diff --git a/.github/workflows/macos-ci-aarch64.yaml b/.github/workflows/macos-ci-aarch64.yaml
index 6a887459d..14f658c52 100644
--- a/.github/workflows/macos-ci-aarch64.yaml
+++ b/.github/workflows/macos-ci-aarch64.yaml
@@ -67,7 +67,7 @@ jobs:
           export SPACK_SYSTEM_CONFIG_PATH="${ENVDIR}/site"
 
           # Find external packages
-          spack external find --scope system --exclude bison
+          spack external find --scope system --exclude bison --exclude openssl
           spack external find --scope system perl
           spack external find --scope system wget
           PATH="/opt/homebrew/opt/curl/bin:$PATH" \
@@ -103,7 +103,7 @@ jobs:
           # Add binary cache and reindex it
           spack mirror add local-binary file:///Users/ec2-user/spack-stack/build-cache/
           # DH* 20230721 - todo remove || true
-          spack buildcache update-index -m local-binary || true
+          spack buildcache update-index local-binary || true
           echo "Packages in combined spack build caches:"
           spack buildcache list
 
@@ -116,14 +116,14 @@ jobs:
           # DH* 20230721 - todo remove --no-checksum
           spack install --fail-fast --source --no-check-signature --no-checksum base-env 2>&1 | tee log.install.apple-clang-14.0.0.base-env
           # DH* 20230721 - todo remove || true (this was here all the time, but should not be needed if spack creates buildcaches correctly)
-          spack buildcache create -a -r -u -d /Users/ec2-user/spack-stack/build-cache/ || true
+          spack buildcache create -a -u /Users/ec2-user/spack-stack/build-cache/ || true
 
           # the rest
           echo "${{ inputs.template || 'unified-dev' }} ..."
           # DH* 20230721 - todo remove --no-checksum
           spack install --fail-fast --source --no-check-signature --no-checksum 2>&1 | tee log.install.apple-clang-14.0.0.${{ inputs.template || 'unified-dev' }}
           # DH* 20230721 - todo remove || true (this was here all the time, but should not be needed if spack creates buildcaches correctly)
-          spack buildcache create -a -r -u -d /Users/ec2-user/spack-stack/build-cache/ || true
+          spack buildcache create -a -u /Users/ec2-user/spack-stack/build-cache/ || true
 
           # Next steps: synchronize source and build cache to a central/combined mirror?
           echo "Next steps ..."
@@ -145,16 +145,17 @@ jobs:
           export ENVNAME=ci-env.macos-ci-aarch64
           # *DH
           export ENVDIR=$PWD/envs/${ENVNAME}
+          ls -l ${ENVDIR}/install/modulefiles/Core
 
           module use ${ENVDIR}/install/modulefiles/Core
           module load stack-apple-clang/14.0.0
-          module load stack-openmpi
+          module load stack-openmpi/4.1.5
           module load stack-python/3.10.8
           module available
 
-          module load jedi-ufs-env/unified-dev
-          module load ewok-env/unified-dev
-          module load soca-env/unified-dev
+          module load jedi-ufs-env/1.0.0
+          module load ewok-env/1.0.0
+          module load soca-env/1.0.0
           module list
 
       # Skip this for now, copied from other yaml
diff --git a/.github/workflows/macos-ci-x86_64.yaml b/.github/workflows/macos-ci-x86_64.yaml
index 67ea0d998..211cd7cec 100644
--- a/.github/workflows/macos-ci-x86_64.yaml
+++ b/.github/workflows/macos-ci-x86_64.yaml
@@ -60,7 +60,7 @@ jobs:
           export SPACK_SYSTEM_CONFIG_PATH="${ENVDIR}/site"
 
           # Find external packages
-          spack external find --scope system --exclude bison
+          spack external find --scope system --exclude bison --exclude openssl
           spack external find --scope system perl
           spack external find --scope system wget
           PATH="/usr/local/opt/curl/bin:$PATH" \
@@ -96,7 +96,7 @@ jobs:
           # Add binary cache and reindex it
           spack mirror add local-binary file:///Users/ec2-user/spack-stack/build-cache/
           # DH* 20230721 - todo remove || true
-          spack buildcache update-index -m local-binary || true
+          spack buildcache update-index local-binary || true
           echo "Packages in combined spack build caches:"
           spack buildcache list
 
@@ -109,14 +109,14 @@ jobs:
           # DH* 20230721 - todo remove --no-checksum
           spack install --fail-fast --source --no-check-signature --no-checksum base-env 2>&1 | tee log.install.apple-clang-14.0.0.base-env
           # DH* 20230721 - todo remove || true (this was here all the time, but should not be needed if spack creates buildcaches correctly)
-          spack buildcache create -a -r -u -d /Users/ec2-user/spack-stack/build-cache/ || true
+          spack buildcache create -a -u /Users/ec2-user/spack-stack/build-cache/ || true
 
