audit: loop over deps once