wrong and not understandable dependency added by stack solver

Question

I have a large and complex package which does compile on two computers but not on the third one (the files are moved by zip and scp). The error message is

In the dependencies for leksah-0.17.0.0:
    process-1.4.2.0 from stack configuration does not match >=1.4.3.0 && <1.7
                    (latest matching version is 1.6.4.0)
needed since leksah is a build target.

I cannot find where the process-1.4.2.0 comes from. It is not in the resolver lts 9.9 (the resolver gives process-1.4.3.0 Process libraries), nor in the cabal file for leksah. Where else should I look? (I have exact-match in the config).

the stack.yaml from global-project is

flags: {}
extra-package-dbs: []
packages: []
extra-deps: []
resolver: lts-10.4

the config.yaml contains (besides the templates) only compiler-check: match-exact.

the project stack.yaml is

resolver: lts-9.9
packages:
- '.'
- 'vendor/leksah-server'
- 'vendor/ltk'
- 'vendor/haskellVCSGUI/vcsgui'
#- 'vendor/yi'
- 'vendor/haskellVCSWrapper/vcswrapper'

# Dependency packages to be pulled from upstream that are not in the resolver
# (e.g., acme-missiles-0.3)
extra-deps:
- binary-shared-0.8.3
- haddock-api-2.17.4
- haskell-gi-overloading-0.0
- gi-gtk-hs-0.3.5.0
- gi-gtksource-3.0.15
- gi-javascriptcore-4.0.14
- gi-soup-2.4.14
- gi-webkit2-4.0.14
- gi-gdk-3.0.14
- gi-gdkpixbuf-2.0.14
- gi-glib-2.0.14
- gi-gobject-2.0.14
- gi-gtk-3.0.17
- gi-cairo-1.0.14
- gi-gio-2.0.14
- gi-pango-1.0.15
- gi-atk-2.0.14
- gi-gtkosxapplication-2.0.14

# Override default flag values for local packages and extra-deps
flags:
  gi-atk:
    enable-overloading: false
  gi-cairo:
    enable-overloading: false
  gi-gdk:
    enable-overloading: false
  gi-gdkpixbuf:
    enable-overloading: false
  gi-gio:
    enable-overloading: false
  gi-glib:
    enable-overloading: false
  gi-gobject:
    enable-overloading: false
  gi-gtk:
    enable-overloading: false
  gi-gtk-hs:
    enable-overloading: false
  gi-gtksource:
    enable-overloading: false
  gi-javascriptcore:
    enable-overloading: false
  gi-pango:
    enable-overloading: false
  gi-soup:
    enable-overloading: false
  gi-webkit2:
    enable-overloading: false
  gi-gtkosxapplication:
    enable-overloading: false

# Extra package databases containing global packages
extra-package-dbs: []

the cabal files contain (the first is the relevant one for the project, the others are in the packages) - none of them is asking for process-1.4.2.0

   process >=1.4.3.0 && <1.7,
    process >= 1.0.1.1,
    process >=1.0.1.5 && <1.7,
    process >=1.0.1.5 && <1.7,
    process >=1.0.1.5 && <1.7,
    process >=1.0.1.5 && <1.7,
    process >=1.0.1.5 && <1.7,
    process >=1.1 && <1.7,
    process >=1.1 && <1.7,
    process >=1.1 && <1.7,
    process >=1.1 && <1.7,

adding process-1.4.3.0 to the extra deps resolves the requirements - but WHY IS THIS NECESSARY? it is in lts 9.9! - It does, as expected, not compile - there must be other packages not selected the same than on the other computer.