diff --git a/repos/spack_repo/builtin/packages/arrow/package.py b/repos/spack_repo/builtin/packages/arrow/package.py
index 02e503380ca..ef6eef9e693 100644
--- a/repos/spack_repo/builtin/packages/arrow/package.py
+++ b/repos/spack_repo/builtin/packages/arrow/package.py
@@ -121,6 +121,11 @@ class Arrow(CMakePackage, CudaPackage):
     variant("ipc", default=True, description="Build the Arrow IPC extensions")
     variant("jemalloc", default=False, description="Build the Arrow jemalloc-based allocator")
     variant("lz4", default=False, description="Build support for lz4 compression")
+    variant(
+        "mimalloc",
+        default=True,
+        description="Build the Arrow mimalloc-based allocator",
+    )
     variant("orc", default=False, description="Build integration with Apache ORC")
     variant("parquet", default=False, description="Build Parquet interface")
     variant("python", default=False, description="Build Python interface")
@@ -174,8 +179,14 @@ def cmake_args(self):
             args.append(self.define("ARROW_USE_SSE", "ON"))
 
         # https://github.com/apache/arrow/issues/47790
-        if self.spec.satisfies("%oneapi@2025:"):
+        # mimalloc is always vendored (no system lookup); Arrow downloads its source
+        # via FetchContent at build time, which fails on air-gapped compute nodes.
+        # The ~mimalloc variant allows disabling it for such environments.
+        # Note: oneapi@2025: also has a compiler bug requiring MIMALLOC=OFF regardless.
+        if self.spec.satisfies("%oneapi@2025:") or self.spec.satisfies("~mimalloc"):
             args.append(self.define("ARROW_MIMALLOC", "OFF"))
+        else:
+            args.append(self.define_from_variant("ARROW_MIMALLOC", "mimalloc"))
 
         args.append(self.define_from_variant("ARROW_COMPUTE", "compute"))
         args.append(self.define_from_variant("ARROW_CSV", "csv"))
diff --git a/repos/spack_repo/builtin/packages/awscli_v2/package.py b/repos/spack_repo/builtin/packages/awscli_v2/package.py
index cd4e687ce87..9da8deb387a 100644
--- a/repos/spack_repo/builtin/packages/awscli_v2/package.py
+++ b/repos/spack_repo/builtin/packages/awscli_v2/package.py
@@ -17,11 +17,16 @@ class AwscliV2(PythonPackage):
     license("Apache-2.0")
     maintainers("climbfuji", "teaguesterling")
 
+    version("2.35.16", sha256="55754646274f224b19b0daeb9f01e4232a3e6e46665f3c1fdb425b2f026ade7d")
     version("2.24.24", sha256="d7b135ef02c96d50d81c0b5eb2723cf474cfda8e1758cccabbcaa6c14f281419")
     version("2.22.4", sha256="56c6170f3be830afef2dea60fc3fd7ed14cf2ca2efba055c085fe6a7c4de358e")
     version("2.15.53", sha256="a4f5fd4e09b8f2fb3d2049d0610c7b0993f9aafaf427f299439f05643b25eb4b")
     version("2.13.22", sha256="dd731a2ba5973f3219f24c8b332a223a29d959493c8a8e93746d65877d02afc1")
 
+    # The patch makes completion-index generation optional for environments
+    # where importing the full CLI command set during the wheel build hangs.
+    patch("skip-autocomplete-index.patch", when="@2.35.16")
+
     with default_args(type="build"):
         depends_on("py-flit-core@3.7.1:", when="@2.22:")
         # Upper bound relaxed for Python 3.14 support
@@ -44,15 +49,26 @@ class AwscliV2(PythonPackage):
         depends_on("py-ruamel-yaml-clib@0.2:0.2.7", when="@:2.15")
         depends_on("py-prompt-toolkit@3.0.24:3.0.38")
         depends_on("py-distro@1.5:1.8")
-        depends_on("py-awscrt@0.19.18:0.22.0", when="@2.22:")
+        depends_on("py-awscrt@0.35.0", when="@2.35.16")
+        depends_on("py-awscrt@0.19.18:0.22.0", when="@2.22:2.35.15")
         depends_on("py-awscrt@0.19.18:0.19.19", when="@2.15")
         depends_on("py-awscrt@0.16.4:0.16.16", when="@2.13")
         depends_on("py-python-dateutil@2.1:2.9.0", when="@2.22:")
         depends_on("py-python-dateutil@2.1:2.8.2", when="@:2.15")
         depends_on("py-jmespath@0.7.1:1.0")
-        depends_on("py-urllib3@1.25.4:1.26")
+
+        # For Python 3.10 and newer, support urllib3 v1 and v2
+        depends_on("py-urllib3@1.25.4:2.99", when="^python@3.10:")
+
+        # For legacy Python versions, stick to the 1.x branch
+        depends_on("py-urllib3@1.25.4:1.26", when="^python@:3.9")
 
     variant("examples", default=True, description="Install code examples")
+    variant("autocomplete", default=True, description="Build the AWS CLI shell-completion index")
+
+    def setup_build_environment(self, env: EnvironmentModifications) -> None:
+        if "~autocomplete" in self.spec:
+            env.set("AWSCLI_SKIP_AUTOCOMPLETE_INDEX", "1")
 
     @run_after("install", when="~examples")
     def post_install(self):
diff --git a/repos/spack_repo/builtin/packages/awscli_v2/skip-autocomplete-index.patch b/repos/spack_repo/builtin/packages/awscli_v2/skip-autocomplete-index.patch
new file mode 100644
index 00000000000..801945adde5
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/awscli_v2/skip-autocomplete-index.patch
@@ -0,0 +1,11 @@
+--- a/backends/pep517.py
++++ b/backends/pep517.py
+@@ -188,6 +188,7 @@ def _rewrite_shebang(path):
+ 
+ def _inject_wheel_extras(whl_path):
+     with _extracted_wheel_dir(whl_path) as extracted_wheel_dir:
+-        _build_and_inject_ac_index(BUILD_DIR, extracted_wheel_dir)
++        if os.environ.get("AWSCLI_SKIP_AUTOCOMPLETE_INDEX") != "1":
++            _build_and_inject_ac_index(BUILD_DIR, extracted_wheel_dir)
+         _inject_scripts(extracted_wheel_dir)
+ 
diff --git a/repos/spack_repo/builtin/packages/bufr/package.py b/repos/spack_repo/builtin/packages/bufr/package.py
index f6d5ba68e56..da53b21be19 100644
--- a/repos/spack_repo/builtin/packages/bufr/package.py
+++ b/repos/spack_repo/builtin/packages/bufr/package.py
@@ -89,9 +89,21 @@ def url_for_version(self, version):
 
     # Need to make the lines shorter at least on some systems
     def patch(self):
-        with when("@:11.7.1"):
+        if self.spec.satisfies("@:11.7.1"):
             filter_file("_lenslmax 120", "_lenslmax 60", "CMakeLists.txt")
 
+        # NumPy f2py uses Meson on Python 3.12 and newer. Direct its
+        # temporary build directory to CMake's already-created binary tree,
+        # rather than the potentially noexec /tmp default.
+        if self.spec.satisfies("+python ^python@3.12:"):
+            filter_file(
+                '-c "${CMAKE_CURRENT_SOURCE_DIR}/_bufrlib.pyf"',
+                '-c "${CMAKE_CURRENT_SOURCE_DIR}/_bufrlib.pyf"\n'
+                '                   --build-dir "${CMAKE_CURRENT_BINARY_DIR}/f2py-build"',
+                "python/CMakeLists.txt",
+                string=True,
+            )
+
     def cmake_args(self):
         args = [
             self.define_from_variant("ENABLE_PYTHON", "python"),
diff --git a/repos/spack_repo/builtin/packages/ecbuild/package.py b/repos/spack_repo/builtin/packages/ecbuild/package.py
index 11bab7c3cf4..a660eeb5302 100644
--- a/repos/spack_repo/builtin/packages/ecbuild/package.py
+++ b/repos/spack_repo/builtin/packages/ecbuild/package.py
@@ -19,6 +19,7 @@ class Ecbuild(CMakePackage):
 
     license("Apache-2.0")
 
+    version("3.15.2", sha256="00abca4018a51a712500130cb3d19edc8dc637cdb7fa0e77d2e2b64caea9c5bf")
     version("3.13.1", sha256="9759815aef22c9154589ea025056db086c575af9dac635614b561ab825f9477e")
     version("3.13.0", sha256="7be83510e7209c61273121bcf817780597c3afa41a5129bfccc281f0df1ffda1")
     version("3.12.0", sha256="70c7fc9b17f736a3312167c2c36d13b3b5833a255fe2b168b2886ad7c743ffdf")
diff --git a/repos/spack_repo/builtin/packages/ecflow/package.py b/repos/spack_repo/builtin/packages/ecflow/package.py
index 158a927ccaf..61ddea6c9af 100644
--- a/repos/spack_repo/builtin/packages/ecflow/package.py
+++ b/repos/spack_repo/builtin/packages/ecflow/package.py
@@ -52,7 +52,7 @@ class Ecflow(CMakePackage):
     depends_on("py-numpy", type="build")
     depends_on("py-pip", type="build")
     # ecFlow 5.18+ configures its Python bindings with pybind11.
-    depends_on("py-pybind11@2.10.3:2", type=("build", "link"), when="@5.18:")
+    depends_on("py-pybind11@2.10.3:", type=("build", "link"), when="@5.18:")
 
