this should be renamed to ``whitelistDependencies``. It is about building the whitelist, not about what is updated