allow a new dependency package to allowed list. backwards compatible.