           # the rest
           echo "${{ inputs.template || 'unified-dev' }} ..."
           # DH* 20230721 - todo remove --no-checksum
           spack install --fail-fast --source --no-check-signature --no-checksum 2>&1 | tee log.install.apple-clang-14.0.0.${{ inputs.template || 'unified-dev' }}
           # DH* 20230721 - todo remove || true (this was here all the time, but should not be needed if spack creates buildcaches correctly)
-          spack buildcache create -a -r -u -d /Users/ec2-user/spack-stack/build-cache/ || true
+          spack buildcache create -a -u /Users/ec2-user/spack-stack/build-cache/ || true
 
           # Next steps: synchronize source and build cache to a central/combined mirror?
           echo "Next steps ..."
@@ -136,16 +136,17 @@ jobs:
           export ENVNAME=ci-env.macos-ci-x86_64
           # *DH
           export ENVDIR=$PWD/envs/${ENVNAME}
+          ls -l ${ENVDIR}/install/modulefiles/Core
 
           module use ${ENVDIR}/install/modulefiles/Core
           module load stack-apple-clang/14.0.0
-          module load stack-openmpi
+          module load stack-openmpi/4.1.5
           module load stack-python/3.10.8
           module available
 
-          module load jedi-ufs-env/unified-dev
-          module load ewok-env/unified-dev
-          module load soca-env/unified-dev
+          module load jedi-ufs-env/1.0.0
+          module load ewok-env/1.0.0
+          module load soca-env/1.0.0
           module list
 
       # Skip this for now, copied from other yaml
diff --git a/.github/workflows/ubuntu-ci-x86_64.yaml b/.github/workflows/ubuntu-ci-x86_64.yaml
index 5b9619406..742deaa1c 100644
--- a/.github/workflows/ubuntu-ci-x86_64.yaml
+++ b/.github/workflows/ubuntu-ci-x86_64.yaml
@@ -60,7 +60,7 @@ jobs:
           export SPACK_SYSTEM_CONFIG_PATH="${ENVDIR}/site"
 
           # Find external packages
-          spack external find --scope system
+          spack external find --scope system --exclude bison --exclude openssl
           spack external find --scope system perl
           spack external find --scope system wget
           PATH="/usr/local/opt/curl/bin:$PATH" \
@@ -134,7 +134,7 @@ jobs:
           # Add binary cache and reindex it
           spack mirror add local-binary file:///home/ubuntu/spack-stack/build-cache/
           # DH* 20230721 - todo remove || true
-          spack buildcache update-index -m local-binary || true
+          spack buildcache update-index local-binary || true
           echo "Packages in combined spack build caches:"
           spack buildcache list
 
@@ -147,14 +147,14 @@ jobs:
           # DH* 20230721 - todo remove --no-checksum
           spack install --fail-fast --source --no-check-signature --no-checksum base-env 2>&1 | tee log.install.intel-2021.4.0.base-env
           # DH* 20230721 - todo remove || true (this was here all the time, but should not be needed if spack creates buildcaches correctly)
-          spack buildcache create -a -r -u -d /home/ubuntu/spack-stack/build-cache/ || true
+          spack buildcache create -a -u /home/ubuntu/spack-stack/build-cache/ || true
 
           # the rest
           echo "${{ inputs.template || 'unified-dev' }} ..."
           # DH* 20230721 - todo remove --no-checksum
           spack install --fail-fast --source --no-check-signature --no-checksum 2>&1 | tee log.install.intel@2021.4.0.${{ inputs.template || 'unified-dev' }}
           # DH* 20230721 - todo remove || true (this was here all the time, but should not be needed if spack creates buildcaches correctly)
-          spack buildcache create -a -r -u -d /home/ubuntu/spack-stack/build-cache/ || true
+          spack buildcache create -a -u /home/ubuntu/spack-stack/build-cache/ || true
 
           # Next steps: synchronize source and build cache to a central/combined mirror?
           echo "Next steps ..."
@@ -186,6 +186,7 @@ jobs:
           export ENVNAME=ci-env.ubuntu-ci-x86_64
           # *DH
           export ENVDIR=$PWD/envs/${ENVNAME}
+          ls -l ${ENVDIR}/install/modulefiles/Core
 
           module use ${ENVDIR}/install/modulefiles/Core
           module load stack-intel/2021.4.0
@@ -193,9 +194,9 @@ jobs:
           module load stack-python/3.10.8
           module available
 
-          module load jedi-ufs-env/unified-dev
-          module load ewok-env/unified-dev
-          module load soca-env/unified-dev
+          module load jedi-ufs-env/1.0.0
+          module load ewok-env/1.0.0
+          module load soca-env/1.0.0
           module list
 
