITIONAL_SBOM_DOCUMENT_PATHS", self.spec.prefix)
-
 
 class QtBase(QtPackage):
     """Qt Base (Core, Gui, Widgets, Network, ...)"""
@@ -139,7 +134,6 @@ class QtBase(QtPackage):
 
     license("BSD-3-Clause")
 
-    version("6.8.2", sha256="9dddbb2ea3c107e20a99b816c1c6ba1483915325918936dda2c762bd73836ad9")
     version("6.8.1", sha256="9b81b83e4079d2f79ae057902973fc0ebb10d566ec022f483e7c0f2294acb19c")
     version("6.8.0", sha256="3e526ceaaf615005bc89a98ee8a52b87db6fefe7155595bf75c40fd82cd1a7ce")
     version("6.7.3", sha256="65771d1618cab08ec5e9bbfdc265b5d2ce2ccf0373143d7d9d139647a7196aec")

var/spack/repos/builtin/packages/qt-declarative/package.py

@@ -15,7 +15,6 @@ class QtDeclarative(QtPackage):
 
     license("BSD-3-Clause")
 
-    version("6.8.2", sha256="1c29e98fac88f6d3b8a790248f4e6ad80439fe6e791116339d080e064ad8ae91")
     version("6.8.1", sha256="c3f41f5de5b2f02aa31bc5668f617f65d9adb3fb1939679b2a57a73a98c36ed6")
     version("6.8.0", sha256="d28e15cec7754ee16588deace17ee83d75e2613f4751a79dd60c277721f7480f")
     version("6.7.3", sha256="f39fa4e7e3b4011e52fc55fbde5f41e61815bffea432869abc9b90aa4de07613")

var/spack/repos/builtin/packages/qt-quick3d/package.py

@@ -15,7 +15,6 @@ class QtQuick3d(QtPackage):
 
     license("BSD-3-Clause")
 
-    version("6.8.2", sha256="2901927d84fa3e55cd598575fa8a47dd97c770ed3c1893af9c9ee2aa167b7433")
     version("6.8.1", sha256="67878e0ecb9e8b760567364afd3c1b90d8c65087d8f676e9df51cad95df1bf21")
     version("6.8.0", sha256="3fc965c7c867e21d894e5394ec1c3f7626ecb895e335115661133ac499a14408")
     version("6.7.3", sha256="3e68f3a9a330e7b9a92ddf5b8d7a0874a107ea77636c788f598de65e327eb4a0")

var/spack/repos/builtin/packages/qt-quicktimeline/package.py

@@ -15,7 +15,6 @@ class QtQuicktimeline(QtPackage):
 
     license("BSD-3-Clause")
 
-    version("6.8.2", sha256="74050e1b87495a500b66d114ba2311e9d2feb5bdadb46979b6986aedf93cd97e")
     version("6.8.1", sha256="29d79b17c0de962ce5dc9f2984eb89b701946522537cf5c90ca803c75148de19")
     version("6.8.0", sha256="3128c0f1a9e944c52ac8d080ecab7e7ed2a37e67cd06ab573dc178b3f8832fb4")
     version("6.7.3", sha256="81ce374a22bf00d53d0a9d5293d6495a224137e9427e4d4913d87f2f0adc5a58")

var/spack/repos/builtin/packages/qt-shadertools/package.py

@@ -17,7 +17,6 @@ class QtShadertools(QtPackage):
 
     license("BSD-3-Clause")
 
-    version("6.8.2", sha256="13d62df354ca2ca034d8a28263ee67104a6d94f5671417152556eb5eb3d64839")
     version("6.8.1", sha256="b780ae2746d98fa3fc896c8ea8cd5c17ea360bedb33948e7343946bd9b115c24")
     version("6.8.0", sha256="19a6fce3e958d8e8d6cb2c13501a4a8fa61ad9e5bc0cd0496901b34012f2362e")
     version("6.7.3", sha256="8ec6a48c41d49b6f9595659169b2c69aecd46e96a88131f19f6a4cda394fa3f4")

var/spack/repos/builtin/packages/qt-svg/package.py

@@ -17,7 +17,6 @@ class QtSvg(QtPackage):
 
     license("BSD-3-Clause")
 
-    version("6.8.2", sha256="b2d1f8acc7471658c963cacf8dc99912fd20e7072b3bdf7a53ccf99ba41788e8")
     version("6.8.1", sha256="288f233991686bc411a11cc331fb1be5f12ed43be03e29639158e545685ce7c9")
     version("6.8.0", sha256="ec3112668b7b8cfd1790bf4f936268dd6d32251ea81bb20d3aa4c4bac2031866")
     version("6.7.3", sha256="2852d8f1f52b60f0624ca5edf479125e4b32d579b1177d8b76d8e28fac98a701")
@@ -38,8 +37,7 @@ class QtSvg(QtPackage):
     version("6.4.0", sha256="375eb69f320121e42d5dc107f9455008980c149646931b8ace19e6bc235dcd80")
     version("6.3.2", sha256="781055bca458be46ef69f2fff147a00226e41f3a23d02c91238b0328a7156518")
 
-    depends_on("c", type="build")
-    depends_on("cxx", type="build")
+    depends_on("cxx", type="build")  # generated
 
     variant("widgets", default=False, description="Build SVG widgets.")
 

var/spack/repos/builtin/packages/qt-tools/package.py

@@ -19,7 +19,6 @@ class QtTools(QtPackage):
     license("BSD-3-Clause")
 
