Not sure why my last comment which I have added earlier today is not visible. So I will do it again...

Ok, so lets skip that. I don't think we will have a problem here. Users who install the automation package directly are most likely devs and have all necessary tools installed. For end-users we provide mozmill-env which could pre-install mercurial as it is done now. So when mozmill-automation gets installed the dependency is already met. 

I would say lets get the strict version specifiers removed from mercurial and mozdownload, so that we can test newer releases. Inside the mozmill-env we will ship proven ones.

Once the file has been updated, I will do the testing around and if everything is fine, we can get it landed.