       # Skip this for now, copied from other yaml
diff --git a/configs/common/config.yaml b/configs/common/config.yaml
index 37b142cde..d1ceb7de6 100644
--- a/configs/common/config.yaml
+++ b/configs/common/config.yaml
@@ -4,7 +4,7 @@ config:
   install_tree:
     root: $env/install
     projections:
-      all: "${COMPILERNAME}/${COMPILERVER}/${PACKAGE}-${VERSION}-${HASH}"
+      all: "{compiler.name}/{compiler.version}/{name}-{version}-{hash}"
     # Needed for relocation of binary packages (build caches)
     #padded_length: true
 
diff --git a/configs/common/modules.yaml b/configs/common/modules.yaml
index a2f822711..78c618e9f 100644
--- a/configs/common/modules.yaml
+++ b/configs/common/modules.yaml
@@ -16,7 +16,7 @@ modules:
         nlohmann-json: '{compiler.name}/{compiler.version}/json/{version}'
         nlohmann-json-schema-validator: '{compiler.name}/{compiler.version}/json-schema-validator/{version}'
         libjpeg-turbo: '{compiler.name}/{compiler.version}/libjpeg/{version}'
-      blacklist:
+      exclude:
       # List of packages for which we don't need modules
       - apple-libunwind
       - apple-libuuid
@@ -261,7 +261,7 @@ modules:
         nlohmann-json: 'json/{version}'
         nlohmann-json-schema-validator: 'json-schema-validator/{version}'
         libjpeg-turbo: 'libjpeg/{version}'
-      blacklist:
+      exclude:
       # List of packages for which we don't need modules
       - apple-libunwind
       - apple-libuuid
diff --git a/configs/common/packages.yaml b/configs/common/packages.yaml
index 55aefab47..7486ed1fd 100644
--- a/configs/common/packages.yaml
+++ b/configs/common/packages.yaml
@@ -11,252 +11,253 @@
         lapack: [openblas]
         yacc: [bison]
     #
-    bacio:
-      version: [2.4.1]
+    bacio:  
+      version: ['2.4.1']
     bison:
-      version: [3.8.2]
+      version: ['3.8.2']
     # Attention - when updating also check orion site config
     boost:
-      version: [1.78.0]
+      version: ['1.78.0']
       variants: ~atomic +chrono +date_time +exception +filesystem ~graph ~iostreams ~locale ~log ~math ~mpi ~numpy +pic +program_options +python ~random +regex +serialization ~signals +system +test +thread +timer ~wave cxxstd=14 visibility=hidden
     bufr:
-      version: [12.0.0]
+      version: ['12.0.0']
       variants: +python
     # Newer versions of CDO require the C++-17 standard, which doesn't
     # work with all compilers that are currently in use in spack-stack
     cdo:
-      version: [2.0.5]
+      version: ['2.0.5']
       variants: ~openmp
     cmake:
-      version: [3.23.1]
+      version: ['3.23.1']
       variants: +ownlibs
     # Attention - when updating also check the various jcsda-emc-bundles env packages
     crtm:
-      version: [2.4.0]
+      version: ['2.4.0']
       variants: +fix
     ecbuild:
-      version: [3.7.2]
+      version: ['3.7.2']
     eccodes:
-      version: [2.27.0]
+      version: ['2.27.0']
     ecflow:
-      version: [5.8.4]
+      version: ['5.8.4']
       variants: +ui
     eckit:
-      version: [1.23.1]
+      version: ['1.23.1']
       variants: linalg=eigen,lapack compression=lz4,bzip2
     ecmwf-atlas:
-      version: [0.33.0]
+      version: ['0.33.0']
       variants: +fckit +trans
     ectrans:
-      version: [1.2.0]
+      version: ['1.2.0']
       variants: ~enable_mkl
     eigen:
-      version: [3.4.0]
+      version: ['3.4.0']
     # Attention - when updating the version also check the common modules.yaml
     # config and update the projections for lmod/tcl
     # Note: Stay away from esmf@8.4.1 ... breaks all sorts of things
     #esmf:
-    #  version: [8.4.1]
+    #  version: ['8.4.1']
     #  variants: ~xerces ~pnetcdf +parallelio ~shared
     esmf:
-      version: [8.4.2]
+      version: ['8.4.2']
       variants: ~xerces ~pnetcdf snapshot=none ~shared +external-parallelio
     fckit:
-      version: [0.10.1]
+      version: ['0.10.1']
       variants: +eckit
     fftw:
-      version: [3.3.10]
+      version: ['3.3.10']
     fiat:
-      version: [1.1.0]
+      version: ['1.1.0']
     fms:
-      version: [2023.01]
+      version: ['2023.01']
       variants: precision=32,64 +quad_precision +gfs_phys +openmp +pic constants=GFS build_type=Release
     g2:
-      version: [3.4.5]
+      version: ['3.4.5']
     g2c:
-      version: [1.6.4]
+      version: ['1.6.4']
     g2tmpl:
-      version: [1.10.2]
+      version: ['1.10.2']
     gfsio:
-      version: [1.4.1]
+      version: ['1.4.1']
     gftl-shared:
-      version: [1.5.0]
+      version: ['1.5.0']
     #git-lfs:
       # Assume git-lfs is provided, hard to install
       # because of dependencies on go/go-bootstrap.
       # Note: Uncommenting this entry will break
       # the container builds.
-      #version: [2.11.0]
+      #version: ['2.11.0']
     grib-util:
-      version: [1.2.3]
+      version: ['1.2.3']
     gsibec:
-      version: [1.1.2]
+      version: ['1.1.2']
     gsi-ncdiag:
-      version: [1.1.1]
+      version: ['1.1.1']
     gsl-lite:
-      version: [0.37.0]
+      version: ['0.37.0']
     hdf:
-      version: [4.2.15]
+      version: ['4.2.15']
       variants: ~fortran ~netcdf
     hdf5:
-      version: [1.14.0]
+      version: ['1.14.0']
       variants: +hl +fortran +mpi ~threadsafe +szip
     ip:
-      version: [3.3.3]
+      version: ['3.3.3']
     ip2:
-      version: [1.1.2]
+      version: ['1.1.2']
     jasper:
-      version: [2.0.32]
+      version: ['2.0.32']
     jedi-cmake:
-      version: [1.4.0]
+      version: ['1.4.0']
     jpeg:
-      version: [9.1.0]
+      version: ['9.1.0']
     landsfcutil:
-      version: [2.4.1]
+      version: ['2.4.1']
     libjpeg-turbo:
-      version: [2.1.0]
+      version: ['2.1.0']
     libpng:
-      version: [1.6.37]
+      version: ['1.6.37']
     libyaml:
-      version: [0.2.5]
+      version: ['0.2.5']
