If we can't list sources, assume that the dependency hasn't changed.

Fixes #1397.