In reply to @maralorn:maralorn.de
We sometimes do. But are you aware of https://github.com/cdepillabout/nix-haskell-updates-status ?

I'm trying to build a package that depends on the patched version of hackage-security, which cabal-install depends on. I overrided it by

pkgs.haskellPackages.override {
  overrides = hself: hsuper: {
    hackage-security = hself.callCabal2nix "hackage-security" "${inputs.hackage-security}/hackage-security" { };
  };
}

Then it tries to rebuild cabal-instsall(I don't like it but it's ok for now) and it failed with the following warning

Warning:
    This package indirectly depends on multiple versions of the same package. This is very likely to cause a compile failure.
      package hackage-security (hackage-security-0.6.3.1-6FXzfmwRBZgCJn05f7VkJU) requires Cabal-syntax-3.10.3.0-244a
      package hackage-security (hackage-security-0.6.3.1-JJgg9sy4JLR8toAcIe55uU) requires Cabal-syntax-3.14.2.0-7o58PFlrICd6tJLSPh82PA
      package cabal-install-solver (cabal-install-solver-3.14.2.0-TJt26BmojeJY4tNaxYAXR) requires Cabal-syntax-3.14.2.0-7o58PFlrICd6tJLSPh82PA
      package cabal-install (cabal-install-3.14.2.0-6ZRHmRwRC2EC3Abb988gBz) requires Cabal-syntax-3.14.2.0-7o58PFlrICd6tJLSPh82PA
      package Cabal (Cabal-3.14.2.0-HaQDVkRM9JfAEDDKZRGu1s) requires Cabal-syntax-3.14.2.0-7o58PFlrICd6tJLSPh82PA