     mapl:
       # 2.35.2 goes with esmf@8.4.1
-      version: [2.35.2]
+      version: ['2.35.2']
       variants: ~shared
     met:
-      version: [11.0.2]
+      version: ['11.0.2']
       variants: +python +grib2
     metplus:
-      version: [5.0.1]
+      version: ['5.0.1']
     mpich:
       variants: ~hwloc +two_level_namespace
     nco:
-      version: [5.0.6]
+      version: ['5.0.6']
       variants: ~doc
     # ncview - when adding information here, also check Orion
     # and Discover site configs
     nemsio:
-      version: [2.5.4]
+      version: ['2.5.4']
     nemsiogfs:
-      version: [2.5.3]
+      version: ['2.5.3']
     nccmp:
-      version: [1.9.0.1]
+      version: ['1.9.0.1']
     ncio:
-      version: [1.1.2]
+      version: ['1.1.2']
     netcdf-c:
-      version: [4.9.2]
+      version: ['4.9.2']
       # If using 4.9.1, turn off byterange variant to fix compile error: ~byterange
       variants: +dap +mpi ~parallel-netcdf
     netcdf-cxx4:
-      version: [4.3.1]
+      version: ['4.3.1']
     netcdf-fortran:
-      version: [4.6.0]
+      version: ['4.6.0']
     # ninja - when adding information here, also check Cheyenne
     # and Discover site configs
     nlohmann-json:
-      version: [3.10.5]
+      version: ['3.10.5']
     nlohmann-json-schema-validator:
-      version: [2.1.0]
+      version: ['2.1.0']
     odc:
-      version: [1.4.6]
+      version: ['1.4.6']
       variants: ~fortran
     openblas:
-      version: [0.3.19]
+      version: ['0.3.19']
       variants: +noavx512
     openmpi:
       variants: +internal-hwloc +two_level_namespace
     openssl:
       variants: +shared
     p4est:
-      version: [2.8]
+      version: ['2.8']
     parallelio:
-      version: [2.5.9]
+      version: ['2.5.9']
       variants: +pnetcdf
     parallel-netcdf:
-      version: [1.12.2]
+      version: ['1.12.2']
     # Do not build pkgconf - https://github.com/jcsda/spack-stack/issues/123
     pkgconf:
       buildable: False
     prod-util:
-      version: [1.2.2]
+      version: ['1.2.2']
     proj:
-      version: [8.1.0]
+      version: ['8.1.0']
       variants: ~tiff
     python:
-      version: [3.10.8]
+      version: ['3.10.8']
     py-cartopy:
       variants: +plotting
     py-click:
-      version: [8.0.3]
+      version: ['8.0.3']
     py-eccodes:
-      version: [1.4.2]
+      version: ['1.4.2']
     py-h5py:
-      version: [3.7.0]
+      version: ['3.7.0']
       variants: ~mpi
     # Comment out for now until build problems are solved
     # https://github.com/jcsda/spack-stack/issues/522
     # see also ewok-env virtual package and container
     # README.md
     #py-mysql-connector-python:
-    #  version: [8.0.32]
+    #  version: ['8.0.32']
     py-netcdf4:
-      version: [1.5.3]
+      version: ['1.5.8']
       variants: ~mpi
     py-numpy:
-      version: [1.22.3]
+      version: ['1.22.3']
       variants: +blas +lapack
     py-openpyxl:
-      version: [3.0.3]
-    py-pandas:
-      version: [1.4.0]
+      version: ['3.0.3']
+    # DH* 20230719 try without version
+    #py-pandas:
+    #  version: ['1.4.0']
     # To avoid pip._vendor.pep517.wrappers.BackendInvalid errors with newer
     # versions of py-poetry-core when using external/homebrew Python as
     # we do at the moment in spack-stack.
     py-poetry-core:
-      version: [1.0.8]
+      version: ['1.0.8']
     py-pybind11:
-      version: [2.8.1]
+      version: ['2.8.1']
     py-pycodestyle:
-      version: [2.8.0]
+      version: ['2.8.0']
     py-pygithub:
-      version: [1.55]
+      version: ['1.55']
     py-pygrib:
-      version: [2.1.4]
+      version: ['2.1.4']
     py-pyhdf:
-      version: [0.10.4]
+      version: ['0.10.4']
     py-pyproj:
-      version: [3.1.0]
+      version: ['3.1.0']
     py-python-dateutil:
-      version: [2.8.2]
+      version: ['2.8.2']
     py-pythran:
       # Versions earlier than 0.11.0 don't compile on macOS with llvm-clang/13.0.0 and Python/3.9,
       # and 0.11.0 leads to downstream errors in py-scipy with the Intel compilers
-      version: [0.12.2]
+      version: ['0.12.2']
     py-pyyaml:
-      version: [6.0]
+      version: ['6.0']
     py-scipy:
-      version: [1.9.3]
+      version: ['1.9.3']
     # Pin the py-setuptools version to avoid duplicate Python packages
     py-setuptools:
-      version: [59.4.0]
+      version: ['59.4.0']
     # Pin the py-setuptools-scm version to avoid duplicate Python packages
     py-setuptools-scm:
-      version: [7.0.5]
+      version: ['7.0.5']
     py-shapely:
-      version: [1.8.0]
+      version: ['1.8.0']
     qt:
-      version: [5.15.3]
+      version: ['5.15.3']
     scotch:
-      version: [7.0.3]
+      version: ['7.0.3']
       variants: +mpi+metis~shared~threads~mpi_thread+noarch
     sfcio:
-      version: [1.4.1]
+      version: ['1.4.1']
     shumlib:
-      version: [macos_clang_linux_intel_port]
+      version: ['macos_clang_linux_intel_port']
     sigio:
-      version: [2.3.2]
+      version: ['2.3.2']
     sp:
-      version: [2.3.3]
+      version: ['2.3.3']
     #texlive:
       # Assume texlive is provided, hard to install
       # because of its dependencies. Both Linux and
@@ -264,26 +265,26 @@
       # can be added as external packages.
       # Note: Uncommenting this entry will break
       # the container builds.
-      #version: [2.11.0]
+      #version: ['2.11.0']
     udunits:
-      version: [2.2.28]
+      version: ['2.2.28']
     upp:
-      version: [10.0.10]
+      version: ['10.0.10']
     w3emc:
-      version: [2.9.2]
+      version: ['2.9.2']
     w3nco:
-      version: [2.4.1]
+      version: ['2.4.1']
     wget:
-      version: [1.21.2]
+      version: ['1.21.2']
     # When changing wgrib2, also check Hercules and Nautilus site configs
     wgrib2:
-      version: [2.0.8]
+      version: ['2.0.8']
