sync dependencies if package.private = true, close #38
Release 0.5.2