Why not just cherry-pick 1e9deaa?

Bumping to 2.0 was the original idea in #30476. However I got the impression that a minimal fix might be more appreciated. Is there anything arguing against just (quickly) fixing the URL?

If this were just a quick fix of the URL, there would not be a hash change.

That's correct. The tarball was re-generated on github by the original author (Chris00/ocaml-csv#20). I have no idea why the hash changed, and I cannot check without access to the original file.

However, why would your use the 2.0 tarball but not trust the 1.7 tarball? Both are available from the same location, and both were apparently generated by the same person.

I trust both tarballs equally: can you please elaborate on the tests you’ve performed?

@vbgl: Nothing special.
My local nix-based build succeeded, apparently passed the package's unit tests, and installed.
Same here: https://travis-ci.org/NixOS/nixpkgs/jobs/289842399