     # v4: Boost-1.7X release not working well on serialization
     depends_on("boost@1.53:1.69+python", when="@:4")
diff --git a/repos/spack_repo/builtin/packages/ectrans/package.py b/repos/spack_repo/builtin/packages/ectrans/package.py
index 0a5ffbf82e7..d712b4af728 100644
--- a/repos/spack_repo/builtin/packages/ectrans/package.py
+++ b/repos/spack_repo/builtin/packages/ectrans/package.py
@@ -51,6 +51,11 @@ class Ectrans(CMakePackage):
 
     variant("mkl", default=False, description="Use MKL")
     variant("fftw", default=True, description="Use FFTW")
+    variant(
+        "trust_ecbuild_flags",
+        default=False,
+        description="Skip ecbuild compiler-flag probes",
+    )
 
     variant(
         "etrans",
@@ -108,4 +113,6 @@ def cmake_args(self):
             # https://github.com/JCSDA/spack-stack/issues/1522
             "-DECTRANS_HAVE_CONTIGUOUS_ISSUE=ON",
         ]
+        if "+trust_ecbuild_flags" in self.spec:
+            args.append(self.define("ECBUILD_TRUST_FLAGS", True))
         return args
diff --git a/repos/spack_repo/builtin/packages/fms/cmake-build-tests-option-2026.01.01.patch b/repos/spack_repo/builtin/packages/fms/cmake-build-tests-option-2026.01.01.patch
new file mode 100644
index 00000000000..543332082b6
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/fms/cmake-build-tests-option-2026.01.01.patch
@@ -0,0 +1,25 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -56,6 +56,7 @@ option(64BIT       "Build 64-bit (r8) FMS library"        OFF)
+ option(FPIC        "Build with position independent code" OFF)
+ option(SHARED_LIBS "Build shared/dynamic libraries"       OFF)
+ option(OPENACC     "Build FMS with OpenACC support"       OFF)
++option(UNIT_TESTS  "Build FMS tests"                      OFF)
+ 
+ # Options for compiler definitions
+ option(INTERNAL_FILE_NML     "Enable compiler definition -DINTERNAL_FILE_NML"      ON)
+@@ -584,6 +585,7 @@ install(
+   ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR})
+ 
+ ### Unit Testing
++if(UNIT_TESTS)
+ include(CTest)
+ 
+ # TODO autotools also checks if srun is available
+@@ -1004,6 +1006,7 @@ set(CMAKE_CTEST_ARGUMENTS "--output-on-failure")
+ 
+ set(CMAKE_CTEST_ARGUMENTS "--output-on-failure")
+ 
++endif()
+ ### Package config
+ include(CMakePackageConfigHelpers)
diff --git a/repos/spack_repo/builtin/packages/fms/package.py b/repos/spack_repo/builtin/packages/fms/package.py
index 00c9b0bc4fe..2fae0fa805c 100644
--- a/repos/spack_repo/builtin/packages/fms/package.py
+++ b/repos/spack_repo/builtin/packages/fms/package.py
@@ -88,6 +88,11 @@ class Fms(CMakePackage):
         sha256="eb043f992942224e3f8fc8dae22f4e53294ecadad83dd80a031c3d4465b7e4b8",
         when="@=2026.01",
     )
+    patch(
+        "cmake-build-tests-option-2026.01.01.patch",
+        sha256="948342aceb3befcbbe5d4edc755a0d34ea5a7181052ac46b40f5429dcfbc09e",
+        when="@=2026.01.01",
+    )
 
     # https://github.com/NOAA-GFDL/FMS/issues/1417
     patch(
diff --git a/repos/spack_repo/builtin/packages/harfbuzz/package.py b/repos/spack_repo/builtin/packages/harfbuzz/package.py
index 3646f01e4fe..87dcb0cfd09 100644
--- a/repos/spack_repo/builtin/packages/harfbuzz/package.py
+++ b/repos/spack_repo/builtin/packages/harfbuzz/package.py
@@ -114,6 +114,12 @@ class Harfbuzz(MesonPackage, AutotoolsPackage, CMakePackage):
     for plat in ["linux", "darwin", "freebsd"]:
         with when(f"platform={plat}"):
             variant("gobject", default=False, description="Enable GObject introspection")
+            variant(
+                "introspection",
+                default=True,
+                when="build_system=meson +gobject",
+                description="Generate GObject introspection metadata",
+            )
             variant(
                 "utils",
                 default=False,
@@ -168,7 +174,7 @@ class MesonBuilder(meson.MesonBuilder, SetupEnvironment):
     def meson_args(self):
         graphite2 = "enabled" if self.pkg.spec.satisfies("+graphite2") else "disabled"
         coretext = "enabled" if self.pkg.spec.satisfies("+coretext") else "disabled"
-        introspection = "enabled" if self.pkg.spec.satisfies("+gobject") else "disabled"
+        introspection = "enabled" if self.pkg.spec.satisfies("+introspection") else "disabled"
         config_args = [
             # disable building of gtk-doc files following #9885 and #9771
             "-Ddocs=disabled",
diff --git a/repos/spack_repo/builtin/packages/hdf/package.py b/repos/spack_repo/builtin/packages/hdf/package.py
index cf253c1b32f..26e47242dcf 100644
--- a/repos/spack_repo/builtin/packages/hdf/package.py
+++ b/repos/spack_repo/builtin/packages/hdf/package.py
@@ -172,6 +172,9 @@ def flag_handler(self, name, flags):
             ):
                 flags.append("-Wno-error=implicit-int")
 
+            if self.spec.satisfies("%gcc@15:"):
+                flags.append("-std=gnu17")
+
         return flags, None, None
 
     def configure_args(self):
diff --git a/repos/spack_repo/builtin/packages/hdf5/nag_hl_fortran_mpi_module.patch b/repos/spack_repo/builtin/packages/hdf5/nag_hl_fortran_mpi_module.patch
new file mode 100644
index 00000000000..5b8e51a1851
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/hdf5/nag_hl_fortran_mpi_module.patch
@@ -0,0 +1,18 @@
+--- a/hl/fortran/src/CMakeLists.txt
++++ b/hl/fortran/src/CMakeLists.txt
+@@ -211,6 +211,6 @@
+ if (BUILD_STATIC_LIBS)
+   add_library (${HDF5_HL_F90_LIB_TARGET} STATIC ${HDF5_HL_F90_F_SOURCES})
+   target_include_directories (${HDF5_HL_F90_LIB_TARGET}
+-      PRIVATE "${HDF5_F90_BINARY_DIR};${CMAKE_Fortran_MODULE_DIRECTORY}/static;$<$<BOOL:${HDF5_ENABLE_PARALLEL}>:${MPI_Fortran_INCLUDE_DIRS}>"
++      PRIVATE "${HDF5_F90_BINARY_DIR};${CMAKE_Fortran_MODULE_DIRECTORY}/static;${MPI_Fortran_MODULE_DIR};$<$<BOOL:${HDF5_ENABLE_PARALLEL}>:${MPI_Fortran_INCLUDE_DIRS}>"
+       INTERFACE "$<INSTALL_INTERFACE:$<INSTALL_PREFIX>/${HDF5_INSTALL_MODULE_DIR}/static>"
+   )
+@@ -245,6 +245,6 @@
+   endif()
+   add_library (${HDF5_HL_F90_LIBSH_TARGET} SHARED ${DLLDEF} ${HDF5_HL_F90_F_SOURCES_SHARED})
+   target_include_directories (${HDF5_HL_F90_LIBSH_TARGET}
+-      PRIVATE "${HDF5_F90_BINARY_DIR};${CMAKE_Fortran_MODULE_DIRECTORY}/shared;$<$<BOOL:${HDF5_ENABLE_PARALLEL}>:${MPI_Fortran_INCLUDE_DIRS}>"
++      PRIVATE "${HDF5_F90_BINARY_DIR};${CMAKE_Fortran_MODULE_DIRECTORY}/shared;${MPI_Fortran_MODULE_DIR};$<$<BOOL:${HDF5_ENABLE_PARALLEL}>:${MPI_Fortran_INCLUDE_DIRS}>"
+       INTERFACE "$<INSTALL_INTERFACE:$<INSTALL_PREFIX>/${HDF5_INSTALL_MODULE_DIR}/shared>"
+   )
diff --git a/repos/spack_repo/builtin/packages/hdf5/nag_linux_threads.patch b/repos/spack_repo/builtin/packages/hdf5/nag_linux_threads.patch
new file mode 100644
index 00000000000..71376210d7d
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/hdf5/nag_linux_threads.patch
@@ -0,0 +1,108 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -839,12 +839,13 @@
+ if (H5_HAVE_PARALLEL)
+   list (APPEND LINK_PUB_LIBS MPI::MPI_C)
+   if (MPI_C_LINK_FLAGS)
+-    set (CMAKE_EXE_LINKER_FLAGS "${MPI_C_LINK_FLAGS} ${CMAKE_EXE_LINKER_FLAGS}")
++    # Do not add the MPI wrapper's bare -pthread flag to NAG's
++    # initial Fortran compiler test. MPI::MPI_C supplies the C link data.
+   endif ()
+ endif ()
+ 
+ # Determine if a threading package is available on this system
+ set (THREADS_PREFER_PTHREAD_FLAG ON)
+ find_package (Threads)
+ if (Threads_FOUND)
+   set (H5_HAVE_THREADS 1)
+--- a/config/HDFUseFortran.cmake
++++ b/config/HDFUseFortran.cmake
+@@ -31,27 +31,29 @@
+ #-----------------------------------------------------------------------------
+ # Detects Fortran/C name mangling convention used between Fortran and C using FortranCInterface
+ #-----------------------------------------------------------------------------
+-include (FortranCInterface)
++if (NOT CMAKE_Fortran_COMPILER_ID MATCHES "NAG")
++  include (FortranCInterface)
+ 
+-#-----------------------------------------------------------------------------
+-# Verifies Fortran and C/C++ compiler interoperability
+-#-----------------------------------------------------------------------------
+-FortranCInterface_VERIFY()
++  #-----------------------------------------------------------------------------
++  # Verifies Fortran and C/C++ compiler interoperability
++  #-----------------------------------------------------------------------------
++  FortranCInterface_VERIFY()
+ 
+-# Sets macros for Fortran name mangling (H5_FC_FUNC, H5_FC_FUNC_)
+-FortranCInterface_HEADER (
+-    ${CMAKE_BINARY_DIR}/FCMangle.h
+-    MACRO_NAMESPACE "H5_FC_"
+-    SYMBOL_NAMESPACE "H5_FC_"
+-)
++  # Sets macros for Fortran name mangling (H5_FC_FUNC, H5_FC_FUNC_)
++  FortranCInterface_HEADER (
++      ${CMAKE_BINARY_DIR}/FCMangle.h
++      MACRO_NAMESPACE "H5_FC_"
++      SYMBOL_NAMESPACE "H5_FC_"
++  )
+ 
+-file (STRINGS ${CMAKE_BINARY_DIR}/FCMangle.h CONTENTS REGEX "H5_FC_GLOBAL\\(.*,.*\\) +(.*)")
+-string (REGEX MATCH "H5_FC_GLOBAL\\(.*,.*\\) +(.*)" RESULT  ${CONTENTS})
+-set (H5_FC_FUNC "H5_FC_FUNC(name,NAME) ${CMAKE_MATCH_1}" CACHE INTERNAL "Fortran name mangling macro for C identifiers without underscores")
++  file (STRINGS ${CMAKE_BINARY_DIR}/FCMangle.h CONTENTS REGEX "H5_FC_GLOBAL\\(.*,.*\\) +(.*)")
++  string (REGEX MATCH "H5_FC_GLOBAL\\(.*,.*\\) +(.*)" RESULT  ${CONTENTS})
++  set (H5_FC_FUNC "H5_FC_FUNC(name,NAME) ${CMAKE_MATCH_1}" CACHE INTERNAL "Fortran name mangling macro for C identifiers without underscores")
+ 
+-file (STRINGS ${CMAKE_BINARY_DIR}/FCMangle.h CONTENTS REGEX "H5_FC_GLOBAL_\\(.*,.*\\) +(.*)")
+-string (REGEX MATCH "H5_FC_GLOBAL_\\(.*,.*\\) +(.*)" RESULT  ${CONTENTS})
+-set (H5_FC_FUNC_ "H5_FC_FUNC_(name,NAME) ${CMAKE_MATCH_1}" CACHE INTERNAL "Fortran name mangling macro for C identifiers with underscores")
++  file (STRINGS ${CMAKE_BINARY_DIR}/FCMangle.h CONTENTS REGEX "H5_FC_GLOBAL_\\(.*,.*\\) +(.*)")
++  string (REGEX MATCH "H5_FC_GLOBAL_\\(.*,.*\\) +(.*)" RESULT  ${CONTENTS})
++  set (H5_FC_FUNC_ "H5_FC_FUNC_(name,NAME) ${CMAKE_MATCH_1}" CACHE INTERNAL "Fortran name mangling macro for C identifiers with underscores")
++endif ()
+ 
+ # READ_SOURCE macro to extract Fortran code blocks for tests
+ # Read source line beginning at the line matching Input:"START" and ending at the line matching Input:"END"
+--- a/fortran/CMakeLists.txt
++++ b/fortran/CMakeLists.txt
+@@ -15,7 +15,25 @@
++  if (CMAKE_Fortran_COMPILER_ID STREQUAL "NAG")
++    # HDF5 copies Threads::Threads into LINK_Fortran_LIBS.
++    set_property (TARGET Threads::Threads PROPERTY INTERFACE_COMPILE_OPTIONS "")
++    set_property (TARGET Threads::Threads PROPERTY INTERFACE_LINK_LIBRARIES "-lpthread")
++  endif ()
+   find_package(MPI REQUIRED COMPONENTS Fortran)
++  if (CMAKE_Fortran_COMPILER_ID STREQUAL "NAG")
++    # MPI::MPI_C is carried by HDF5's C library and otherwise propagates its
++    # bare -pthread compile option to HDF5 Fortran targets.  NAG accepts the
++    # pthread library, not the compiler-driver option.
++    string (REPLACE "-pthread" "-lpthread" H5_MPI_C_LINK_FLAGS "${MPI_C_LINK_FLAGS}")
++    set_property (TARGET MPI::MPI_C PROPERTY INTERFACE_COMPILE_OPTIONS "")
++    set_property (TARGET MPI::MPI_C PROPERTY INTERFACE_LINK_OPTIONS "${H5_MPI_C_LINK_FLAGS}")
++  endif ()
+   set (LINK_Fortran_LIBS ${LINK_Fortran_LIBS} ${MPI_Fortran_LIBRARIES})
+   if (MPI_Fortran_LINK_FLAGS)
+-    set (CMAKE_Fortran_EXE_LINKER_FLAGS "${MPI_Fortran_LINK_FLAGS} ${CMAKE_EXE_LINKER_FLAGS}")
++    if (CMAKE_Fortran_COMPILER_ID MATCHES "NAG")
++      string (REPLACE "-pthread" "-Wl,-pthread" H5_MPI_FORTRAN_LINK_FLAGS "${MPI_Fortran_LINK_FLAGS}")
++      set (CMAKE_Fortran_EXE_LINKER_FLAGS "${H5_MPI_FORTRAN_LINK_FLAGS} ${CMAKE_EXE_LINKER_FLAGS}")
++    else ()
++      set (CMAKE_Fortran_EXE_LINKER_FLAGS "${MPI_Fortran_LINK_FLAGS} ${CMAKE_EXE_LINKER_FLAGS}")
++    endif ()
+   endif ()
+   # Check if MPI-3 Fortran 2008 module mpi_f08 is supported
+   if (MPI_Fortran_HAVE_F08_MODULE)
+@@ -39,7 +57,12 @@
+ 
+ if (H5_HAVE_PARALLEL)
+   if (MPI_Fortran_LINK_FLAGS)
+-    set (CMAKE_EXE_LINKER_FLAGS "${MPI_Fortran_LINK_FLAGS} ${CMAKE_EXE_LINKER_FLAGS}")
++    if (CMAKE_Fortran_COMPILER_ID MATCHES "NAG")
++      string (REPLACE "-pthread" "-Wl,-pthread" H5_MPI_FORTRAN_LINK_FLAGS "${MPI_Fortran_LINK_FLAGS}")
++      set (CMAKE_EXE_LINKER_FLAGS "${H5_MPI_FORTRAN_LINK_FLAGS} ${CMAKE_EXE_LINKER_FLAGS}")
++    else ()
++      set (CMAKE_EXE_LINKER_FLAGS "${MPI_Fortran_LINK_FLAGS} ${CMAKE_EXE_LINKER_FLAGS}")
++    endif ()
+   endif ()
+ endif ()
diff --git a/repos/spack_repo/builtin/packages/hdf5/package.py b/repos/spack_repo/builtin/packages/hdf5/package.py
index 459d4b99918..fec945bcb8b 100644
--- a/repos/spack_repo/builtin/packages/hdf5/package.py
+++ b/repos/spack_repo/builtin/packages/hdf5/package.py
@@ -255,6 +255,14 @@ class Hdf5(CMakePackage):
     # Fix Apple linker flags (-current_version and -compatibility_version) when building with NAG compiler
     patch("nag_macos_linker.patch", when="@1.12.0:1.14.99 %nag platform=darwin")
 
