no need to collect the dep keys. npm-normalize already does this