Bug 237437

I have configured 2 repositories for pkg:
default - current version of all ports installed on the machine, priority 0
ossec-hids - future versions of ossec-hids* ports (I am the maintainer), priority 1

The ossec-hids* ports in "default" repository have version 3.1.0 and in "ossec-hids" repository have version 3.2.0. Other ports (dependencies) that exist in both repositories have the same version. All ports that exist in both repositories have same options.

# pkg install ossec-hids-server-config

gives proper result trying to install the newer version of ossec-hids, but strangely postgresql10-client dependency is incorrectly taken from "default" repository:

New packages to be INSTALLED:
	ossec-hids-server-config: 3.2.0 [ossec-hids]
	ossec-hids-server: 3.2.0 [ossec-hids]
	openssl: 1.0.2r,1 [ossec-hids]
	expect: 5.45.4_1,1 [ossec-hids]
	tcl86: 8.6.9_1 [ossec-hids]
	libinotify: 20180201_1 [ossec-hids]
	postgresql10-client: 10.7_2 [default]
	perl5: 5.28.1_1 [ossec-hids]
	readline: 8.0.0 [ossec-hids]
	indexinfo: 0.3.1 [ossec-hids]

# pkg install security/ossec-hids-server-config

gives wrong result trying to install old version of ossec-hids, but surprisingly the postgresql10-client dependency is correctly taken from "ossec-hids" repository:

New packages to be INSTALLED:
	ossec-hids-server-config: 3.1.0_1 [default]
	ossec-hids-server: 3.1.0_3 [default]
	openssl: 1.0.2r,1 [default]
	expect: 5.45.4_1,1 [default]
	tcl86: 8.6.9_1 [default]
	readline: 8.0.0 [default]
	indexinfo: 0.3.1 [default]
	libinotify: 20180201_1 [default]
	postgresql10-client: 10.7_2 [ossec-hids]
	perl5: 5.28.1_1 [default]

Note that the postgresql10-client is the same in both repositories so selection of the wrong repository does little harm in this particular case.