+    # CMake's preferred pthread compiler flag is not accepted by NAG on Linux.
+    # Use the pthread linker library instead.
+    patch("nag_linux_threads.patch", when="@2.1.0 %nag platform=linux")
+
+    # OpenMPI with NAG installs mpi.mod in its library directory, which HDF5's
+    # high-level Fortran targets do not otherwise include.
+    patch("nag_hl_fortran_mpi_module.patch", when="@2.1.0 %nag platform=linux")
+
     # There are known build failures with intel@18.0.1. This issue is
     # discussed and patch is provided at
     # https://software.intel.com/en-us/forums/intel-fortran-compiler-for-linux-and-mac-os-x/topic/747951.
@@ -629,6 +637,10 @@ def cmake_args(self):
         if spec.satisfies("@1.14.4: %aocc"):
             args.append(self.define("HDF5_ENABLE_NONSTANDARD_FEATURE_FLOAT16", False))
 
+        if spec.satisfies("%nag"):
+            # NAG cannot pass Spack's padded build rpath through its linker.
+            args.append(self.define("CMAKE_SKIP_RPATH", True))
+
         return args
 
     @run_after("install")
diff --git a/repos/spack_repo/builtin/packages/ncview/package.py b/repos/spack_repo/builtin/packages/ncview/package.py
index ce75cdcd0f2..806a8919764 100644
--- a/repos/spack_repo/builtin/packages/ncview/package.py
+++ b/repos/spack_repo/builtin/packages/ncview/package.py
@@ -40,6 +40,13 @@ def configure_args(self):
 
         return config_args
 
+    def flag_handler(self, name, flags):
+        # The package does not build with C dialects newer than gnu17, so set gnu17
+        # for GCC 15 and newer which default to gnu23
+        if name == "cflags" and self.spec.satisfies("%gcc@15:"):
+            flags.append("-std=gnu17")
+        return (flags, None, None)
+
     def patch(self):
         # Disable the netcdf-c compiler check, save and restore the
         # modification timestamp of the file to prevent autoreconf.
diff --git a/repos/spack_repo/builtin/packages/nvtx/package.py b/repos/spack_repo/builtin/packages/nvtx/package.py
index eeb83536a4f..b2ea8952987 100644
--- a/repos/spack_repo/builtin/packages/nvtx/package.py
+++ b/repos/spack_repo/builtin/packages/nvtx/package.py
@@ -46,6 +46,11 @@ def patch(self):
         setup = FileFilter("python/setup.py")
         setup.filter("include_dirs=include_dirs", f"include_dirs=['{include_dir}']", string=True)
 
+    def flag_handler(self, name, flags):
+        if name == "cflags" and self.spec.satisfies("@3.2: %gcc@15:"):
+            flags.append("-std=gnu17")
+        return (flags, None, None)
+
     def install(self, spec, prefix):
         install_tree("c/include", prefix.include)
         install("c/CMakeLists.txt", prefix)
diff --git a/repos/spack_repo/builtin/packages/openblas/package.py b/repos/spack_repo/builtin/packages/openblas/package.py
index 1559d2c1040..4578b5c683b 100644
--- a/repos/spack_repo/builtin/packages/openblas/package.py
+++ b/repos/spack_repo/builtin/packages/openblas/package.py
@@ -688,6 +688,13 @@ def cmake_args(self):
             self.define("CMAKE_POLICY_DEFAULT_CMP0042", "NEW"),
         ]
 
+        # On macOS the cmake build sets the dylib install name to the build-stage
+        # path instead of the install prefix, causing downstream packages (e.g.
+        # py-numpy) to embed a broken rpath.  Setting CMAKE_INSTALL_NAME_DIR fixes
+        # the install name to the real installed lib directory.
+        if self.spec.satisfies("platform=darwin"):
+            cmake_defs += [self.define("CMAKE_INSTALL_NAME_DIR", self.spec.prefix.lib)]
+
         if self.spec.satisfies("+dynamic_dispatch"):
             cmake_defs += [self.define("DYNAMIC_ARCH", "ON")]
         if self.spec.satisfies("platform=windows"):
diff --git a/repos/spack_repo/builtin/packages/parallelio/package.py b/repos/spack_repo/builtin/packages/parallelio/package.py
index 21824c1c935..4d0ffd0d0d9 100644
--- a/repos/spack_repo/builtin/packages/parallelio/package.py
+++ b/repos/spack_repo/builtin/packages/parallelio/package.py
@@ -105,6 +105,9 @@ def cmake_args(self):
             define("PIO_ENABLE_EXAMPLES", False),
             define_from_variant("WITH_PNETCDF", "pnetcdf"),
         ]
+        if spec.satisfies("%nag"):
+            # NAG cannot pass Spack's padded build rpath through its linker.
+            args.append(define("CMAKE_SKIP_RPATH", True))
         if spec.satisfies("+ncint"):
             args.extend([define("PIO_ENABLE_NETCDF_INTEGRATION", True)])
         if spec.satisfies("+pnetcdf"):
diff --git a/repos/spack_repo/builtin/packages/py_awscrt/package.py b/repos/spack_repo/builtin/packages/py_awscrt/package.py
index f0436c52c65..1ec851153c1 100644
--- a/repos/spack_repo/builtin/packages/py_awscrt/package.py
+++ b/repos/spack_repo/builtin/packages/py_awscrt/package.py
@@ -17,6 +17,7 @@ class PyAwscrt(PythonPackage):
 
     license("Apache-2.0")
 
