The code was assuming that such dependencies had always exact versions, which is of course not always true (it should, however, be true for dependencies with a "path" field).