     wrf-io:
-      version: [1.2.0]
+      version: ['1.2.0']
     yafyaml:
-      version: [0.5.1]
+      version: ['0.5.1']
     zlib:
-      version: [1.2.13]
+      version: ['1.2.13']
     zstd:
-      version: [1.5.2]
+      version: ['1.5.2']
       variants: +programs
diff --git a/configs/sites/acorn/packages.yaml b/configs/sites/acorn/packages.yaml
index 8d5ac5635..fa6df72fd 100644
--- a/configs/sites/acorn/packages.yaml
+++ b/configs/sites/acorn/packages.yaml
@@ -11,7 +11,7 @@
         - craype-network-ofi
         - cray-mpich/8.1.9
     esmf:
-      version: [8.3.0b09]
+      version: ['8.3.0b09']
       variants: ~xerces ~pnetcdf +pio ~shared snapshot=b09 esmf_os=Linux esmf_comm=mpich3
     git:
       buildable: false
@@ -51,11 +51,11 @@
       - spec: pkg-config@0.29.2
         prefix: /usr
     patchelf:
-      version: [0.13.1]
+      version: ['0.13.1']
     gettext:
-      version: [0.19.7]
+      version: ['0.19.7']
     rhash:
-      version: [1.3.5]
+      version: ['1.3.5']
     gdal:
       variants: ~curl
     flex:
diff --git a/configs/sites/aws-pcluster/modules.yaml b/configs/sites/aws-pcluster/modules.yaml
index 3228b7f94..11c5514e2 100644
--- a/configs/sites/aws-pcluster/modules.yaml
+++ b/configs/sites/aws-pcluster/modules.yaml
@@ -3,6 +3,6 @@ modules:
     enable::
     - lmod
     lmod:
-      whitelist:
+      include:
       # List of packages for which we need modules that are blacklisted by default
       - python
diff --git a/configs/sites/casper/modules.yaml b/configs/sites/casper/modules.yaml
index 7728eff92..8264ecf47 100644
--- a/configs/sites/casper/modules.yaml
+++ b/configs/sites/casper/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/casper/packages.yaml b/configs/sites/casper/packages.yaml
index 819f634c7..659f48762 100644
--- a/configs/sites/casper/packages.yaml
+++ b/configs/sites/casper/packages.yaml
@@ -172,7 +172,7 @@ packages:
       prefix: /usr
   # Old re2c on Casper unable to build newer versions of ninja
   ninja:
-    version:: [1.10.2]
+    version:: ['1.10.2']
   openssh:
     externals:
     - spec: openssh@7.4p1
@@ -183,7 +183,7 @@ packages:
       prefix: /usr
   # Pin patchelf to 0.15.0 for Intel compiler (no C++-17 features)
   patchelf:
-    version:: [0.15.0]
+    version:: ['0.15.0']
   perl:
     externals:
     - spec: perl@5.16.3~cpanm+shared+threads
diff --git a/configs/sites/cheyenne/modules.yaml b/configs/sites/cheyenne/modules.yaml
index 7728eff92..8264ecf47 100644
--- a/configs/sites/cheyenne/modules.yaml
+++ b/configs/sites/cheyenne/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/cheyenne/packages.yaml b/configs/sites/cheyenne/packages.yaml
index 522814b53..6c930de33 100644
--- a/configs/sites/cheyenne/packages.yaml
+++ b/configs/sites/cheyenne/packages.yaml
@@ -192,7 +192,7 @@ packages:
       prefix: /usr
   # Old re2c on Cheyenne unable to build newer versions of ninja
   ninja:
-    version:: [1.10.2]
+    version:: ['1.10.2']
   openssh:
     externals:
     - spec: openssh@7.2p2
@@ -203,7 +203,7 @@ packages:
       prefix: /usr
   # Pin patchelf to 0.15.0 for Intel compiler (no C++-17 features)
   patchelf:
-    version:: [0.15.0]
+    version:: ['0.15.0']
   perl:
     externals:
     - spec: perl@5.18.2~cpanm+shared+threads
diff --git a/configs/sites/discover/modules.yaml b/configs/sites/discover/modules.yaml
index 7728eff92..8264ecf47 100644
--- a/configs/sites/discover/modules.yaml
+++ b/configs/sites/discover/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/discover/packages.yaml b/configs/sites/discover/packages.yaml
index e5e9fbbd5..91140abd2 100644
--- a/configs/sites/discover/packages.yaml
+++ b/configs/sites/discover/packages.yaml
@@ -179,7 +179,7 @@ packages:
       prefix: /usr
   # Old re2c on Discover unable to build newer versions of ninja
   ninja:
-    version:: [1.10.2]
+    version:: ['1.10.2']
   openssl:
     externals:
     - spec: openssl@1.0.2j-fips
diff --git a/configs/sites/emc-rhel/modules.yaml b/configs/sites/emc-rhel/modules.yaml
index b66a9a948..7a73bf221 100644
--- a/configs/sites/emc-rhel/modules.yaml
+++ b/configs/sites/emc-rhel/modules.yaml
@@ -3,7 +3,7 @@ modules:
     enable::
     - lmod
     lmod:
-      whitelist:
+      include:
       # List of packages for which we need modules that are blacklisted by default
       - openmpi
       - mpich
diff --git a/configs/sites/frontera/modules.yaml b/configs/sites/frontera/modules.yaml
index 7728eff92..8264ecf47 100644
--- a/configs/sites/frontera/modules.yaml
+++ b/configs/sites/frontera/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/gaea-c5/modules.yaml b/configs/sites/gaea-c5/modules.yaml
index 7728eff92..8264ecf47 100644
--- a/configs/sites/gaea-c5/modules.yaml
+++ b/configs/sites/gaea-c5/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/gaea/modules.yaml b/configs/sites/gaea/modules.yaml
index 07cc3c509..9724c405d 100644
--- a/configs/sites/gaea/modules.yaml
+++ b/configs/sites/gaea/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - tcl
     tcl:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/hera/modules.yaml b/configs/sites/hera/modules.yaml
index 7728eff92..8264ecf47 100644
--- a/configs/sites/hera/modules.yaml
+++ b/configs/sites/hera/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/hercules/modules.yaml b/configs/sites/hercules/modules.yaml
index 7728eff92..8264ecf47 100644
--- a/configs/sites/hercules/modules.yaml
+++ b/configs/sites/hercules/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/hercules/packages.yaml b/configs/sites/hercules/packages.yaml
index ade1b7bb1..26df869b3 100644
--- a/configs/sites/hercules/packages.yaml
+++ b/configs/sites/hercules/packages.yaml
@@ -29,7 +29,7 @@ packages:
 ### Modifications of common packages
   # Version 2.0.8 doesn't compile on Hercules
   wgrib2:
-    version:: [3.1.1]
+    version:: ['3.1.1']
 