+    version("0.35.0", sha256="761ae0dda17fd9dfaff4bbb2a376e28e44dfd77dc6410b7bc408297a1fd5600e")
     version("0.31.2", sha256="552555de1beff02d72a1f6d384cd49c5a7c283418310eae29d21bcb749c65792")
     version("0.29.2", sha256="c78d81b1308d42fda1eb21d27fcf26579137b821043e528550f2cfc6c09ab9ff")
     version("0.20.9", sha256="243785ac9ee64945e0479c2384325545f29597575743ce84c371556d1014e63e")
diff --git a/repos/spack_repo/builtin/packages/py_cachetools/package.py b/repos/spack_repo/builtin/packages/py_cachetools/package.py
index 23a13ed2030..bf919ee32f6 100644
--- a/repos/spack_repo/builtin/packages/py_cachetools/package.py
+++ b/repos/spack_repo/builtin/packages/py_cachetools/package.py
@@ -32,6 +32,7 @@ class PyCachetools(PythonPackage):
         depends_on("python@3.9:3", when="@6:")
 
     with default_args(type="build"):
-        depends_on("py-setuptools")
+        depends_on("py-setuptools@77:", when="@7.1.1:")
+        depends_on("py-setuptools@61:", when="@6.2.3:")
         depends_on("py-setuptools@46.4.0:", when="@4.2.2:")
-        depends_on("py-setuptools@61.0.0:", when="@6.2.3:")
+        depends_on("py-setuptools")
diff --git a/repos/spack_repo/builtin/packages/py_dask/package.py b/repos/spack_repo/builtin/packages/py_dask/package.py
index 8b6ce0599e0..54106a9a691 100644
--- a/repos/spack_repo/builtin/packages/py_dask/package.py
+++ b/repos/spack_repo/builtin/packages/py_dask/package.py
@@ -19,6 +19,7 @@ class PyDask(PythonPackage):
 
     version("2026.3.0", sha256="f7d96c8274e8a900d217c1ff6ea8d1bbf0b4c2c21e74a409644498d925eb8f85")
     version("2025.7.0", sha256="c3a0d4e78882e85ea81dbc71e6459713e45676e2d17e776c2f3f19848039e4cf")
+    version("2025.5.0", sha256="3ec9175e53effe1c2b0086668352e0d5261c5ef6f71a410264eda83659d686ef")
     version("2025.3.0", sha256="322834f44ebc24abeb564c56ccb817c97d6e7af6be71ad0ad96b78b51f2e0e85")
     version("2024.12.1", sha256="bac809af21c2dd7eb06827bccbfc612504f3ee6435580e548af912828f823195")
     version("2024.7.1", sha256="dbaef2d50efee841a9d981a218cfeb50392fc9a95e0403b6d680450e4f50d531")
@@ -26,9 +27,6 @@ class PyDask(PythonPackage):
     version("2022.10.2", sha256="42cb43f601709575fa46ce09e74bea83fdd464187024f56954e09d9b428ceaab")
     version("2021.6.2", sha256="8588fcd1a42224b7cfcd2ebc8ad616734abb6b1a4517efd52d89c7dd66eb91f8")
     version("2021.4.1", sha256="195e4eeb154222ea7a1c368119b5f321ee4ec9d78531471fe0145a527f744aa8")
-    version("2021.3.1", sha256="1fa7e1809e7c50c5505297b03e6ee161e0695df73b4c4051b5b1c8fd670bf5d7")
-    version("2021.3.0", sha256="566054b493d63c15732f2a640382b21e861571d61639f59341bc7695a9be138e")
-    version("2021.2.0", sha256="e7054b8d685205e95c789900ae87d6174550180cbe38a3cb1142e10c73004c22")
     version("2020.12.0", sha256="43e745afd4b464e6c0113131e430a16dce6ac42460b06e24d799093d098f7ab0")
 
     variant("array", default=True, description="Install requirements for dask.array")
@@ -58,8 +56,6 @@ class PyDask(PythonPackage):
         depends_on("py-versioneer@0.29+toml", when="@2023.10.1:2025.11.0")
         depends_on("py-versioneer@0.28+toml", when="@2023.4.1:2023.10.0")
 
-        depends_on("py-packaging@20:", when="@2022.10.2:")
-
     with default_args(type=("build", "run")):
         # python@3.14 breaks py-dask@:2025.7.0
         depends_on("python@:3.13", when="@:2025.12")
@@ -85,8 +81,8 @@ class PyDask(PythonPackage):
         depends_on("py-partd@1.2.0:", when="@2023.4.0:")
         depends_on("py-partd@0.3.10:", when="@2021.3.1:")
 
-        depends_on("py-pyyaml")
         depends_on("py-pyyaml@5.3.1:", when="@2022.10.2:")
+        depends_on("py-pyyaml")
 
         depends_on("py-toolz@0.12.0:", when="@2026.3.0:")
         depends_on("py-toolz@0.10.0:", when="@2023.4.1:")
diff --git a/repos/spack_repo/builtin/packages/py_h5py/package.py b/repos/spack_repo/builtin/packages/py_h5py/package.py
index 8b47149d036..6e783e3233a 100644
--- a/repos/spack_repo/builtin/packages/py_h5py/package.py
+++ b/repos/spack_repo/builtin/packages/py_h5py/package.py
@@ -92,7 +92,8 @@ class PyH5py(PythonPackage):
     # Link dependencies (py-h5py v2 cannot build against HDF5 1.12 regardless
     # of API setting)
     # version constraints from https://github.com/h5py/h5py/tree/master/docs/whatsnew
-    depends_on("hdf5@1.10.7:1.14 +hl", when="@3.15:")
+    depends_on("hdf5@1.10.7: +hl", when="@3.16:")
+    depends_on("hdf5@1.10.7:1.14 +hl", when="@3.15")
     depends_on("hdf5@1.10.6:1.14 +hl", when="@3.12:3.14")
     depends_on("hdf5@1.10.4:1.14 +hl", when="@3.10:3.11")
     depends_on("hdf5@1.8.4:1.14 +hl", when="@3.8:3.9")
diff --git a/repos/spack_repo/builtin/packages/py_llvmlite/package.py b/repos/spack_repo/builtin/packages/py_llvmlite/package.py
index a2f5dcdf468..dc8271b85b0 100644
--- a/repos/spack_repo/builtin/packages/py_llvmlite/package.py
+++ b/repos/spack_repo/builtin/packages/py_llvmlite/package.py
@@ -14,8 +14,11 @@ class PyLlvmlite(PythonPackage):
     pypi = "llvmlite/llvmlite-0.23.0.tar.gz"
     git = "https://github.com/numba/llvmlite.git"
 
+    maintainers("mathomp4")
+
     license("BSD-2-Clause")
 
+    version("0.48.0", sha256="543b19f9ef8f3c7c60d1468191e4ee1b1537bf9f8a3d56f64c0ddd98de92edd2")
     version("0.47.0", sha256="62031ce968ec74e95092184d4b0e857e444f8fdff0b8f9213707699570c33ccc")
     version("0.46.0", sha256="227c9fd6d09dce2783c18b754b7cd9d9b3b3515210c46acc2d3c5badd9870ceb")
     version("0.45.1", sha256="09430bb9d0bb58fc45a45a57c7eae912850bedc095cd0810a57de109c69e1c32")
@@ -57,7 +60,8 @@ class PyLlvmlite(PythonPackage):
         depends_on("python@:3.9", when="@0.36:0.37")
 
     # https://github.com/numba/llvmlite#compatibility
-    depends_on("llvm@20", when="@0.45:")
+    depends_on("llvm@22", when="@0.48:")
+    depends_on("llvm@20", when="@0.45:0.47")
     depends_on("llvm@15:16", when="@0.44")
     depends_on("llvm@14", when="@0.41:0.43")
     depends_on("llvm@11:14", when="@0.40")
diff --git a/repos/spack_repo/builtin/packages/py_numba/package.py b/repos/spack_repo/builtin/packages/py_numba/package.py
index 52e673a40b0..dbda92a926b 100644
--- a/repos/spack_repo/builtin/packages/py_numba/package.py
+++ b/repos/spack_repo/builtin/packages/py_numba/package.py
@@ -20,8 +20,11 @@ class PyNumba(PythonPackage):
 
     skip_modules = ["numba.core.rvsdg_frontend"]
 
+    maintainers("mathomp4")
+
     license("BSD-2-Clause")
 
+    version("0.66.0", sha256="b900e63a0e26c05ea9a6d5a3a5a0a177cb64c5011887bf43edb8c3ed2c38d363")
     version("0.65.1", sha256="19357146c32fe9ed25059ab915e8465fb13951cf6b0aace3826b76886373ab23")
     version("0.64.0", sha256="95e7300af648baa3308127b1955b52ce6d11889d16e8cfe637b4f85d2fca52b1")
     version("0.63.0", sha256="27e525ce6f9f727c4f61e89b9d453d4a7d0aabbbf110278988334f43cbd70fdc")
@@ -76,6 +79,7 @@ class PyNumba(PythonPackage):
         depends_on("py-numpy@1.18:1.21", when="@0.55.0:0.55.1")
         depends_on("py-numpy@1.17:1.20", when="@0.54")
 
+        depends_on("py-llvmlite@0.48", when="@0.66")
         depends_on("py-llvmlite@0.47", when="@0.65")
         depends_on("py-llvmlite@0.46", when="@0.63,0.64")
         depends_on("py-llvmlite@0.45", when="@0.62")
diff --git a/repos/spack_repo/builtin/packages/py_pandas_datareader/package.py b/repos/spack_repo/builtin/packages/py_pandas_datareader/package.py
index afdc5cdf0f1..3dc1355ea46 100644
--- a/repos/spack_repo/builtin/packages/py_pandas_datareader/package.py
+++ b/repos/spack_repo/builtin/packages/py_pandas_datareader/package.py
@@ -11,20 +11,36 @@ class PyPandasDatareader(PythonPackage):
     """Up-to-date remote data access for pandas. Works for multiple versions of pandas"""
 
     homepage = "https://pypi.org/project/pandas-datareader"
-    pypi = "pandas-datareader/pandas-datareader-0.10.0.tar.gz"
+    pypi = "pandas-datareader/pandas_datareader-0.11.1.tar.gz"
     git = "https://github.com/pydata/pandas-datareader.git"
 
     maintainers("climbfuji")
 
     license("BSD-3-Clause", checked_by="climbfuji")
 
