The original dependency resolution did not correctly resolve version or
URL of a dependency. Version was tracked by filename, and URL was
assumed to be absolute. This fixes both of those.

Closes #1277