add support for source for top level dependencies, fix 'by-extra' -> use source info