+    version("0.11.1", sha256="e1eadb6d2ccaa4b7a876a1c81b6ff0307fa7a08b56f7799862a50207c2e65a05")
+    version("0.11.0", sha256="6c86360127f0b4c4451495574e162da058cf6154a185503310df70c417e0e266")
     version("0.10.0", sha256="9fc3c63d39bc0c10c2683f1c6d503ff625020383e38f6cbe14134826b454d5a6")
 
+    def url_for_version(self, version):
+        if isinstance(version, str):
+            version = Version(version)
+
+        if version < Version("0.11.0"):
+            return f"https://files.pythonhosted.org/packages/source/p/pandas-datareader/pandas-datareader-{version}.tar.gz"
+
+        return super().url_for_version(version)
+
+    # Versioneer bundled with 0.10.0 uses APIs removed in Python 3.12.
+    patch("py312-versioneer.patch", when="@0.10.0 ^python@3.12:")
+
     depends_on("python@3.8:", type=("build", "run"))
+    depends_on("python@3.11:", when="@0.11.0:", type=("build", "run"))
     depends_on("py-setuptools@0.64:", type="build")
     depends_on("py-setuptools-scm@8", type="build")
 
     depends_on("py-lxml", type="run")
-    depends_on("py-pandas@1.5.3:", type="run")
-    depends_on("py-statsmodels@0.12:", type="run")
+    depends_on("py-pandas@1.5.3:", when="@0.10.0", type="run")
+    depends_on("py-pandas@2.1.4:", when="@0.11.0:", type="run")
+    depends_on("py-statsmodels@0.12:", when="@0.10.0", type="run")
     depends_on("py-requests@2.19:", type="run")
diff --git a/repos/spack_repo/builtin/packages/py_pandas_datareader/py312-versioneer.patch b/repos/spack_repo/builtin/packages/py_pandas_datareader/py312-versioneer.patch
new file mode 100644
index 00000000000..aee4c185bba
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/py_pandas_datareader/py312-versioneer.patch
@@ -0,0 +1,13 @@
+--- a/versioneer.py
++++ b/versioneer.py
+@@ -344,9 +344,9 @@ def get_config_from_root(root):
+     # the top of versioneer.py for instructions on writing your setup.cfg .
+     setup_cfg = os.path.join(root, "setup.cfg")
+-    parser = configparser.SafeConfigParser()
++    parser = configparser.ConfigParser()
+     with open(setup_cfg, "r") as f:
+-        parser.readfp(f)
++        parser.read_file(f)
+     VCS = parser.get("versioneer", "VCS")  # mandatory
+ 
+     def get(parser, name):
diff --git a/repos/spack_repo/builtin/packages/py_pykdtree/package.py b/repos/spack_repo/builtin/packages/py_pykdtree/package.py
new file mode 100644
index 00000000000..206d47ea1f8
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/py_pykdtree/package.py
@@ -0,0 +1,37 @@
+# Copyright Spack Project Developers. See COPYRIGHT file for details.
+#
+# SPDX-License-Identifier: (Apache-2.0 OR MIT)
+
+from spack_repo.builtin.build_systems.python import PythonPackage
+
+from spack.package import *
+
+
+class PyPykdtree(PythonPackage):
+    """pykdtree is a kd-tree implementation for fast nearest neighbour search in Python."""
+
+    homepage = "https://github.com/storpipfugl/pykdtree"
+    pypi = "pykdtree/pykdtree-1.4.3.tar.gz"
+
+    license("LGPL-2.1-or-later")
+
+    # Add the relevant versions and their SHA-256 checksums from PyPI
+    version("1.4.3", sha256="d9187930ffb8c822c52595b64948b47346694ee2a49e2702420b58f743d786f5")
+
+    # Build system backends
+    depends_on("python@3.9:", type=("build", "run"))
+    depends_on("py-setuptools", type="build")
+    depends_on("py-cython", type="build")
+
+    # Runtime and Link Dependencies
+    depends_on("py-numpy@1.16:", type=("build", "run"))
+    
+    # OpenMP is required for multi-threaded queries
+    depends_on("llvm-openmp", when="%apple-clang", type=("build", "link"))
+
+    def install_options(self, spec, prefix):
+        # Optional: Hand over specific compilation variables if building on macOS 
+        options = []
+        if "%apple-clang" in spec:
+            options.append("--build-option=--use-openmp")
+        return options
diff --git a/repos/spack_repo/builtin/packages/py_pyresample/package.py b/repos/spack_repo/builtin/packages/py_pyresample/package.py
new file mode 100644
index 00000000000..9a288a5719f
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/py_pyresample/package.py
@@ -0,0 +1,64 @@
+# Copyright Spack Project Developers. See COPYRIGHT file for details.
+#
+# SPDX-License-Identifier: (Apache-2.0 OR MIT)
+
+from spack_repo.builtin.build_systems.python import PythonPackage
+
+from spack.package import *
+
+
+class PyPyresample(PythonPackage):
+    """A package for resampling geospatial image data"""
+
+    homepage = "https://github.com/pytroll/pyresample"
+    pypi = "pyresample/pyresample-1.35.0.tar.gz"
+
+    license("LGPL-3.0-or-later")
+
+    version("1.35.0", sha256="95f64734d63632ca642bc7bf4bce057c2ecac60f05fafd73c881bf68403ab5bb")
+    version("1.34.2", sha256="094e959e3e31a547d39ce1a940e5cdb23845a5c458a0fc244f2e4e5135e4f797")
+    version("1.34.1", sha256="6e0e7ccf090bcabf4bfc8818d7ff633741fddf9784fe90b4add86f925b5b72f1")
+    version("1.34.0", sha256="a0cd05327f8015862809da8704e93943890f02194d11d97ede29576f6a6730d4")
+
+    depends_on("py-setuptools", type="build")
+    depends_on("py-setuptools-scm +toml", type="build")
+
+    depends_on("python@3.11:", when="@1.34.0:", type=("build", "run"))
+
+    depends_on("py-configobj", type=("build", "run"))
+    depends_on("py-cython", type=("build", "run"))
+    depends_on("py-donfig", type=("build", "run"))
+    depends_on("py-numexpr", type=("build", "run"))
+    depends_on("py-numpy", type=("build", "run"))
+    depends_on("py-platformdirs", type=("build", "run"))
+    depends_on("py-pykdtree", type=("build", "run"))
+    depends_on("py-pyproj", type=("build", "run"))
+    depends_on("py-pyyaml", type=("build", "run"))
+    depends_on("py-shapely", type=("build", "run"))
+    depends_on("py-versioneer", type=("build", "run"))
+
+    # Optional functionality dependencies
+    depends_on("py-dask", type=("build", "run"))
+    depends_on("py-odc-geo", type=("build", "run"))
+    depends_on("py-rasterio", type=("build", "run"))
+    depends_on("py-scipy", type=("build", "run"))
+    depends_on("py-xarray", type=("build", "run"))
+
+    variant("plotting", default=False, description="Enable plotting functionality")
+    variant("tests", default=False, description="Dependencies to run test suites")
+
+    with when("+plotting"):
+        depends_on("py-cartopy", type=("build", "run"))
+        depends_on("py-matplotlib", type=("build", "run"))
+
+    with when("+tests"):
+        depends_on("py-cartopy", type="test")
+        depends_on("py-dask", type="test")
+        depends_on("py-matplotlib", type="test")
+        depends_on("py-pillow", type="test")
+        depends_on("py-pytest", type="test")
+        depends_on("py-pytest-lazy-fixtures", type="test")
+        depends_on("py-rasterio", type="test")
+        depends_on("py-scipy", type="test")
+        depends_on("py-xarray", type="test")
+        depends_on("py-zarr", type="test")
diff --git a/repos/spack_repo/builtin/packages/py_pytest_lazy_fixtures/package.py b/repos/spack_repo/builtin/packages/py_pytest_lazy_fixtures/package.py
new file mode 100644
index 00000000000..970c3d4c5df
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/py_pytest_lazy_fixtures/package.py
@@ -0,0 +1,28 @@
+# Copyright Spack Project Developers. See COPYRIGHT file for details.
+#
+# SPDX-License-Identifier: (Apache-2.0 OR MIT)
+
+from spack_repo.builtin.build_systems.python import PythonPackage
+
+from spack.package import *
+
+
+class PyPytestLazyFixtures(PythonPackage):
+    """Allows you to use fixtures in @pytest.mark.parametrize."""
+
+    homepage = "https://github.com/dev-petrov/pytest-lazy-fixtures"
+    pypi = "pytest_lazy_fixtures/pytest_lazy_fixtures-1.4.0.tar.gz"
+
+    license("MIT")
+
+    version("1.4.0", sha256="f544b60c96b909b307558a62cc1f28f026f11e9f03d7f583a1dc636de3dbcb10")
+    version("1.3.4", sha256="15e12ec3ca7e2e50efb0e352ef2e3d54ec2f38a1ef084c8a2b5e28a5e1144410")
+
+    # Python version compatibility requirement
+    depends_on("python@3.8:", type=("build", "run"))
+
+    # Build system dependencies (PEP 517 standard via Hatchling)
+    depends_on("py-hatchling", type="build")
+
+    # Runtime dependencies
+    depends_on("py-pytest@7.1:", type=("build", "run"))
diff --git a/repos/spack_repo/builtin/packages/py_scipy/nag_disable_version_script.patch b/repos/spack_repo/builtin/packages/py_scipy/nag_disable_version_script.patch
new file mode 100644
index 00000000000..71bb45802c1
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/py_scipy/nag_disable_version_script.patch
@@ -0,0 +1,5 @@
+--- a/meson.build
++++ b/meson.build
+@@ -168 +168 @@
+-if cc.get_id() != 'clang-cl'
++if cc.get_id() != 'clang-cl' and ff.get_id() != 'nagfor'
diff --git a/repos/spack_repo/builtin/packages/py_scipy/package.py b/repos/spack_repo/builtin/packages/py_scipy/package.py
index 506b82c727a..85594fda918 100644
--- a/repos/spack_repo/builtin/packages/py_scipy/package.py
+++ b/repos/spack_repo/builtin/packages/py_scipy/package.py
@@ -181,9 +181,9 @@ class PyScipy(PythonPackage):
     #         |          ^~~~~~~~~~~
     #   compilation terminated.
     # See also: https://github.com/macports/macports-ports/commit/d45376ea224ffa9184c6a0ecbcbdf024ee447f12
-    patch("use_stdc_no_threads.patch", when="platform=darwin %gcc")
+    patch("use_stdc_no_threads.patch", when="@:1.8 platform=darwin %gcc")
     # Additional changes needed for scipy-1.8.0
-    patch("use_stdc_no_threads_scipy180_addon.patch", when="@1.8: platform=darwin %gcc")
+    patch("use_stdc_no_threads_scipy180_addon.patch", when="@1.8 platform=darwin %gcc")
     # *DH
 