 ### All other external packages listed alphabetically
   autoconf:
diff --git a/configs/sites/linux.default/modules.yaml b/configs/sites/linux.default/modules.yaml
index 3341f991c..57e6be9fe 100644
--- a/configs/sites/linux.default/modules.yaml
+++ b/configs/sites/linux.default/modules.yaml
@@ -3,7 +3,7 @@ modules:
     enable::
     - tcl
     tcl:
-      whitelist:
+      include:
       # List of packages for which we need modules that are blacklisted by default
       - openmpi
       - mpich
diff --git a/configs/sites/macos.default/modules.yaml b/configs/sites/macos.default/modules.yaml
index 266afdf3c..66048a90e 100644
--- a/configs/sites/macos.default/modules.yaml
+++ b/configs/sites/macos.default/modules.yaml
@@ -3,7 +3,7 @@ modules:
     enable::
     - lmod
     lmod:
-      whitelist:
+      include:
       # List of packages for which we need modules that are blacklisted by default
       - openmpi
       - mpich
diff --git a/configs/sites/macos.default/packages.yaml b/configs/sites/macos.default/packages.yaml
index ad72fe5a7..08c7436e1 100644
--- a/configs/sites/macos.default/packages.yaml
+++ b/configs/sites/macos.default/packages.yaml
@@ -1,4 +1,9 @@
 packages:
+  libiconv:
+    buildable: false
+    externals:
+    - spec: libiconv@1.17
+      prefix: /usr
   wgrib2:
     variants: ~openmp
   cairo:
diff --git a/configs/sites/narwhal/modules.yaml b/configs/sites/narwhal/modules.yaml
index 07cc3c509..9724c405d 100644
--- a/configs/sites/narwhal/modules.yaml
+++ b/configs/sites/narwhal/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - tcl
     tcl:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/nautilus/modules.yaml b/configs/sites/nautilus/modules.yaml
index cf9e47b1c..fb279947b 100644
--- a/configs/sites/nautilus/modules.yaml
+++ b/configs/sites/nautilus/modules.yaml
@@ -3,8 +3,8 @@ modules:
     enable::
     - tcl
     tcl:
-      whitelist:
+      include:
       # List of packages for which we need modules that are blacklisted by default
       - python
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/nautilus/packages.yaml b/configs/sites/nautilus/packages.yaml
index f664ac383..2a403c439 100644
--- a/configs/sites/nautilus/packages.yaml
+++ b/configs/sites/nautilus/packages.yaml
@@ -45,7 +45,7 @@ packages:
 ### Modifications of common packages
   # Version 2.0.8 doesn't compile on Nautilus
   wgrib2:
-    version:: [3.1.1]
+    version:: ['3.1.1']
 
