stdenv.mkDerivation: warn when overriding version without also overriding src (#406535)

pkgs/applications/editors/neovim/build-neovim-plugin.nix

@@ -26,6 +26,7 @@ let
 
   luaDrv = originalLuaDrv.overrideAttrs (oa: {
     version = attrs.version or oa.version;
+    __intentionallyOverridingVersion = true;
     rockspecVersion = oa.rockspecVersion;
 
     extraConfig = ''
@@ -43,6 +44,7 @@ let
           lua.pkgs.luarocksMoveDataFolder
         ];
         version = "${originalLuaDrv.version}-unstable-${oa.version}";
+        __intentionallyOverridingVersion = true;
       }
     )
   );

pkgs/applications/video/obs-studio/default.nix

@@ -67,6 +67,7 @@ let
 
   cef = cef-binary.overrideAttrs (oldAttrs: {
     version = "127.3.5";
+    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
     gitRevision = "114ea2a";
     chromiumVersion = "127.0.6533.120";
 

pkgs/by-name/bo/bolt-launcher/package.nix

@@ -23,6 +23,7 @@
 let
   cef = cef-binary.overrideAttrs (oldAttrs: {
     version = "126.2.18";
+    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
     gitRevision = "3647d39";
     chromiumVersion = "126.0.6478.183";
 

pkgs/by-name/li/linux-wallpaperengine/package.nix

@@ -33,6 +33,7 @@
 let
   cef = cef-binary.overrideAttrs (oldAttrs: {
     version = "120.1.10";
+    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
     gitRevision = "3ce3184";
     chromiumVersion = "120.0.6099.129";
 

pkgs/development/lua-modules/overrides.nix

@@ -109,6 +109,7 @@ in
         rev = lib.last (lib.splitString "-" (lib.last rel));
       in
       "${date}-${rev}";
+    __intentionallyOverridingVersion = true;
 
     meta.broken = luaOlder "5.1" || luaAtLeast "5.5";
 

pkgs/stdenv/generic/make-derivation.nix

@@ -87,7 +87,48 @@ let
       args = rattrs (args // { inherit finalPackage overrideAttrs; });
       #              ^^^^
 
-      overrideAttrs = f0: makeDerivationExtensible (lib.extends (lib.toExtension f0) rattrs);
+      overrideAttrs =
+        f0:
+        let
+          extends' =
+            overlay: f:
+            (
+              final:
+              let
+                prev = f final;
+                thisOverlay = overlay final prev;
+                warnForBadVersionOverride = (
+                  thisOverlay ? version
+                  && !(thisOverlay ? src)
+                  && !(thisOverlay.__intentionallyOverridingVersion or false)
+                );
+                pname = args.pname or "<unknown name>";
+                version = args.version or "<unknown version>";
+                pos = builtins.unsafeGetAttrPos "version" thisOverlay;
+              in
+              lib.warnIf warnForBadVersionOverride ''
+                ${
+                  args.name or "${pname}-${version}"
+                } was overridden with `version` but not `src` at ${pos.file or "<unknown file>"}:${
+                  builtins.toString pos.line or "<unknown line>"
+                }:${builtins.toString pos.column or "<unknown column>"}.
+
+                This is most likely not what you want. In order to properly change the version of a package, override
+                both the `version` and `src` attributes:
+
+                hello.overrideAttrs (oldAttrs: rec {
+                  version = "1.0.0";
+                  src = pkgs.fetchurl {
+                    url = "mirror://gnu/hello/hello-''${version}.tar.gz";
+                    hash = "...";
+                  };
+                })
+
+                (To silence this warning, set `__intentionallyOverridingVersion = true` in your `overrideAttrs` call.)
+              '' (prev // (builtins.removeAttrs thisOverlay [ "__intentionallyOverridingVersion" ]))
+            );
+        in
+        makeDerivationExtensible (extends' (lib.toExtension f0) rattrs);
 
       finalPackage = mkDerivationSimple overrideAttrs args;