     # https://github.com/scipy/scipy/issues/21884
@@ -193,6 +193,10 @@ class PyScipy(PythonPackage):
         when="@1.8.0:1.14.0",
     )
 
+    # NAG forwards GNU linker flags (e.g. --version-script) to GCC without
+    # the required -Wl, prefix, causing the link step to fail.
+    patch("nag_disable_version_script.patch", when="@1.17:1 %nag")
+
     @property
     def archive_files(self):
         return [join_path(self.stage.source_path, "build", "meson-logs", "meson-log.txt")]
diff --git a/repos/spack_repo/builtin/packages/py_torch/air_gapped_nnpack_cmake.patch b/repos/spack_repo/builtin/packages/py_torch/air_gapped_nnpack_cmake.patch
new file mode 100644
index 00000000000..a1a9f2201d3
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/py_torch/air_gapped_nnpack_cmake.patch
@@ -0,0 +1,26 @@
+diff --git a/cmake/EnvVarForwarding.cmake b/cmake/EnvVarForwarding.cmake
+index a31ce6db266..258d458099e 100644
+--- a/cmake/EnvVarForwarding.cmake
++++ b/cmake/EnvVarForwarding.cmake
+@@ -42,6 +42,7 @@ set(_ENV_PASSTHROUGH
+   TORCH_XPU_ARCH_LIST
+   TRACING_BASED
+   PYTHON_LIB_REL_PATH
++  PYTHON_SIX_SOURCE_DIR
+ )
+ 
+ # Low-priority aliases: if the canonical var is not set, use the alias.
+diff --git a/cmake/External/nnpack.cmake b/cmake/External/nnpack.cmake
+index 8a4a310d629..2491d4e2cc2 100644
+--- a/cmake/External/nnpack.cmake
++++ b/cmake/External/nnpack.cmake
+@@ -46,6 +46,9 @@ if(ANDROID OR IOS OR ${CMAKE_SYSTEM_NAME} STREQUAL "Linux" OR ${CMAKE_SYSTEM_NAM
+ 
+   # Directories for NNPACK dependencies submoduled in Caffe2
+   set(PYTHON_PEACHPY_SOURCE_DIR "${CAFFE2_THIRD_PARTY_ROOT}/python-peachpy" CACHE STRING "PeachPy (Python package) source directory")
++  if(NOT DEFINED PYTHON_SIX_SOURCE_DIR AND DEFINED ENV{PYTHON_SIX_SOURCE_DIR})
++    set(PYTHON_SIX_SOURCE_DIR "$ENV{PYTHON_SIX_SOURCE_DIR}" CACHE STRING "six (Python package) source directory")
++  endif()
+   if(NOT DEFINED CPUINFO_SOURCE_DIR)
+     set(CPUINFO_SOURCE_DIR "${CAFFE2_THIRD_PARTY_ROOT}/cpuinfo" CACHE STRING "cpuinfo source directory")
+   endif()
diff --git a/repos/spack_repo/builtin/packages/py_torch/air_gapped_nnpack_cmake_older.patch b/repos/spack_repo/builtin/packages/py_torch/air_gapped_nnpack_cmake_older.patch
new file mode 100644
index 00000000000..63b7f9ce1d1
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/py_torch/air_gapped_nnpack_cmake_older.patch
@@ -0,0 +1,26 @@
+diff --git a/cmake/External/nnpack.cmake b/cmake/External/nnpack.cmake
+index 8a4a310d629..2491d4e2cc2 100644
+--- a/cmake/External/nnpack.cmake
++++ b/cmake/External/nnpack.cmake
+@@ -46,6 +46,9 @@ if(ANDROID OR IOS OR ${CMAKE_SYSTEM_NAME} STREQUAL "Linux" OR ${CMAKE_SYSTEM_NAM
+
+   # Directories for NNPACK dependencies submoduled in Caffe2
+   set(PYTHON_PEACHPY_SOURCE_DIR "${CAFFE2_THIRD_PARTY_ROOT}/python-peachpy" CACHE STRING "PeachPy (Python package) source directory")
++  if(NOT DEFINED PYTHON_SIX_SOURCE_DIR AND DEFINED ENV{PYTHON_SIX_SOURCE_DIR})
++    set(PYTHON_SIX_SOURCE_DIR "$ENV{PYTHON_SIX_SOURCE_DIR}" CACHE STRING "six (Python package) source directory")
++  endif()
+   if(NOT DEFINED CPUINFO_SOURCE_DIR)
+     set(CPUINFO_SOURCE_DIR "${CAFFE2_THIRD_PARTY_ROOT}/cpuinfo" CACHE STRING "cpuinfo source directory")
+   endif()
+diff --git a/tools/setup_helpers/cmake.py b/tools/setup_helpers/cmake.py
+index 88f0fe5d309..9cf2e478f5d 100644
+--- a/tools/setup_helpers/cmake.py
++++ b/tools/setup_helpers/cmake.py
+@@ -294,6 +294,7 @@ class CMake:
+                     "TORCH_XPU_ARCH_LIST",
+                     "TRACING_BASED",
+                     "PYTHON_LIB_REL_PATH",
++                    "PYTHON_SIX_SOURCE_DIR",
+                 )
+             }
+         )
diff --git a/repos/spack_repo/builtin/packages/py_torch/envvar-forwarding-188242.patch b/repos/spack_repo/builtin/packages/py_torch/envvar-forwarding-188242.patch
new file mode 100644
index 00000000000..8caebcc974b
--- /dev/null
+++ b/repos/spack_repo/builtin/packages/py_torch/envvar-forwarding-188242.patch
@@ -0,0 +1,91 @@
+diff --git a/cmake/EnvVarForwarding.cmake b/cmake/EnvVarForwarding.cmake
+index a31ce6db266..68f77a4e3f8 100644
+--- a/cmake/EnvVarForwarding.cmake
++++ b/cmake/EnvVarForwarding.cmake
+@@ -70,33 +70,61 @@ foreach(_var IN LISTS _ENV_PASSTHROUGH)
+   endif()
+ endforeach()
+ 
+-# Forward all BUILD_*, USE_*, CMAKE_* env vars not already set as CMake
+-# variables, plus vars ending in EXITCODE or EXITCODE__TRYRUN_OUTPUT.
+-# This matches the existing behavior where setup.py passed everything with
+-# these prefixes/suffixes through to CMake.
+-# We use execute_process + env to get the full list since CMake has no
+-# built-in way to enumerate environment variables.
++# Forward all BUILD_*, USE_*, CMAKE_* environment variables (plus names ending
++# in EXITCODE / EXITCODE__TRYRUN_OUTPUT) into the CMake cache, mirroring the -D
++# flags setup.py used to pass.
++#
++# CMake cannot enumerate environment variables, and serializing the whole
++# environment to text and re-parsing it in CMake is unsafe: values such as PS1
++# contain ';' and '\' (and some exported shell functions even contain newlines),
++# all of which collide with CMake's list, escape, and line semantics and
++# silently corrupt unrelated variables. The top-level CMakeLists.txt already
++# requires Python (find_package(Python COMPONENTS Interpreter REQUIRED)) before
++# including this module, so read os.environ directly there -- the full
++# environment is never serialized -- and have it emit only the selected,
++# properly escaped cache assignments for CMake to evaluate.
++
++# Applies one forwarded variable. An explicitly-set environment variable takes
++# priority, matching the -D semantics this module emulates: override the cache
++# (do not merely fill when undefined) so a value left by an earlier env-less
++# configure -- an option() default or a ninja-triggered reconfigure -- cannot
++# permanently shadow the environment.
++function(_envfwd_apply _name _value)
++  if(NOT DEFINED ${_name} OR NOT "${${_name}}" STREQUAL "${_value}")
++    set(${_name} "${_value}" CACHE STRING "From environment" FORCE)
++  endif()
++endfunction()
++
++# Reads os.environ and prints `_envfwd_apply("<name>" "<value>")` for each
++# selected variable, escaping the value for a CMake double-quoted argument.
++set(_envfwd_script [==[
++import os, re, sys
++
++select = re.compile(r"^(BUILD_|USE_|CMAKE_)|(EXITCODE|EXITCODE__TRYRUN_OUTPUT)$")
++
++def q(s):
++    # Escape for a CMake double-quoted argument. Backslash and quote are
++    # structural; '$' is escaped to suppress ${}/$ENV{} expansion. ';' and
++    # newlines are literal inside quotes and need no escaping.
++    return s.replace("\\", "\\\\").replace('"', '\\"').replace("$", "\\$")
++
++sys.stdout.write("\n".join(
++    '_envfwd_apply("%s" "%s")' % (q(name), q(value))
++    for name, value in os.environ.items()
++    if select.search(name)
++))
++]==])
++
+ execute_process(
+-  COMMAND "${CMAKE_COMMAND}" -E environment
+-  OUTPUT_VARIABLE _all_env
+-  OUTPUT_STRIP_TRAILING_WHITESPACE
++  COMMAND "${Python_EXECUTABLE}" -c "${_envfwd_script}"
++  OUTPUT_VARIABLE _envfwd_code
++  RESULT_VARIABLE _envfwd_rc
+ )
+-string(REPLACE "\n" ";" _env_lines "${_all_env}")
+-foreach(_line IN LISTS _env_lines)
+-  if(_line MATCHES "^([A-Za-z_0-9]+)=(.*)")
+-    set(_var_name "${CMAKE_MATCH_1}")
+-    set(_var_value "${CMAKE_MATCH_2}")
+-    # Only forward vars with BUILD_/USE_/CMAKE_ prefix or *EXITCODE* suffix.
+-    string(REGEX MATCH "^(BUILD_|USE_|CMAKE_)" _has_prefix "${_var_name}")
+-    string(REGEX MATCH "(EXITCODE|EXITCODE__TRYRUN_OUTPUT)$" _has_suffix "${_var_name}")
+-    if(NOT _has_prefix AND NOT _has_suffix)
+-      continue()
+-    endif()
+-    if(NOT DEFINED ${_var_name})
+-      set(${_var_name} "${_var_value}" CACHE STRING "From environment" FORCE)
+-    endif()
+-  endif()
+-endforeach()
++if(NOT _envfwd_rc EQUAL 0)
++  message(FATAL_ERROR
++    "EnvVarForwarding: failed to read the environment via Python (exit ${_envfwd_rc}).")
++endif()
++cmake_language(EVAL CODE "${_envfwd_code}")
+ 
+ # Low-priority aliases
+ foreach(_alias IN LISTS _LOW_PRIORITY_ALIASES)
diff --git a/repos/spack_repo/builtin/packages/py_torch/package.py b/repos/spack_repo/builtin/packages/py_torch/package.py
index c17b5061546..b0503639e00 100644
--- a/repos/spack_repo/builtin/packages/py_torch/package.py
+++ b/repos/spack_repo/builtin/packages/py_torch/package.py
@@ -29,6 +29,8 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
     tags = ["e4s"]
 
     version("main", branch="main")
+    version("2.13.0", tag="v2.13.0", commit="cf30153c4c131c8164ee7798e5022d810682e2cb")
+    version("2.12.1", tag="v2.12.1", commit="7269437d655783a26cba32aa88195b741ff496aa")
     version("2.12.0", tag="v2.12.0", commit="0d62256a2b23365f8e1604297eb23a6545102aa8")
     version("2.11.0", tag="v2.11.0", commit="70d99e998b4955e0049d13a98d77ae1b14db1f45")
     version("2.10.0", tag="v2.10.0", commit="449b1768410104d3ed79d3bcfe4ba1d65c7f22c0")
@@ -173,7 +175,8 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
 
