expose dependencies
return a defensive copy