Bug: build dep versions not enforced

It seems build dependencies on specific versions aren't actually enforced.

eg. golang-any <= x.y doesn't break if the requested minimum version isn't enforced, but silently installs the lower version,
it just picks the highest available one.
