package dependency should be usable without a github key