     # Based on PyPI wheel availability
     with default_args(type=("build", "link", "run")):
-        depends_on("python@3.10:3.14", when="@2.9:")
+        depends_on("python@3.10:3.15", when="@2.13:")
+        depends_on("python@3.10:3.14", when="@2.9:2.12")
         depends_on("python@3.9:3.13", when="@2.5:2.8")
         depends_on("python@3.8:3.12", when="@2.2:2.4")
         depends_on("python@3.8:3.11", when="@2.0:2.1")
@@ -205,8 +208,9 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
         depends_on("py-fsspec", when="@2.1:")
 
         # pyproject.toml
-        depends_on("py-setuptools@70.1:81", when="@2.10:")
-        depends_on("py-setuptools@70.1:79", when="@2.9:")
+        depends_on("py-setuptools@77.0.3:", when="@2.13:")
+        depends_on("py-setuptools@70.1:81", when="@2.10:2.12")
+        depends_on("py-setuptools@70.1:79", when="@2.9")
         depends_on("py-setuptools@62.3:79", when="@2.8")
         depends_on("py-setuptools@:79", when="@:2.7")
         depends_on("py-numpy")
@@ -238,7 +242,8 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
     # depends_on("xnnpack@2021-02-22", when="@1.8:1.9+xnnpack")
     # depends_on("xnnpack@2020-03-23", when="@1.6:1.7+xnnpack")
     depends_on("benchmark", when="@1.6:+test")
-    depends_on("cpuinfo@2025-11-14", when="@2.10:")
+    depends_on("cpuinfo@2026-04-13", when="@2.13:")
+    depends_on("cpuinfo@2025-11-14", when="@2.10:2.12")
     depends_on("cpuinfo@2025-03-21", when="@2.8:2.9")
     depends_on("cpuinfo@2024-09-26", when="@2.6:2.7")
     depends_on("cpuinfo@2024-09-06", when="@2.5.1")
@@ -249,7 +254,8 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
     depends_on("cpuinfo@2020-12-17", when="@1.8:1.12")
     depends_on("cpuinfo@2020-06-11", when="@1.6:1.7")
     with when("+gloo"):
-        depends_on("gloo@2025-12-02", when="@2.11:")
+        depends_on("gloo@2026-02-12", when="@2.13:")
+        depends_on("gloo@2025-12-02", when="@2.11:2.12")
         depends_on("gloo@2025-08-21", when="@2.9:2.10")
         depends_on("gloo@2025-06-04", when="@2.8")
         depends_on("gloo@2023-12-03", when="@2.3:2.7")
@@ -281,11 +287,13 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
             depends_on("py-protobuf@3.13", when="@1.10:")
             depends_on("py-protobuf@3.11", when="@1.6:1.9")
     depends_on("psimd@2020-05-17")
-    depends_on("pthreadpool@2023-08-29", when="@2.2:")
+    depends_on("pthreadpool@2026-05-01", when="@2.13:")
+    depends_on("pthreadpool@2023-08-29", when="@2.2:2.12")
     depends_on("pthreadpool@2021-04-13", when="@1.9:2.1")
     depends_on("pthreadpool@2020-10-05", when="@1.8")
     depends_on("pthreadpool@2020-06-15", when="@1.6:1.7")
     with default_args(type=("build", "link", "run")):
+        depends_on("py-pybind11@3.0.4:", when="@2.13:")
         depends_on("py-pybind11@3.0.1:", when="@2.9:")
         depends_on("py-pybind11@2.13.6:", when="@2.6:")
         depends_on("py-pybind11@2.13.5:", when="@2.5")
@@ -307,7 +315,7 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
     # Optional dependencies
     with default_args(type=("build", "link", "run")):
         # cmake/public/cuda.cmake
-        depends_on("cuda@12.6:", when="@2.12:+cuda")
+        depends_on("cuda@12.1:", when="@2.12:+cuda")
         depends_on("cuda@12:", when="@2.9:+cuda")
         depends_on("cuda@11:", when="@2.4:+cuda")
         # https://github.com/pytorch/pytorch/issues/122169
@@ -317,11 +325,17 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
         depends_on("cuda@10.2:11.4", when="@1.10+cuda")
         depends_on("cuda@9.2:11.4", when="@1.6:1.9+cuda")
     # https://github.com/pytorch/pytorch#prerequisites
-    depends_on("cudnn@8.5:9", when="@2.8:+cudnn")
-    # https://github.com/pytorch/pytorch/issues/119400
-    depends_on("cudnn@8.5:9.0", when="@2.3:2.7+cudnn")
-    depends_on("cudnn@7:8", when="@1.6:2.2+cudnn")
-    depends_on("nccl", when="+nccl+cuda")
+    with when("+cudnn"):
+        depends_on("cudnn@9:", when="@2.12:")
+        depends_on("cudnn@8.5:9", when="@2.8:2.11")
+        # https://github.com/pytorch/pytorch/issues/119400
+        depends_on("cudnn@8.5:9.0", when="@2.3:2.7")
+        depends_on("cudnn@7:8", when="@1.6:2.2")
+    # torch/csrc/distributed/c10d/NCCLUtils.hpp
+    with when("+nccl+cuda"):
+        depends_on("nccl@2.23:", when="@2.13:")
+        depends_on("nccl@2.7:", when="@2.6:")
+        depends_on("nccl")
     # https://github.com/pytorch/pytorch/pull/178065
     depends_on("magma@:2.9+cuda", when="+magma+cuda")
     depends_on("magma@:2.9+rocm", when="+magma+rocm")
@@ -386,7 +400,7 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
     )
 
     # https://github.com/pytorch/pytorch/issues/151592
-    patch("macos_rpath.patch", when="@2.7:")
+    patch("macos_rpath.patch", when="@2.7:2.12")
 
     # https://github.com/pytorch/pytorch/issues/151316
     patch(
@@ -593,6 +607,19 @@ class PyTorch(PythonPackage, CudaPackage, ROCmPackage):
         working_dir="third_party/fbgemm",
     )
 
+    # Make Pytorch build work in air gapped environments (without internet access)
+    # This forwards six source folder path to NNPACK which forwards it to PeachPy
+    # for versions @2.5:2.11
+    patch("air_gapped_nnpack_cmake_older.patch", when="@2.5:2.11")
+    # for version @2.12: (env forwarding mechanism changed)
+    # This error has been raised upstream https://github.com/pytorch/pytorch/pull/188263
+    patch("air_gapped_nnpack_cmake.patch", when="@2.12:")
+
+    # Backport the generic environment forwarding fix from PyTorch PR 188242.
+    # PyTorch 2.12--2.13 parse the entire environment as a CMake list, which
+    # can lose USE_* selections when unrelated values contain semicolons.
+    patch("envvar-forwarding-188242.patch", when="@2.12:2.13")
+
     def patch(self):
         # https://github.com/pytorch/pytorch/issues/52208
         filter_file(
@@ -742,6 +769,13 @@ def enable_or_disable(variant, keyword="USE", var=None):
 
         # cmake/External/nnpack.cmake
         enable_or_disable("nnpack")
+        if "+nnpack" in self.spec and "py-six" in self.spec:
+            # NNPACK/PeachPy wires this path into PYTHONPATH for codegen.
+            # Point it at Spack's installed py-six to avoid network fetches.
+            env.set(
+                "PYTHON_SIX_SOURCE_DIR",
+                self["py-six"].module.python_purelib,
+            )
 
         enable_or_disable("numa")
         if "+numa" in self.spec:
@@ -791,7 +825,7 @@ def enable_or_disable(variant, keyword="USE", var=None):
         elif self.spec["blas"].name == "intel-oneapi-mkl":
             env.set("BLAS", "MKL")
             env.set("WITH_BLAS", "mkl")
-            env.set("INTEL_MKL_DIR", self.spec["mkl"].prefix.mkl.latest)
+            env.set("INTEL_MKL_DIR", self.spec["intel-oneapi-mkl"].prefix.mkl.latest)
         elif self.spec["blas"].name == "openblas":
             env.set("BLAS", "OpenBLAS")
             env.set("WITH_BLAS", "open")
diff --git a/repos/spack_repo/builtin/packages/py_urllib3/package.py b/repos/spack_repo/builtin/packages/py_urllib3/package.py
index 4daa717dbdb..1929518c8e4 100644
--- a/repos/spack_repo/builtin/packages/py_urllib3/package.py
+++ b/repos/spack_repo/builtin/packages/py_urllib3/package.py
@@ -17,56 +17,84 @@ class PyUrllib3(PythonPackage):
 
     license("MIT")
 
