make `outdated` ignore private packages

review please :)

fixes #6762
Now checking if `d` even exists because it won't if a dependency is missing (`test/tap/outdated-new-versions.js`).