Being able to do this relies on both editing on the server, and for
the client to actually use the updated .cabal file. So this patch
provides the client side part of the feature. The server side already
works (we've actually made quite a few edits to .cabal files on
hackage post-release) but the UI for it will improve significantly in
the new server which we expect to go live during the lifetime of this
next cabal-install release. So getting the feature in now would be a
real help to everyone (and ideally, most users will never notice).

It worries me because now there's an invisible piece of metadata floating around that neither OS packagers nor library maintainers can see. In a way, this feels strictly worse than having a package just plain break, because it's not hard to imagine a cycle of "package breaks; magic invisible dependency update silently fixes it; new version is released; package re-breaks because maintainer never found out about previous breakage".

I could be convinced that in fact everything is going to be awesome and it will all somehow work, but in the short term I'd prefer to delay sprinkling invisible dependency pixie dust on packages, and let this wait until the next release, 3 months down the line.