Updated so that only CPE Identifiers are used when "bundeling" dependencies