recipe dependencies aren't constrained by versions

[Dylan Jay]

Consider the following buildout

[buildout]
parts =
  filestorage
  instance

versions=versions

[filestorage]
recipe = collective.recipe.filestorage
...

[instance]
recipe = plone.recipe.zope2instance

[versions]
plone.recipe.zope2instance = 4.1.9

The problem comes about because the filestorage recipe lists plone.recipe.zope2instance as a dependency it it's setup.py
e.g.
      install_requires=['setuptools',
                        'zc.buildout',
                        'plone.recipe.zope2instance',
                        # -*- Extra requirements: -*-
                        ],

What seems to be happening is that plone.recipe.zope2instance is becoming part of the global working set as part of the initialisation of the filestorage part, but without versions being applied. This doesn't even raise a conflict error, but instead silently installs a later version of zope2instance. If you make the following change you will get a ConflictError

[instance]
recipe = plone.recipe.zope2instance==4.1.9