 ### All other external packages listed alphabetically
   autoconf:
diff --git a/configs/sites/noaa-aws/modules.yaml b/configs/sites/noaa-aws/modules.yaml
index 7728eff92..8264ecf47 100644
--- a/configs/sites/noaa-aws/modules.yaml
+++ b/configs/sites/noaa-aws/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/orion/modules.yaml b/configs/sites/orion/modules.yaml
index 7728eff92..8264ecf47 100644
--- a/configs/sites/orion/modules.yaml
+++ b/configs/sites/orion/modules.yaml
@@ -3,5 +3,5 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
diff --git a/configs/sites/orion/packages.yaml b/configs/sites/orion/packages.yaml
index 046c0e67a..707826850 100644
--- a/configs/sites/orion/packages.yaml
+++ b/configs/sites/orion/packages.yaml
@@ -46,7 +46,7 @@ packages:
 ### Modifications of common packages
   # Versions 1.73+ don't compile on orion (bootstrap.sh fails)
   boost:
-    version:: [1.72.0]
+    version:: ['1.72.0']
 
 ### All other external packages listed alphabetically
   autoconf:
diff --git a/configs/sites/s4/modules.yaml b/configs/sites/s4/modules.yaml
index e6d6fac4b..039d7d19c 100644
--- a/configs/sites/s4/modules.yaml
+++ b/configs/sites/s4/modules.yaml
@@ -3,7 +3,7 @@ modules:
     enable::
     - lmod
     lmod:
-      blacklist:
+      exclude:
       - ecflow
-      whitelist:
+      include:
       - mpich
diff --git a/configs/sites/s4/packages.yaml b/configs/sites/s4/packages.yaml
index 705038e20..4a7263b78 100644
--- a/configs/sites/s4/packages.yaml
+++ b/configs/sites/s4/packages.yaml
@@ -35,7 +35,7 @@ packages:
       - miniconda/3.9.12
   # Versions 1.73+ don't compile on s4 (bootstrap.sh fails)
   boost:
-    version:: [1.72.0]
+    version:: ['1.72.0']
 