     # src/assistant/qlitehtml is a submodule that is not in the git archive
-    version("6.8.2", commit="8aa2456d4461516f54c98916fcd699557afb41ad", submodules=True)
     version("6.8.1", commit="b0d66c51cbda17b213bed73d379f0900c77f457c", submodules=True)
     version("6.8.0", commit="3dd2b6ad0dd1a0480628b4cc74cb7b89a89e4a61", submodules=True)
     version("6.7.3", commit="ec4747e62a837a0262212a5f4fb03734660c7360", submodules=True)

var/spack/repos/builtin/packages/seacas/package.py

@@ -246,6 +246,7 @@ class Seacas(CMakePackage):
     # Always depends on netcdf-c
     depends_on("netcdf-c@4.8.0:+mpi+parallel-netcdf", when="+mpi")
     depends_on("netcdf-c@4.8.0:~mpi", when="~mpi")
+    depends_on("netcdf-c@:4.9.2", when="@:2024-08-15")
     depends_on("hdf5+hl~mpi", when="~mpi")
     depends_on("hdf5+hl+mpi", when="+mpi")
 

var/spack/repos/builtin/packages/vecgeom/package.py

@@ -19,17 +19,11 @@ class Vecgeom(CMakePackage, CudaPackage):
 
     maintainers("drbenmorgan", "sethrj")
 
-    version("master", branch="master", get_full_repo=True)
-    version(
-        "2.0.0-surfacedev.1",
-        tag="v2.0.0-surfacedev.1",
-        commit="1d9797ea47e3b35ab0114e72ce5925ecbd59cbf4",
-    )
+    version("master", branch="master")
     version(
         "1.2.10",
         url="https://gitlab.cern.ch/-/project/981/uploads/8e0a94013efdd1b2d4f44c3fbb10bcdf/VecGeom-v1.2.10.tar.gz",
         sha256="3e0934842694452e4cb4a265428cb99af1ecc45f0e2d28a32dfeaa0634c21e2a",
-        preferred=True,
     )
     version(
         "1.2.9",
@@ -94,7 +88,6 @@ class Vecgeom(CMakePackage, CudaPackage):
     variant("geant4", default=False, description="Support Geant4 geometry construction")
     variant("root", default=False, description="Support ROOT geometry construction")
     variant("shared", default=True, description="Build shared libraries")
-    variant("surface", default=False, when="@2:", description="Use surface frame representation")
 
     depends_on("veccore")
     depends_on("veccore@0.8.1:", when="+cuda")
@@ -104,9 +97,6 @@ class Vecgeom(CMakePackage, CudaPackage):
 
     conflicts("+cuda", when="@:1.1.5")
 
-    # NOTE: surface branch doesn't yet compile with volume
-    conflicts("~surface", when="@=2.0.0-surfacedev.1")
-
     # Fix empty -Xcompiler= with nvcc
     patch(
         "https://gitlab.cern.ch/VecGeom/VecGeom/-/commit/0bf9b675ab70eb5cb9409ff73c1152fd1326dbf4.diff",
@@ -169,8 +159,6 @@ def cmake_args(self):
                     raise InstallError("Exactly one cuda_arch must be specified")
                 args.append(define("CUDA_ARCH", arch[0]))
 
-        args.append(from_variant("VECGEOM_USE_SURF", "surface"))
-
         # Set testing flags
         build_tests = self.run_tests
         args.append(define("BUILD_TESTING", build_tests))

var/spack/repos/builtin/packages/xz/package.py

@@ -27,10 +27,8 @@ class Xz(MSBuildPackage, AutotoolsPackage, SourceforgePackage):
 
     license("GPL-2.0-or-later AND Public-Domain AND LGPL-2.1-or-later", checked_by="tgamblin")
 
-    version("5.6.3", sha256="a95a49147b2dbb5487517acc0adcd77f9c2032cf00664eeae352405357d14a6c")
-    version("5.6.2", sha256="e12aa03cbd200597bd4ce11d97be2d09a6e6d39a9311ce72c91ac7deacde3171")
-    # ALERT: don't add XZ 5.6.0 or 5.6.1, https://nvd.nist.gov/vuln/detail/CVE-2024-3094
-    version("5.4.7", sha256="9976ed9cd0764e962d852d7d519ee1c3a7f87aca3b86e5d021a45650ba3ecb41")
+    # NOTE: don't add XZ 5.6 until this compromise is resolved:
+    # https://www.openwall.com/lists/oss-security/2024/03/29/4
     version("5.4.6", sha256="913851b274e8e1d31781ec949f1c23e8dbcf0ecf6e73a2436dc21769dd3e6f49")
     version("5.4.5", sha256="8ccf5fff868c006f29522e386fb4c6a1b66463fbca65a4cfc3c4bd596e895e79")
     version("5.4.1", sha256="dd172acb53867a68012f94c17389401b2f274a1aa5ae8f84cbfb8b7e383ea8d3")
@@ -62,7 +60,6 @@ class Xz(MSBuildPackage, AutotoolsPackage, SourceforgePackage):
     conflicts("platform=windows", when="+pic")  # no pic on Windows
     # prior to 5.2.3, build system is for MinGW only, not currently supported by Spack
     conflicts("platform=windows", when="@:5.2.3")
-    conflicts("platform=windows", when="@5.6:")  # CMake is required
 
     patch(
         "nvhpc.patch",