-    version("2.6.3", sha256="1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed")
-    version("2.5.0", sha256="3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760")
-    version("2.3.0", sha256="f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d")
-    version("2.1.0", sha256="df7aa8afb0148fa78488e7899b2c59b5f4ffcfa82e6c54ccb9dd37c1d7b52d54")
-    version("2.0.7", sha256="c97dfde1f7bd43a71c8d2a58e369e9b2bf692d1334ea9f9cae55add7d0dd0f84")
-    version("2.0.6", sha256="b19e1a85d206b56d7df1d5e683df4a7725252a964e3993648dd0fb5a1c157564")
-    version("2.0.5", sha256="13abf37382ea2ce6fb744d4dad67838eec857c9f4f57009891805e0b5e123594")
-    version("1.26.20", sha256="40c2dc0c681e47eb8f90e7e27bf6ff7df2e677421fd46756da1161c39ca70d32")
-    version("1.26.12", sha256="3fa96cf423e6987997fc326ae8df396db2a8b7c667747d47ddd8ecba91f4a74e")
-    version("1.26.6", sha256="f57b4c16c62fa2760b7e3d97c35b255512fb6b59a259730f36ba32ce9f8e342f")
-    version("1.25.11", sha256="8d7eaa5a82a1cac232164990f04874c594c9453ec55eef02eab885aa02fc17a2")
-    version("1.25.9", sha256="3018294ebefce6572a474f0604c2021e33b3fd8006ecd11d62107a5d2a963527")
-    version("1.25.6", sha256="9a107b99a5393caf59c7aa3c1249c16e6879447533d0887f4336dde834c7be86")
-    version("1.25.3", sha256="dbe59173209418ae49d485b87d1681aefa36252ee85884c31346debd19463232")
-    version("1.24.3", sha256="2393a695cd12afedd0dcb26fe5d50d0cf248e5a66f75dbd89a3d4eb333a61af4")
-    version("1.21.1", sha256="b14486978518ca0901a76ba973d7821047409d7f726f22156b24e83fd71382a5")
-    version("1.20", sha256="97ef2b6e2878d84c0126b9f4e608e37a951ca7848e4855a7f7f4437d5c34a72f")
-    version("1.14", sha256="dd4fb13a4ce50b18338c7e4d665b21fd38632c5d4b1d9f1a1379276bd3c08d37")
+    version("2.7.0", sha256="231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c")
+
+    with default_args(deprecated=True):
+        # https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j
+        # https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc
+        version("2.6.3", sha256="1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed")
+        # https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99
+        # https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53
+        # https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37
+        version("2.5.0", sha256="3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760")
+        version("2.3.0", sha256="f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d")
+        version("2.1.0", sha256="df7aa8afb0148fa78488e7899b2c59b5f4ffcfa82e6c54ccb9dd37c1d7b52d54")
+        version("2.0.7", sha256="c97dfde1f7bd43a71c8d2a58e369e9b2bf692d1334ea9f9cae55add7d0dd0f84")
+        version("2.0.6", sha256="b19e1a85d206b56d7df1d5e683df4a7725252a964e3993648dd0fb5a1c157564")
+        version("2.0.5", sha256="13abf37382ea2ce6fb744d4dad67838eec857c9f4f57009891805e0b5e123594")
+        version(
+            "1.26.20", sha256="40c2dc0c681e47eb8f90e7e27bf6ff7df2e677421fd46756da1161c39ca70d32"
+        )
+        version(
+            "1.26.12", sha256="3fa96cf423e6987997fc326ae8df396db2a8b7c667747d47ddd8ecba91f4a74e"
+        )
+        version(
+            "1.26.6", sha256="f57b4c16c62fa2760b7e3d97c35b255512fb6b59a259730f36ba32ce9f8e342f"
+        )
+        version(
+            "1.25.11", sha256="8d7eaa5a82a1cac232164990f04874c594c9453ec55eef02eab885aa02fc17a2"
+        )
+        version(
+            "1.25.9", sha256="3018294ebefce6572a474f0604c2021e33b3fd8006ecd11d62107a5d2a963527"
+        )
+        version(
+            "1.25.6", sha256="9a107b99a5393caf59c7aa3c1249c16e6879447533d0887f4336dde834c7be86"
+        )
+        version(
+            "1.25.3", sha256="dbe59173209418ae49d485b87d1681aefa36252ee85884c31346debd19463232"
+        )
+        version(
+            "1.24.3", sha256="2393a695cd12afedd0dcb26fe5d50d0cf248e5a66f75dbd89a3d4eb333a61af4"
+        )
+        version(
+            "1.21.1", sha256="b14486978518ca0901a76ba973d7821047409d7f726f22156b24e83fd71382a5"
+        )
+        version("1.20", sha256="97ef2b6e2878d84c0126b9f4e608e37a951ca7848e4855a7f7f4437d5c34a72f")
+        version("1.14", sha256="dd4fb13a4ce50b18338c7e4d665b21fd38632c5d4b1d9f1a1379276bd3c08d37")
 
     variant("brotli", default=False, when="@1.25:", description="Add Brotli support")
     variant("socks", default=False, when="@1.15:", description="SOCKS and HTTP proxy support")
     # Historical variant
     variant("secure", default=False, when="@:2.0", description="Add SSL/TLS support")
 
-    depends_on("python@3.9:", when="@2.3:", type=("build", "run"))
-    depends_on("python@3.8:", when="@2.1:", type=("build", "run"))
-
-    depends_on("py-hatchling@1.6:1", when="@2:", type="build")
-    depends_on("py-hatch-vcs@0.4:0.5", when="@2.5:", type="build")
-    depends_on("py-hatch-vcs@0.4", when="@2.3:2.4", type="build")
-    depends_on("py-setuptools-scm@8", when="@2.5:", type="build")
-
-    with when("+brotli"):
-        depends_on("py-brotli@1.2:", when="@2.6:", type=("build", "run"))
-        depends_on("py-brotli@1.0.9:", when="@1.26.9:", type=("build", "run"))
+    with default_args(type="build"):
+        depends_on("py-hatchling@1.27:1", when="@2.7:")
+        depends_on("py-hatchling@1.6:1", when="@2:2.6")
+        depends_on("py-hatch-vcs@0.4:0.5", when="@2.5:")
+        depends_on("py-hatch-vcs@0.4", when="@2.3:2.4")
+        depends_on("py-setuptools-scm@8:10", when="@2.7:")
+        depends_on("py-setuptools-scm@8", when="@2.5:2.6")
 
         # Historical dependencies
-        depends_on("py-brotlipy@0.6:", when="@:1.26.8", type=("build", "run"))
+        depends_on("py-setuptools", when="@1")
 
-    depends_on("py-pysocks@1.5.6,1.5.8:1", when="+socks", type=("build", "run"))
+    with default_args(type="run"):
+        with when("+brotli"):
+            depends_on("py-brotli@1.2:", when="@2.6:")
+            depends_on("py-brotli@1.0.9:", when="@1.26.9:")
 
-    # Historical dependencies
-    with when("+secure"):
-        depends_on("py-pyopenssl@17.1:", when="@2:", type=("build", "run"))
-        depends_on("py-pyopenssl@0.14:", when="@1", type=("build", "run"))
-        depends_on("py-cryptography@1.9:", when="@2:", type=("build", "run"))
-        depends_on("py-cryptography@1.3.4:", when="@1", type=("build", "run"))
-        depends_on("py-idna@2:", type=("build", "run"))
-        depends_on("py-certifi", type=("build", "run"))
-        depends_on("py-urllib3-secure-extra", when="@1.26.12:", type=("build", "run"))
+            # Historical dependencies
+            depends_on("py-brotlipy@0.6:", when="@:1.26.8")
 
-    depends_on("py-setuptools", when="@1", type="build")
-    depends_on("python@3.6:3", when="@1.26.12:1", type=("build", "run"))
+        with when("+socks"):
+            depends_on("py-pysocks@1.5.6,1.5.8:1")
+
+        # Historical dependencies
+        with when("+secure"):
+            depends_on("py-pyopenssl@17.1:", when="@2:")
+            depends_on("py-pyopenssl@0.14:", when="@1")
+            depends_on("py-cryptography@1.9:", when="@2:")
+            depends_on("py-cryptography@1.3.4:", when="@1")
+            depends_on("py-idna@2:")
+            depends_on("py-certifi")
+            depends_on("py-urllib3-secure-extra", when="@1.26.12:")
diff --git a/repos/spack_repo/builtin/packages/python/package.py b/repos/spack_repo/builtin/packages/python/package.py
index 623ed470765..f3a81141f16 100644
--- a/repos/spack_repo/builtin/packages/python/package.py
+++ b/repos/spack_repo/builtin/packages/python/package.py
@@ -723,14 +723,14 @@ def configure_args(self):
         if cflags:
             config_args.append("CFLAGS={0}".format(" ".join(cflags)))
 
-        if spec["gettext"].satisfies("~shared"):
+        if "gettext" in spec and spec["gettext"].satisfies("~shared"):
             config_args.append(
                 "LIBS=-L{0} -L{1} -lintl -liconv".format(
                     spec["gettext"].prefix.lib, spec["iconv"].prefix.lib
                 )
             )
 
-        if self.version >= Version("3.12.0") and sys.platform == "darwin":
+        if self.version >= Version("3.12.0") and sys.platform == "darwin" and "ncurses" in spec:
             config_args.append("CURSES_LIBS={0}".format(spec["ncurses"].libs.link_flags))
 
         return config_args
diff --git a/repos/spack_repo/builtin/packages/rust/package.py b/repos/spack_repo/builtin/packages/rust/package.py
index 38f4efda780..37ded7e6814 100644
--- a/repos/spack_repo/builtin/packages/rust/package.py
+++ b/repos/spack_repo/builtin/packages/rust/package.py
@@ -191,7 +191,14 @@ def get_test_path(p):
     def setup_dependent_build_environment(
         self, env: EnvironmentModifications, dependent_spec: Spec
     ) -> None:
-        env.set("CARGO_HOME", join_path(dependent_spec.package.stage.path, "cargo"))
+        # Respect an explicitly configured Cargo cache for offline builds.
+        # Otherwise retain Spack's isolated per-package cache.
+        cargo_home = os.environ.get("SPACK_CARGO_HOME")
+        cargo_offline = os.environ.get("CARGO_NET_OFFLINE", "").lower() == "true"
+        if cargo_home and cargo_offline:
+            env.set("CARGO_HOME", cargo_home)
+        else:
+            env.set("CARGO_HOME", join_path(dependent_spec.package.stage.path, "cargo"))
 
         # Until we get a little more integration with cargo or offload solving to spack
         # (how to do this is TBD), we need it to fall back to older package versions
diff --git a/repos/spack_repo/builtin/packages/yafyaml/package.py b/repos/spack_repo/builtin/packages/yafyaml/package.py
index c2630412e31..5edb1258452 100644
--- a/repos/spack_repo/builtin/packages/yafyaml/package.py
+++ b/repos/spack_repo/builtin/packages/yafyaml/package.py
@@ -94,6 +94,15 @@ def patch(self):
     )
     variant("fismahigh", default=False, description="Apply patching for FISMA-high compliance")
 
+    def cmake_args(self):
+        args = []
+        if self.spec.satisfies("%nag"):
+            # NAG's nested linker-argument syntax cannot represent Spack's
+            # padded install-prefix placeholder in an rpath. yaFyaml only
+            # installs static libraries, so it does not need build rpaths.
+            args.append(self.define("CMAKE_SKIP_RPATH", True))
+        return args
+
     @when("+fismahigh")
     def patch(self):
         if os.path.exists("tools/ci-install-gfe.bash"):