 ### All other external packages listed alphabetically
   autoconf:
diff --git a/configs/templates/skylab-dev/spack.yaml b/configs/templates/skylab-dev/spack.yaml
index 65a22bf5f..17f117197 100644
--- a/configs/templates/skylab-dev/spack.yaml
+++ b/configs/templates/skylab-dev/spack.yaml
@@ -8,13 +8,13 @@ spack:
   definitions:
   - compilers: ['%aocc', '%apple-clang', '%gcc', '%intel']
   - packages:
-      - ewok-env@skylab-dev
-      - jedi-fv3-env@skylab-dev
-      - jedi-mpas-env@skylab-dev
-      - jedi-neptune-env@skylab-dev
-      - jedi-ufs-env@skylab-dev
-      - jedi-um-env@skylab-dev
-      - soca-env@skylab-dev
+      - ewok-env
+      - jedi-fv3-env
+      - jedi-mpas-env
+      - jedi-neptune-env
+      - jedi-ufs-env
+      - jedi-um-env
+      - soca-env
 
       # Additional crtm tags
       - crtm@v2.4-jedi.2
diff --git a/configs/templates/unified-dev/spack.yaml b/configs/templates/unified-dev/spack.yaml
index bedb4de90..caf4df879 100644
--- a/configs/templates/unified-dev/spack.yaml
+++ b/configs/templates/unified-dev/spack.yaml
@@ -8,22 +8,22 @@ spack:
   definitions:
   - compilers: ['%aocc', '%apple-clang', '%gcc', '%intel']
   - packages:
-      - global-workflow-env@unified-dev
-      #- gsi-env@unified-dev
-      - ewok-env@unified-dev
-      - jedi-fv3-env@unified-dev
-      - jedi-mpas-env@unified-dev
-      - jedi-neptune-env@unified-dev
-      - jedi-tools-env@unified-dev
-      - jedi-ufs-env@unified-dev
-      - jedi-um-env@unified-dev
-      #- nceplibs-env@unified-dev
-      - soca-env@unified-dev
-      - ufs-srw-app-env@unified-dev
-      #- ufs-utils-env@unified-dev
-      - ufs-weather-model-env@unified-dev
-      #- upp-env@unified-dev
-      #- ww3-env@unified-dev
+      - global-workflow-env
+      #- gsi-env
+      - ewok-env
+      - jedi-fv3-env
+      - jedi-mpas-env
+      - jedi-neptune-env
+      - jedi-tools-env
+      - jedi-ufs-env
+      - jedi-um-env
+      #- nceplibs-env
+      - soca-env
+      - ufs-srw-app-env
+      #- ufs-utils-env
+      - ufs-weather-model-env
+      #- upp-env
+      #- ww3-env
 
       # Additional esmf/mapl tags
       #- esmf@8.4.2~debug+external-parallelio
diff --git a/doc/source/NewSiteConfigs.rst b/doc/source/NewSiteConfigs.rst
index 1acd0220d..da9b9c451 100644
--- a/doc/source/NewSiteConfigs.rst
+++ b/doc/source/NewSiteConfigs.rst
@@ -203,10 +203,8 @@ Remember to activate the ``lua`` module environment and have MacTeX in your sear
 
 .. code-block:: console
 
-   spack external find --scope system # use '--exclude' for troublesome packages like bison@:3.3
+   spack external find --scope system # use '--exclude' for troublesome packages like bison@:3.3, openssl@1.1.1
    spack external find --scope system perl
-   # Don't use any external Python, let spack build it
-   #spack external find --scope system python
    spack external find --scope system wget
    spack external find --scope system mysql
 
@@ -434,10 +432,8 @@ It is recommended to increase the stacksize limit by using ``ulimit -S -s unlimi
 
 .. code-block:: console
 
-   spack external find --scope system
+   spack external find --scope system # use '--exclude' for troublesome packages like bison@:3.3, openssl@1.1.1
    spack external find --scope system perl
-   # Don't use any external Python, let spack build it
-   #spack external find --scope system python
    spack external find --scope system wget
    spack external find --scope system mysql
    spack external find --scope system texlive
diff --git a/spack b/spack
index 6a9dd3983..d00539433 160000
--- a/spack
+++ b/spack
@@ -1 +1 @@
-Subproject commit 6a9dd3983e8e371b3c423fb48ecbaf9c40201506
+Subproject commit d00539433606d917b3c45b8e6c5990485744a009